Summary
Five points for those who don't have time to read it all.
- CBG collects only the data users voluntarily provide (name, company, email, engagement context) and aggregated technical navigation data.
- Data is used to respond to inquiries, execute contracted engagements and comply with regulatory obligations. CBG does not use it for behavioral marketing or tracking.
- CBG does not sell, rent or commercialize personal data. Sharing occurs only with contracted operators, BOKS member firms when needed, or by legal requirement.
- The data subject has all rights guaranteed by art. 18 of the LGPD: access, correction, deletion, portability and consent revocation.
- Data Protection Officer: Carlos Bernardo Gonçalves · carlos.bernardo@cbgvaluation.com
1. Who we are
CBG Assessoria Empresarial Ltda. (trade name CBG Valuation Services), registered under CNPJ No. 66.665.933/0001-06, with headquarters at Av. Rio Branco, 131, suite 1003, Centro, Rio de Janeiro/RJ, Brazil, is the controller of personal data collected through cbgvaluation.com.
This policy describes what data we collect, the purposes of processing, retention periods and the rights data subjects may exercise.
2. Data we collect
2.1. Data provided voluntarily
When users complete the contact form or send a message by email, we collect:
- Full name
- Company or organization represented
- Professional email address
- Telephone (optional)
- Nature of the engagement of interest
- Context of the engagement described by the user
- How the user heard about CBG (optional)
When users sign up to receive publications, we collect name, professional email and company, used solely for that purpose. Users can unsubscribe at any time by email.
2.2. Data collected automatically
When users navigate the website, the servers of Cloudflare, which hosts the site, record technical access data. When audience measurement is active, it uses Cloudflare Web Analytics, which does not use cookies and produces aggregated statistics only. These records may include:
- IP address and approximate geolocation data
- Device type, operating system and browser
- Pages visited and date and time of access
- Referring page (address of the page that led to the site)
The site's typefaces are loaded from Google Fonts, which receives the visitor's IP address and browser type in order to deliver the font files and sets no cookies.
3. Processing purposes
Personal data is processed for the following purposes:
- Response to contact: reply to inquiries sent via form or email, scheduling exploratory meetings and follow-up on commercial discussions.
- Execution of contracted engagements: processing of professional data necessary for the conduct of valuation engagements, fairness opinions, due diligence and other contracted services, as per scope defined in contract.
- Compliance with legal and regulatory obligations: retention of records required by tax, corporate law, and the normative framework of CFC, CRC, CVM and other entities applicable to the practice.
- Statistical navigation analysis: website improvement, audience measurement and production of relevant technical content. Data is aggregated and anonymized whenever possible.
- Occasional technical communications: sending of publications, white papers and webinar invitations, only with explicit user consent.
4. Legal basis for processing
CBG's processing of personal data is grounded on the following legal bases set forth in art. 7 of the LGPD:
- Consent (art. 7, I): for marketing communications and recurring technical content distribution.
- Performance of contract or preliminary procedures (art. 7, V): for processing arising from contracted engagements or under negotiation.
- Compliance with legal or regulatory obligation (art. 7, II): for record retention required by regulation.
- Legitimate interest (art. 7, IX): for aggregated statistical navigation analysis, always observing the balancing with the data subject's fundamental rights and freedoms.
5. Data sharing
CBG does not sell, rent or commercialize personal data. Sharing occurs only in the following situations:
- Operators and service providers: email providers, website hosting, IT infrastructure and analytics tools. All subject to contracts with data protection clauses.
- BOKS International member firms: exclusively for engagements with international components, with prior client consent and within the scope of the contracted mandate.
- Competent authorities: when required by law, judicial order or request from competent public authority.
6. Data retention
Personal data is retained for the period necessary to fulfill the stated purposes. As reference:
- Commercial contact data without contracted engagement: up to 3 years after last contact, unless the data subject requests otherwise.
- Documentation of contracted engagements: 10 years after the conclusion of the engagement, in compliance with applicable accounting and tax rules.
- Technical access records: kept by Cloudflare, which hosts the site, for the periods set in Cloudflare's privacy policy.
After the retention period, data is deleted or anonymized.
7. Data subject rights
Per art. 18 of the LGPD, data subjects have the right to:
- Confirm the existence of processing
- Access their data
- Correct incomplete, inaccurate or outdated data
- Anonymize, block or eliminate unnecessary or non-compliantly processed data
- Data portability to another provider
- Eliminate data processed under consent, subject to legal retention exceptions
- Information about public and private entities with which CBG has shared data
- Revoke consent
- Object to processing based on legal grounds other than consent, when there is non-compliance with the LGPD.
To exercise any of these rights, the data subject may contact us through the channels listed at the end of this policy.
8. Cookies
The website sets no cookies. The only information the website stores in the browser is a record that the privacy notice has been read, with the date it was read. That record stays in the browser's local storage and is never sent to CBG.
Audience measurement, when active, uses Cloudflare Web Analytics, which does not use cookies or identify visitors. The notice record can be deleted at any time in the browser settings, by clearing the site data.
9. Information security
CBG adopts reasonable technical and administrative measures to protect personal data against unauthorized access, accidental loss and destruction. This includes access control, encryption of data in transit, periodic backup and personnel training on data protection.
Nevertheless, no internet transmission or electronic storage is absolutely secure. The data subject acknowledges this residual risk when providing data through the website.
10. International transfer
In engagements with international components, personal data may be transferred to BOKS International member firms in other jurisdictions, subject to art. 33 of the LGPD and through specific contractual safeguards.
11. Changes to this policy
CBG may update this policy periodically. The current version is always the one published on this page, with the last update date indicated above. Material changes will be communicated via email to registered contacts when applicable.
12. Data Protection Officer contact
The data subject may also file a complaint with the Brazilian National Data Protection Authority (ANPD), through the official channels available at www.gov.br/anpd.