Version: July 2026
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
Joya Assessoria Contabil LTDA
Avenida Nova Cantareira, 1740, Sala 2
Tucuruvi — Sao Paulo/SP
Postal Code: 02330-000
Brazil
CNPJ: 53.102.422/0001-34
Manager: Jose Roberto Oliveira Costa
E-mail: [email protected]
The appointment of a data protection officer is not required, since our company does not permanently employ at least twenty people assigned to the automated processing of personal data. For any question relating to data protection, you may contact the e-mail address indicated above at any time.
When our site is accessed, the browser used on your device automatically transmits the following information to our site's server, where it is stored temporarily in log files:
The data mentioned is processed for the following purposes: ensuring a smooth connection to the site, ensuring comfortable use of our site, evaluating system security and stability, as well as other administrative purposes.
Legal basis: Article 6(1)(f) GDPR (legitimate interest). Our legitimate interest arises from the collection purposes set out above, in particular the security and stability of our site.
Retention period: The data is erased as soon as it is no longer necessary for the purpose for which it was collected. Where data is collected for the provision of the site, this is the case at the end of the session concerned. Server log files are automatically erased after 7 days at the latest.
If you send us an inquiry via the contact form, the information you provide there, including the contact details you enter, is retained by us for the purpose of processing the inquiry and in case follow-up questions arise. The following data is collected on this occasion:
We do not pass this data on without your consent.
Legal basis: Article 6(1)(b) GDPR (performance of pre-contractual measures taken at the request of the data subject). Insofar as your inquiry does not concern the conclusion of a contract, the legal basis is Article 6(1)(f) GDPR (legitimate interest in the efficient handling of inquiries addressed to us).
Retention period: The data you enter in the contact form is retained until you ask us to erase it, until you withdraw your consent to its retention, or until the purpose of retention ceases to apply. Mandatory statutory provisions — in particular retention periods — remain reserved.
Our site uses exclusively technically necessary cookies. These are small text files that your browser creates automatically and that are stored on your device when you visit our site.
Technically necessary cookies are exempt from the requirement to obtain consent, since they are strictly necessary for the operation of the site. These cookies cannot be disabled.
We use no tracking, analytics, or advertising cookies without your prior express consent. Where applicable, this consent is obtained via our cookie consent banner.
Legal basis for technically necessary cookies: Article 6(1)(f) GDPR (legitimate interest in the operation of the site).
Legal basis for optional cookies: Article 6(1)(a) GDPR (consent).
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter « Google »).
Purpose: We use Google Ads conversion tracking in order to measure the effectiveness of our advertising campaigns. When you click on an ad served by Google, a conversion tracking cookie is stored on your device. These cookies expire after 30 days and do not serve for personal identification.
If you visit certain pages of our site while the cookie has not yet expired, Google and we can determine that you clicked on the ad and were redirected to this page. Each Google Ads customer receives a different cookie. The information obtained by means of conversion cookies serves to compile conversion statistics for Ads customers who have opted for conversion tracking.
Legal basis: Article 6(1)(a) GDPR (consent). The conversion tracking cookie is placed only if you have given your consent via our cookie consent banner. You may withdraw your consent at any time, with effect for the future.
Transfer of data to third countries: Google may transfer the collected data to the United States. This transfer takes place on the basis of the EU–US Data Privacy Framework. You will find further information in Google's privacy rules: https://policies.google.com/privacy.
If a payment obligation exists after the conclusion of the contract, we use an external payment provider to process the payment. Your payment data (e.g. bank card number, bank details) is transmitted directly to the payment provider and processed there.
At no time do we retain complete bank card or bank account data on our servers. The payment provider transmits to us only a confirmation of the success or failure of the payment as well as, where applicable, a transaction identifier permitting reconciliation.
Legal basis: Article 6(1)(b) GDPR (performance of the contract). Processing the payment data is necessary for the performance of the contract concluded between you and us.
As the registered office of our company is located in Brazil, personal data is transferred to a third country. Brazil is a third country outside the European Union. The transfer of personal data to Brazil takes place on the basis of Article 49(1)(a) GDPR (explicit consent) or Article 49(1)(b) GDPR (performance of the contract). Brazil has its own data protection law, the Lei Geral de Proteção de Dados (LGPD).
Protective measures: Insofar as personal data is transferred to recipients located in third countries not covered by the adequacy decision relating to the Data Privacy Framework, we ensure by means of appropriate safeguards that the rights of the data subjects are duly protected. To this end, we conclude European Union standard contractual clauses in accordance with Article 46(2)(c) GDPR.
In exceptional cases, the transfer may be based on your explicit consent in accordance with Article 49(1)(a) GDPR. In that case, you are informed of the possible risks before the transfer.
You have the following rights with respect to the controller concerning your personal data:
To exercise your rights, please write to us by e-mail at: [email protected]. We will handle your request without delay and at the latest within one month.
Without prejudice to any other administrative or judicial remedy, you have the right, in accordance with Article 77 GDPR, to lodge a complaint with a supervisory authority if you consider that the processing of your personal data constitutes an infringement of the GDPR.
You may exercise this right before a supervisory authority of the Member State of your residence, your place of work, or the place of the alleged infringement. In France, the competent authority is the Commission nationale de l'informatique et des libertés (CNIL): https://www.cnil.fr.
We reserve the right to adapt this privacy policy in order to bring it into line with a change in the legal framework or with modifications to the service or to data processing. This applies, however, only to statements relating to data processing. Where consent is required or where elements of the privacy policy contain provisions relating to the contractual relationship with users, changes are made only with the users' agreement.
The version in force is available on this page at all times. We invite you to review the content of our privacy policy regularly.
Version: July 2026