PRIVACY POLICY

How we protect data and information.

QUESTIONS? CONTACT US

Welcome!

This Privacy Policy covers the operations of Central Server Informática Ltda., which operates under the CentralServer and Nevolus brands. It explains our commitment to security, transparency and confidentiality in processing personal data, and the measures we take to comply with applicable law.

Nevolus offers a range of products and services and continually seeks to improve and innovate. Our contracts therefore contain privacy provisions specific to each product or service. Customers approve these documents, which are available in their account.

Under Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018), express consent to this Privacy Policy and the specific privacy provisions for each service or product is required for Brazilian citizens. This consent is obtained through our websites, customer account or other Nevolus communication channels.

Collection and Processing of Personal Data

Nevolus collects data needed to enter into contracts, provide its products and services, and communicate with current customers, prospective customers and job applicants. We collect business information (legal name, CNPJ registration number, address, telephone and email); personal information about authorized company representatives who sign contracts or manage contracted products and services (name, job title, CPF, RG or other official identification, email, telephone, address and access credentials); and information about prospects or applicants (name, job title, email, telephone, address and professional history).

Personal data are used to prepare and sign contracts and other legal documents; identify users and their use of products and services; provide access to the customer account; process payments and purchases; communicate with current and prospective customers; and carry out recruitment and selection. Depending on a product’s or service’s technical characteristics, other specific purposes may apply and will be expressly stated in the relevant contract.

A user who signs contracts and consents on behalf of a legal entity declares, under penalty of law, that they are its duly authorized representative (for example, a partner, manager, employee, agent or legal proxy).

To improve service quality or comply with applicable law, we retain access data relating to our services. We combine these data with other data to produce logs and aggregate statistics, anonymized whenever possible (for example, visitor counts, source and destination IP addresses, the country of the internet service provider, and the date and time of access).

To bill for Nevolus products and services, we provide financial institutions and payment service providers with identifying information about the relevant legal entity or individual and the customer’s chosen payment method, in accordance with applicable laws, rules and security standards.

Communications with Nevolus customer service may be recorded or monitored, as permitted by applicable law, for local operational needs such as quality control, training or resolving questions.

We do not intend to collect or process sensitive personal data in the normal course of business. If processing is necessary for any reason, we will obtain prior express consent for voluntary processing (for example, marketing) or rely on an applicable legal basis (for example, detecting and preventing crime or fraud, or complying with the law).

To contact people about our products and services, we may collect personal information that has been shared publicly or forms part of social media profiles (for example, Facebook, Instagram, X and LinkedIn). This includes basic account information (name, email address, gender, date of birth, current city, profile photo, user ID and friends list) and any additional information or activity the user allows the social network to share with us.

When customers or visitors interact with our materials, content or events, we may collect information they choose to share through forms, email, instant messages, telephone calls, applications or other channels. We may need to combine data collected through our marketing activities. We ensure this combination is not discriminatory and does not infringe individual rights or freedoms. Personal data collected are used exclusively by Nevolus and are not disclosed or sold to third parties. Data subjects may request changes to or withdrawal of these processing permissions at any time.

We send newsletters only with express authorization obtained through a registration process for that purpose. Subscribers may cancel at any time by making a request.

Legal Bases

We collect and process data only on legal grounds permitted by law, such as steps to enter into or perform a contract, compliance with a legal or regulatory obligation, and legitimate interests.

Use of Cookies

We automatically collect information about devices and applications used to browse our pages through cookies, if cookies are enabled in your browser. Cookies provide functionality and improve site performance. The social media and advertising networks we use—Google, X, Facebook, Microsoft and their affiliates—also use cookies to target ads and show product or service offers based on an identified profile. Users who browse our sites with cookies enabled may therefore see Nevolus advertising elsewhere on the internet.

To prevent your browser from providing these data, you can use the consent tool available on our site. Alternatively, you can disable cookies in your browser.

Data Retention Period

We keep personal data only for as long as needed to fulfill the purposes for which they were collected, including compliance with legal or contractual obligations or requests from competent authorities.

We store personal information about prospective Nevolus customers for up to five years. Professional information sent by job applicants is stored for up to one year. Data subjects may request deletion of their data, in which case we will delete them from our databases within 72 hours after receiving the request.

Information Security

Nevolus applies information security, software development, policy and procedure practices to protect personal and corporate data and prevent unauthorized access, improper use, disclosure, loss or destruction. More information about our security standards, methods and procedures is available in this document (Portuguese).

Despite Nevolus’s efforts, each customer is responsible for ensuring that their computers and mobile devices are adequately protected against malicious software and activity, including viruses, spyware, adware and unauthorized remote access.

Customers should also be aware that without appropriate security measures—for example, regularly updated strong passwords, secure browser settings, current antivirus software, firewalls, and avoiding vulnerable or illicit software—the risk of unauthorized disclosure of personal data is considerably higher.

When data are sent over open public networks such as the internet, personal data may travel without adequate security and could be viewed or used by unauthorized third parties. We therefore recommend following basic digital security practices to keep data safe.

To deliver contracted products and services, we store customer access credentials in our systems. Customers acknowledge that they need to protect credentials for these systems with strong passwords that are updated regularly.

Rights of Personal Data Subjects

Personal data means any information concerning an identified or identifiable natural person. In accordance with Brazil’s Law No. 13,709/2018 (LGPD), which governs personal data processing, Nevolus values transparency and its customers’ digital security and follows good information security practices. Data will be used only for the specific purposes of the relationship, users’ access to and use of the products and services offered, and their purchase.

Data subjects may request correction or updating of their data, ask how they are used and processed, and withdraw consent. Article 18 of Brazil’s Law No. 13,709/2018 (LGPD) establishes the following rights for Brazilian personal data subjects:

Art. 18. A personal data subject has the right to obtain from the controller, in relation to the subject’s data processed by it, at any time and upon request:
I – confirmation that processing exists;
II – access to the data;
III – correction of incomplete, inaccurate or outdated data;
IV – anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of this Law;
V – portability of data to another service or product provider, upon express request and subject to trade and industrial secrets, in accordance with the controller body’s regulations;
V – portability of data to another service or product provider, upon express request, in accordance with the regulations of the national authority and subject to trade and industrial secrets; (Wording given by Law No. 13,853 of 2019)
VI – deletion of personal data processed with the subject’s consent, except in the cases provided for in Art. 16 of this Law;
VII – information about public and private entities with which the controller has shared data;
VIII – information about the possibility of withholding consent and the consequences of doing so;
IX – withdrawal of consent, under § 5 of Art. 8 of this Law.
§ 1. The personal data subject has the right to petition the national authority against the controller in relation to their data.
§ 2. The subject may object to processing based on one of the grounds for exemption from consent if this Law has not been complied with.
§ 3. The rights in this article are exercised by an express request from the subject or a legally appointed representative to a processing agent.
§ 4. If immediate action under § 3 is not possible, the controller shall send the subject a response that may:
I – state that it is not the data processing agent and, whenever possible, identify that agent; or
II – state the factual or legal reasons preventing immediate action.
§ 5. Requests under § 3 shall be fulfilled at no cost to the subject, within the periods and on the terms set out in regulations.
§ 6. The responsible party shall immediately inform the processing agents with which it has shared data of any correction, deletion, anonymization or blocking so they can carry out the same procedure. (Wording given by Law No. 13,853 of 2019)
§ 7. Portability under item V of the main text of this article does not include data already anonymized by the controller.
§ 8. The right under § 1 may also be exercised before consumer protection bodies.

Nevolus does not market or sell its products or services to minors (people under 18 years of age).

Disclosure and Transfer of Personal Data

All Nevolus customer data (personal data, files, web pages, source code, databases and email messages) stored on our servers are covered by the confidentiality clause of the contract.

Nevolus may occasionally be required to disclose personal data to regulators, courts, agencies or other government bodies in administrative or legal proceedings. It will do so only where there is a clear legal requirement, a court order, or a need to defend the rights, interests or property of Nevolus or related third parties, especially its customers, while seeking to protect the privacy and confidentiality of third-party data in its custody. Otherwise, we will not share your personal data unless you request or approve the sharing in advance.

When providing services, we may process personal data on behalf of a controller (the customer or one of its branches or affiliates), primarily to administer, manage, monitor performance or effectively deliver our products and services in Brazil and internationally.

Personal data will be processed appropriately, relevantly and only to the extent necessary for their purposes. They will be shared only with relevant, duly authorized Nevolus personnel, contractors or subcontractors as needed to deliver and maintain the quality of our products and services and support business and technical operations.

Under Brazilian data protection law, international transfers of personal data will take place only to countries that ensure an adequate level of protection. Nevolus follows these principles when acting as data controller, transferring data only to perform contracted services and taking steps to keep transferred data secure.

Privacy Policy Updates

Nevolus may change this Privacy Policy at any time to maintain compliance with legal, judicial or administrative requirements. Customers will be informed of changes by email or through their account. Under the LGPD (Law No. 13,709/2018), when this Privacy Policy changes, data subjects will be informed so that, where applicable, they can give express consent through our communication channels or contracts.

Controller Identification and Contact Channels

Our products and services are provided by Central Server Informática Ltda., at Rod. José Carlos Daux, 4150, Florianópolis, Santa Catarina, Brazil, registered under CNPJ No. 04.151.097/0001-94. Telephone: 4000-1075 (Brazil) and +55-11-3995-7905 (global).

Details of the appointed Data Protection Officer (DPO) for purposes of the LGPD (Law No. 13,709/2018):

If you have any questions about this Privacy Policy, contact us.