1. Who we are and how to reach us

Tech86 (referred to as "Tech86", "we") operates tech86.com.br and provides hosting, cloud infrastructure, cybersecurity and software engineering services. In the relationship with you, visitor, client and data subject, Tech86 acts as the controller of the personal data described in this policy.

For privacy and data protection matters, contact our Data Protection Officer (DPO):

• Dedicated channel: [email protected]
• General channel: [email protected]
• Formal exercise of rights: the LGPD Portal form at /lgpd

2. Data we process

We collect only what each purpose requires, in the following categories:

• Registration and contact: name, e-mail, phone/WhatsApp, company and revenue range you provide in site forms.
• Contracting and payment: contracted services, configurations, domains, order history, invoices and payments. Card data is not stored by Tech86: processing happens in the payment gateway environment.
• Service usage: technical logs (IP address, date and time, accessed resources) generated by the operation and security of the services, and the content you host with us.
• Site navigation: cookies and usage metrics, according to your consent preferences (section 4).
• Support and communication: e-mails, WhatsApp messages, tickets and records of interactions with our teams.

3. Legal bases and purposes

Every processing activity relies on the Brazilian General Data Protection Law (LGPD, Law 13.709/2018):

Purpose	Data used	Legal basis (art. 7)
Provision, operate, invoice and support contracted services	Registration, contracting, service usage	Contract performance
Respond to requests via forms, e-mail and WhatsApp	Registration and contact	Contract performance and legitimate interest
Commercial communication about products and campaigns	Registration and contact	Consent
Information security, anti-spam and abuse/fraud prevention	Technical logs, IP	Legitimate interest
Compliance with legal and regulatory obligations	Contracting, invoicing, connection logs	Legal obligation
Continuous improvement of the site and services	Aggregated navigation	Legitimate interest

4. Cookies and preferences

We use three cookie categories, manageable at any time through the site consent banner:

• Essential: session, your consent choice and form anti-spam verification. The site does not work correctly without them.
• Analytics: aggregated usage metrics (via Google Tag Manager) to understand and improve the site.
• Marketing: campaign measurement and relevant content.

Refusing non-essential cookies does not prevent browsing. Preferences can be changed at any time through the cookie banner.

5. Sharing and operators

Tech86 does not sell, rent or trade personal data. Sharing happens only with operators contracted for service delivery (under data processing agreements) and in legal hypotheses:

Operator	Role	Shared data
Tech86 Panel (CRM, billing and support platform)	Client, order, ticket and contract management	Registration, contracting, support
MDH Corporate - Datacenter no Brasil	Infrastructure for the Brazil VPS, Windows VPS, semi-dedicated, outlet, cPanel reseller and streaming lines	Registration data required for provisioning and support
20i Ltd	Infrastructure for the international lines: cloud servers, web hosting, WordPress, WooCommerce, Magento, VPS and Node.js	Registration data required for provisioning and support
Vultr	Cloud infrastructure for the Managed Cloud	Registration data required for provisioning and support
Cloudflare	CDN, WAF, DDoS protection, form anti-spam verification and workers	IP and technical navigation data
Resend	Delivery of transactional site e-mails	Name, e-mail and message content
Payment gateways	Processing of Pix, bank slip and card payments	Billing data
Public authorities	Compliance with court orders and legal obligations	Only what the law requires

When you host third-party data on our services (for example, your clients' data on a hosted site), you act as the controller of that data and Tech86 acts as the operator, processing it only per your instructions and this policy.

6. International transfers

• Brazilian lines (Brazil VPS, Windows VPS, semi-dedicated, cPanel resellers and streaming): hosting in datacenters in São Paulo, Brazil.
• International lines (20i Ltd, United Kingdom; Vultr and Cloudflare, with global regions): international data transfers under art. 33 of the LGPD, with adequate contractual safeguards and exclusively for the purposes of this policy.
• The site and panel use Cloudflare's global network; client records remain in systems under Tech86 control.

7. Retention and disposal

We keep data only as long as each purpose requires:

Data	Period	Basis
Connection and access logs (application)	6 months	Brazilian Internet Civil Framework, art. 15
Fiscal records, orders and invoices	5 years	Legal and tax obligations
Registration and contracting of active clients	For the duration of the relationship	Contract performance
Registration and contracting after the relationship ends	Up to 5 years, for defense in legal claims and legal obligations	Legitimate interest and legal obligation
Form data that does not convert into clients	Up to 24 months	Legitimate interest
Service backups	Rotating cycle of the infrastructure provider of each line, disposed at the end of the cycle	Security and integrity
Data subject request records	As long as needed to evidence compliance	Legal obligation

At the end of each period, data is deleted or anonymized.

8. Information security

We adopt industry-standard practices, reviewed periodically:

• Encryption in transit (TLS) across the site and panels.
• WAF, DDoS protection and edge protections via Cloudflare.
• Anti-spam verification (Turnstile) on all forms.
• Least-privilege access control across teams.
• Continuous monitoring and periodic security reviews.
• Service isolation and infrastructure hardening best practices.

No system is absolutely immune; section 11 describes how we act in incidents.

9. Data subject rights

You, as a data subject, can exercise the rights of art. 18 of the LGPD at any time:

1. Confirmation of processing: know whether we process your data.
2. Access to data: obtain a copy of the data we process about you.
3. Correction: request correction of incomplete, inaccurate or outdated data.
4. Anonymization, blocking or deletion: of unnecessary, excessive or unlawfully processed data.
5. Portability: request the transfer of your data to another service provider.
6. Deletion of data processed on the basis of consent.
7. Information about sharing: know with whom we share your data.
8. Information about consent: know the consequences of not providing consent.
9. Withdrawal of consent, when processing relies on it.
10. Opposition and review in cases of automated processing that affects your interests.

How to exercise: through the LGPD Portal form at /lgpd or the DPO e-mail ([email protected]). Some rights can be exercised directly in the client panel, without a formal request.

10. Response times

We answer data subject requests within 15 days of receipt. When a case requires a longer period, we communicate the extension and its reason before the deadline.

11. Security incidents

If a security incident may cause relevant risk or harm to you, we will notify the affected data subject and the Brazilian National Data Protection Authority (ANPD) within a reasonable period, informing the nature of the affected data, the containment measures and protection recommendations.

12. Complaints

If you believe your rights were not honored, contact us first ([email protected]). You may also file a complaint directly with the Brazilian National Data Protection Authority (ANPD) through its official channel at gov.br/anpd.

13. Changes to this policy

This policy may be updated to reflect changes in the services, the infrastructure providers or the legislation. The current version, with its effective date and change history, is always available on this page. Relevant processing changes are communicated by e-mail to affected clients.