Privacy notice

Who we are

Rivera Brazil is the international service of Agência Rivera de Consultoria em Comunicação, Tradução, Edição e Publicidade Ltda., a Brazilian company (company registration number, CNPJ, 42.968.216/0001-95) at Rua Vinte e Dois, 849, Centro, Santa Fé do Sul, SP, 15775-000, Brazil.

We decide why and how the data in this notice is used, so we are its controller under Brazil’s General Personal Data Protection Law (LGPD, Law No. 13,709/2018) and, where they apply, under the EU General Data Protection Regulation (GDPR) and its UK version, the UK GDPR.

For anything about your personal data, write to privacy@riverabrazil.com. For everything else, hello@riverabrazil.com.

What we collect

When you browse the site. The site sets no cookies, runs no analytics, and loads nothing from other servers. Our host, Hostinger, keeps standard logs of each request the server receives: your internet protocol (IP) address, the time, the address of the page or file requested, and the browser and device details your browser sends. The short forms on our pages (numbers of recordings and minutes, a debrief date, the options and questions you check) put your answers in the page address, so those values appear in the logs too. They don’t ask for your name, email address, or message.

When you use the quote form. Your name, email address, and message, and your organization if you give it. Also the project details you choose to share: what you’re asking for (a quote, a pilot, a budget figure, fieldwork, or written answers for an ethics committee), the service, the number and length of recordings, including how many are interviews and how many are focus groups, voices, notes about the audio, the language and style you need, extras, your deadline, a debrief date, the agreements you ask about, the data-security topics you want answered in writing, and the page you came from. The email we receive contains these fields and nothing else; it doesn’t include your IP address. Please don’t put participant names or other research data in the message.

When you email us. Your address, your name as it appears in your email, what you write, any attachments, and the routing details that email systems add to every message.

If you send research data by mistake. Please don’t send recordings, participant information, health data, or other research data through the form or by ordinary email. If we receive such material unexpectedly, we restrict access to it and don’t use it. Unless a client instructs us otherwise or the law requires us to keep it for a limited time, we promptly delete it from our active systems and ask the sender to use the upload link set up for the project.

Do you have to give us this? No. To reply and quote, we need your name, your email address, the service, and a short description of the project; the form doesn’t send without them. Everything else is optional, and leaving it out only means we may ask you more questions.

Why we use it

• To answer you. We use what you send to reply, prepare a quote, and discuss a possible project. Legal basis: steps taken at your request before a contract (LGPD Art. 7, V; GDPR and UK GDPR Art. 6(1)(b)). If you write on behalf of your institution, our legitimate interest in answering an inquiry about our services (LGPD Art. 7, IX; GDPR and UK GDPR Art. 6(1)(f)).
• To keep the site and the form running and free of spam and abuse. Server logs, the anti-spam checks, and a log of email delivery problems. Legal basis: our legitimate interest in keeping the site and the form running and free of spam and abuse (LGPD Art. 7, IX; GDPR and UK GDPR Art. 6(1)(f)).
• To meet our legal obligations. If a contract follows, Brazilian tax and accounting law requires us to keep certain records (LGPD Art. 7, II; under the GDPR and UK GDPR, our legitimate interest in complying with Brazilian law, Art. 6(1)(f)).
• To defend our rights. If a contract follows, we may keep the core contract documents needed to establish, exercise, or defend legal claims (LGPD Art. 7, VI; GDPR and UK GDPR Art. 6(1)(f)).
• To introduce our services. See Professional outreach below. Legal basis: our legitimate interest (LGPD Art. 7, IX; GDPR and UK GDPR Art. 6(1)(f), where they apply).

We don’t sell your data, and we don’t make automated decisions about you.

Professional outreach

We may write first to researchers and organizations whose work is related to ours. For that, we may collect your name, professional role, organization, institutional email address, and the public source where we found them (a university or organization website, a conference program, a professional directory) or the person who referred you. We would use this limited information to send a short business introduction to our services, and before any campaign we weigh our interest against your rights and interests. We don’t use sensitive data for outreach, and we don’t add these contacts to a newsletter.

You can object or opt out at any time by replying “unsubscribe” or writing to privacy@riverabrazil.com. We then stop commercial messages and keep only the minimal record needed to respect your choice.

Who handles it for us

• Hostinger hosts the website, delivers its pages through its content delivery network, and runs our email (Hostinger Email). Its data processing addendum governs the data it handles for us.
• MailChannels, an email relay provider based in Canada, passes on outgoing email from our mailboxes, such as our replies to you, on Hostinger’s behalf.

Your email provider and ours carry messages in transit, as with any email. If we work together, our accountant and the Brazilian tax authorities receive the invoicing details the law requires, and the payment service providers and banks that carry your payment see its details; they may act as independent controllers for payment, fraud prevention, and legal compliance. We would also disclose data if Brazilian law or a court order required it.

Where your data goes

• Hostinger’s content delivery network receives each request, including the form, on a server that may be in another country, and passes it to our web server.
• The web server is in the United States (North Carolina).
• The form is emailed from that server to our mailbox at Hostinger Email. In our test, the message passed through Hostinger mail servers in Germany and France.
• We read our email in an email program on our computers in Brazil.
• Our replies leave through Hostinger’s mail servers and MailChannels.

So your data is handled in Brazil, the United States, and the European Union, and may pass through other countries on Hostinger’s network and MailChannels’ servers. On the EU side, the European Commission’s adequacy decision for Brazil (Commission Implementing Decision (EU) 2026/179) covers personal data sent from the EU to organizations in Brazil that are subject to the LGPD; it doesn’t cover the steps that take place outside Brazil and the EU. On the Brazilian side, transfers to the EU and the European Economic Area (EEA) rely on the adequacy decision of the ANPD, Brazil’s data protection authority (LGPD Art. 33, I; Resolution CD/ANPD No. 32/2026). For the other countries involved, we are confirming the applicable safeguards with our providers and will update this notice. Hostinger’s data processing addendum (hostinger.com/legal/dpa) sets out the terms on which it handles data for us. You can ask about the safeguard that applies to a particular transfer, and for a copy where appropriate, at privacy@riverabrazil.com.

How long we keep it

• Quote requests that don’t lead to a contract: up to 24 months after our last exchange, then deleted. This includes the emails about the request.
• If a contract follows: tax and accounting records are kept for the periods Brazilian law sets for tax assessment and collection, normally at least five years from the applicable starting point, and longer while an audit, proceeding, or duty to preserve them is pending. Core contract documents needed to establish, exercise, or defend rights may be kept for the applicable limitation period, which can reach ten years where no shorter period applies. Project files and recordings follow the period set in the project agreement.
• Other emails: up to 24 months after our last exchange, then deleted.
• Outreach contacts who don’t reply: up to 12 months after our last message, then deleted. If you opt out, we keep only the minimal record needed not to contact you again.
• Server logs: kept by Hostinger. Hostinger’s published documents don’t say for how long.
• Anti-spam file: holds only times and one-way codes of used form tokens, with no name, email address, or IP address; entries older than 24 hours are removed the next time a request passes the form’s checks.
• Delivery log: holds the time and a short technical reason when a message fails or the form can’t use its usual route, with nothing you wrote. Entries older than 90 days are deleted automatically the next time the contact page is used.
• Files sent through an upload link: encrypted in the sender’s browser and kept on the web server only in that encrypted form until we move them to our computers in Brazil. They are deleted from the server then, and within 30 days of upload at the latest. After that, they follow the period set in the project agreement.

How we protect it

Pages and the form travel over HTTPS. The site passes your request to our mail server over TLS, logged in to our own mail account, and doesn’t keep a copy on the web server. The two small files described above, and the encrypted copies of files sent through an upload link, sit outside the public part of the site. Email passes through several providers’ servers on its way, so please don’t send research data by email or through the form. For project files, we set up a private upload link on this site: your browser encrypts each file before sending it, the web server keeps only the encrypted copy, and the key that opens it isn’t on the server (see Where your recordings go).

Your rights

Under the LGPD, depending on the situation and the legal basis, you can ask us to confirm whether we process your data and give you access to it; correct it; anonymize, block, or delete data that is unnecessary, excessive, or handled against the LGPD; provide it in a portable format, as regulated; and tell you who we have shared it with. You can object to processing carried out without your consent if it doesn’t comply with the LGPD. If we ever rely on your consent, you can also ask us to delete the data processed on that basis, learn what happens if you don’t consent, and withdraw your consent. We don’t make decisions based solely on automated processing; if that changes, we will tell you and respect your rights under Art. 20 of the LGPD. You can also petition the ANPD.

Under the GDPR or the UK GDPR, where they apply, you can ask for access, rectification, erasure, restriction of processing, and data portability where the legal conditions are met, and withdraw your consent if we ever rely on it.

Your right to object. Under the GDPR or the UK GDPR, you can object at any time, on grounds relating to your situation, to our use of your data based on our legitimate interests. Under the LGPD, you can also object to processing that doesn’t comply with the law.

Write to privacy@riverabrazil.com. We may ask you to confirm your identity before acting on a request. Requests are free of charge, except where the law allows otherwise, and we reply within the time limits the law sets.

Complaints

You can complain to us at privacy@riverabrazil.com. You can also complain to Brazil’s National Data Protection Authority, the ANPD (gov.br/anpd). If you are in the EU or the European Economic Area (EEA), you can complain to the data protection authority of the country where you live or work, or where you think the problem happened. In the UK, the data protection regulator is the ICO (ico.org.uk).

In the United Kingdom, if you believe we haven’t complied with UK data protection law, you can complain to us at privacy@riverabrazil.com. We acknowledge your complaint within 30 days, look into it properly, keep you informed of its progress, and tell you the outcome without undue delay.

About this notice

Our website and contact form are meant for organizations and adults acting in a professional capacity, not for children or adolescents. Please don’t send their personal data through the form or by ordinary email. If a project includes participants under 18, we handle their data only under the client’s documented instructions, the project agreement, and the safeguards the law requires.

The English and Portuguese versions of this notice are meant to say the same thing. If you find an inconsistency, write to privacy@riverabrazil.com so we can correct it. Nothing in either version limits your rights under data protection law.

Changes

When we change this notice, we update the date and the version at the top of this page. We are confirming some details with our hosting provider and will update this notice when we do.

Versão em português