Privacy Policy

01 Introduction

THOUGHTWORKS BRASIL SOFTWARE LTDA ("Thoughtworks Brasil", "we", "our", or "us") is a Brazilian technology company registered under CNPJ 10.564.976/0001-40, headquartered at Avenida Ipiranga 6681, Edifício 99A, Sala 601 / 1401 A e B / Sala 1402, Partenon, Porto Alegre – RS, Brazil. We develop software, provide technology consulting services, and engage with clients and prospective partners through our digital properties.

This Privacy Policy applies to all personal data collected, processed, or stored through the website located at thoughtworks-us.site ("Website"), including through contact forms, newsletter sign-ups, job-application flows, analytics, and advertising tools. It does not cover data practices of third-party websites linked from our pages.

We are committed to protecting your personal data in compliance with Brazil's Lei Geral de Proteção de Dados (LGPD — Law 13.709/2018) and, where applicable, the European Union's General Data Protection Regulation (GDPR — Regulation 2016/679). We process personal data only when we have a lawful basis to do so and only for purposes that are clearly defined in this document.

By using this Website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of it, please refrain from using the Website and contact us using the details in Section 11.

02 Information We Collect

We collect personal data through several distinct channels. The scope of data collected depends on how you interact with our Website.

Information you provide directly

When you fill in a contact form, request a service quotation, subscribe to our newsletter, or submit a job application, we collect the information you actively enter. This typically includes:

• Full name and professional title or role
• Business or personal email address
• Company name and industry sector
• Phone number (if provided)
• The subject and content of your enquiry or message
• Curriculum vitae, portfolio links, or other attachments you choose to include with a job application
• Any additional information you voluntarily supply in free-text fields

Providing this information is always voluntary. However, certain fields (such as email address and message content) are required for us to respond to your enquiry; without them, we cannot process your request.

Information collected automatically

When you browse our Website, certain technical and behavioural data is collected automatically by our servers and third-party analytics tools. This includes:

• IP address (truncated or pseudonymised where technically feasible)
• Browser type and version, operating system, and device type
• Referring URL (the address of the page that linked you to ours)
• Pages visited, time spent on each page, and navigation path through the Website
• Date and time of each visit
• Interaction data such as button clicks, scroll depth, and form engagement (via analytics scripts)
• Approximate geolocation derived from IP address (country or city level only)

Information from advertising platforms

If you arrive at our Website through a Google Ads campaign or another paid advertising channel, additional data may be associated with your visit for the purposes of conversion tracking and campaign measurement. This is covered in detail in Section 4 (Cookies & Tracking Technologies). We do not purchase third-party marketing lists or acquire personal data from data brokers.

03 How We Use Your Information

We use personal data only for specific, explicit, and legitimate purposes. The table below outlines our primary use cases and the corresponding legal basis under the LGPD and GDPR.

Responding to enquiries and processing contact requests

When you submit a contact or quotation form, we use your name, email address, and the content of your message to respond to you in a timely and relevant manner. Legal basis: performance of a pre-contractual relationship (LGPD Art. 7, II) / legitimate interest (GDPR Art. 6(1)(f)).

Sending service-related communications

If you have entered into or expressed serious intent to enter into a service agreement with us, we may send you updates directly relevant to that engagement, such as project milestones, invoices, or policy notifications. Legal basis: contract performance.

Marketing and newsletter communications

If you explicitly opt in to our mailing list, we may send you articles, event invitations, industry insights, and information about our services. Every marketing message includes a clearly visible unsubscribe link. We will never send unsolicited commercial communications. Legal basis: consent (LGPD Art. 7, I / GDPR Art. 6(1)(a)).

Evaluating job applications

Information submitted through our careers section or sent directly to our recruitment team is used solely to evaluate your suitability for roles at Thoughtworks Brasil. We retain application data only as long as described in Section 6. Legal basis: pre-contractual steps at the data subject's request.

Website analytics and performance improvement

We analyse aggregated and pseudonymised usage data to understand how visitors navigate our Website, which pages generate the most engagement, and where technical issues may arise. This helps us improve content quality, page performance, and user experience over time. Legal basis: legitimate interest.

Advertising measurement and attribution

We use Google Ads conversion tracking to measure whether a visitor who clicked one of our advertisements subsequently completed a desired action (such as submitting a contact form). This data is used exclusively to assess and optimise the effectiveness of our advertising spend; it is not used to build individual user profiles for resale. Legal basis: legitimate interest / consent where required by applicable cookie rules.

Legal compliance and fraud prevention

We may retain and disclose personal data where required to comply with a legal obligation, enforce our terms, or protect the rights, property, or safety of Thoughtworks Brasil, our clients, or the public. Legal basis: compliance with a legal obligation (LGPD Art. 7, II / GDPR Art. 6(1)(c)).

04 Cookies & Tracking Technologies

Our Website uses cookies and similar tracking technologies (including pixel tags and JavaScript libraries) to operate correctly, remember your preferences, analyse usage, and measure the effectiveness of our advertising.

What is a cookie?

A cookie is a small text file placed on your device by a website server when you visit a page. Cookies cannot execute programmes or transmit viruses. Session cookies expire when you close your browser; persistent cookies remain on your device for a defined period or until you delete them manually.

Categories of cookies we use

Strictly necessary cookies

These cookies are essential for the Website to function. They enable core features such as security, page navigation, and access to secure areas. They do not collect information about you for marketing purposes and cannot be disabled without breaking the Website. No consent is required for these cookies under applicable law.

• Session management cookie — maintains your session state across page loads. Expires at end of session.
• CSRF protection token — prevents cross-site request forgery on form submissions. Expires at end of session.

Analytics and performance cookies

We use Google Analytics 4 (GA4) to collect anonymised data about how visitors use our Website. Data is transmitted to Google LLC servers in the United States under appropriate data transfer mechanisms (Standard Contractual Clauses). IP addresses are anonymised before storage. Aggregate analytics data helps us identify which content is most useful and where the Website can be improved.

• _ga — distinguishes unique users. Persistent; expires after 2 years. Set by Google Analytics.
• _ga_[ID] — persists session state for GA4. Persistent; expires after 2 years. Set by Google Analytics.

Advertising and conversion-tracking cookies

We use Google Ads conversion tracking to measure when a visitor who arrived via one of our ads subsequently takes a meaningful action on our Website (e.g., submitting a contact enquiry). This cookie does not store personally identifiable information, and its data is used solely for measuring ad performance.

• _gcl_au — Google Ads conversion linker. Persistent; expires after 90 days.
• IDE — used by Google DoubleClick to register and report on ad interactions. Persistent; expires after 1 year. Stored under google.com domain.

Managing your cookie preferences

When you first visit our Website, you will be presented with a cookie consent banner where you can accept or decline non-essential cookies by category. You may update your preferences at any time via the "Cookie Preferences" link in the site footer.

You can also control cookies at the browser level. Most browsers allow you to view, block, or delete cookies through their settings menus. Be aware that disabling certain cookies may affect the functionality of parts of the Website. Useful resources include:

• Google Analytics opt-out browser add-on: tools.google.com/dlpage/gaoptout
• Google Ads settings: adssettings.google.com
• Your browser's privacy or security settings panel

05 Sharing With Third Parties

We do not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share data only in the specific circumstances described below, and only to the minimum extent necessary.

Service providers acting as data processors

We engage carefully selected third-party service providers who process data on our behalf and under our instruction. Each provider is bound by a data processing agreement that requires them to maintain appropriate security measures and to use data only as directed by us. Current categories of processors include:

• Website hosting and infrastructure — cloud server and content delivery providers who host the Website's files and serve them to your browser.
• Email delivery — a transactional email provider used to send automated confirmation and response emails when you submit a contact form.
• CRM and sales management — a customer relationship management platform used by our commercial team to track and respond to business enquiries.
• Analytics — Google LLC (Google Analytics 4), subject to Google's data processing terms and the EU–US Data Privacy Framework.
• Advertising measurement — Google LLC (Google Ads), for conversion tracking as described in Section 4.

Professional advisors and compliance obligations

We may disclose personal data to our legal counsel, auditors, or accountants where strictly necessary and subject to professional confidentiality obligations. We will also disclose data to competent authorities or courts when required to do so by applicable law, a valid court order, or in response to a lawful request from a public authority.

Business restructuring

In the event of a merger, acquisition, sale of substantially all our assets, or corporate restructuring, personal data held by us may be transferred to the acquiring entity as part of that transaction, provided the receiving party agrees to be bound by this Privacy Policy or an equivalent standard of protection.

International data transfers

Some of the third-party processors listed above are based outside Brazil. When personal data originating in Brazil or the European Economic Area is transferred to recipients in countries that do not offer an equivalent level of data protection, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, adequacy decisions, or binding corporate rules, as applicable. You may request a copy of the applicable transfer mechanism by contacting us at the address in Section 11.

06 Data Retention

We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. Our general retention criteria are:

• Contact and enquiry data: Retained for 2 years from the date of last interaction. If your enquiry results in a signed contract, data is retained for the duration of the contract plus 5 years to meet Brazilian civil and tax law requirements.
• Marketing subscription data: Retained for as long as you remain subscribed. Upon unsubscription, identifiable data is deleted or anonymised within 30 days, except for a minimal record of consent and unsubscription retained for legal compliance purposes.
• Job application data: Retained for 12 months after the conclusion of the selection process for which you applied, in case a suitable opportunity arises. Applications submitted on a speculative basis are retained for 6 months. You may request deletion at any time.
• Analytics data: Aggregated and pseudonymised GA4 data is retained for 14 months at the property level. Raw event data is not retained beyond Google's standard processing window.
• Server and access logs: Retained for 90 days for security monitoring, then deleted.
• Cookie consent records: Retained for 3 years to demonstrate compliance, then deleted.

When retention periods expire, data is securely deleted or irreversibly anonymised so it can no longer be linked to an identifiable individual. Where deletion is not immediately technically feasible (for example, due to backup schedules), the data is isolated from active processing until deletion can be completed.

07 Data Security

We implement appropriate technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our measures include, but are not limited to:

• End-to-end TLS/HTTPS encryption for all data transmitted between your browser and our servers
• Access controls ensuring that only authorised personnel with a legitimate need can view personal data
• Role-based permissions and multi-factor authentication for internal systems that store contact and CRM data
• Regular security patching and software dependency updates for our Website infrastructure
• Periodic internal reviews of data processing activities and third-party processor security postures
• Contractual security obligations imposed on all third-party data processors

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, and we encourage you not to share highly sensitive personal information through our public contact forms where an alternative (such as encrypted email) is available.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant data protection authority within the timeframes required by applicable law (within 72 hours under GDPR; within 2 working days under ANPD guidance under the LGPD), and will communicate directly with affected individuals where required.

08 Your Rights

Depending on your country of residence and the legal framework that applies to your data, you are entitled to exercise the following rights regarding your personal data. Brazilian data subjects are covered by the LGPD (Art. 18); EU/EEA data subjects are covered by the GDPR (Arts. 15–21). We honour both frameworks for all visitors.

Right to withdraw consent

Where we rely on your consent as the legal basis for processing (for example, marketing emails or non-essential cookies), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. To unsubscribe from marketing communications, use the unsubscribe link in any email we send you, or contact us directly.

Right to lodge a complaint

If you are located in Brazil, you have the right to lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at www.gov.br/anpd. If you are in the European Union or EEA, you may contact the supervisory authority in your country of habitual residence, place of work, or place of the alleged infringement. We encourage you to contact us first so that we have the opportunity to address your concern directly.

How to exercise your rights

To exercise any of the rights listed above, please send a written request to contato@thoughtworks-us.site with the subject line "Data Subject Rights Request." Please include sufficient information for us to verify your identity (such as your full name and the email address associated with your interaction with us). We will respond within 15 calendar days under the LGPD and within 30 calendar days under the GDPR, with a possible extension of up to a further 60 days (LGPD) or 2 months (GDPR) for complex or multiple requests, of which we will notify you.

We will not charge a fee for handling your request unless it is manifestly unfounded or excessive. In such cases, we will inform you of any applicable fee before proceeding.

09 Children's Privacy

This Website is intended for business professionals and adults seeking technology services or employment. It is not directed at, nor designed to attract, children under the age of 18. We do not knowingly collect personal data from minors.

If you are a parent or guardian and believe that a minor in your care has submitted personal data to us without your consent, please contact us immediately at contato@thoughtworks-us.site. We will promptly investigate and, if confirmed, delete the relevant data from our systems without undue delay.

Where our services are accessed by persons under 18 years of age in the context of employment or contractor relationships permitted by applicable Brazilian labour law, data processing in those specific contexts follows the consent and oversight requirements established by the LGPD for data subjects under legal age of civil majority.

10 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we offer. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where technically feasible, by posting a notice on the Website or, if we hold your email address, by sending a brief notification email.

We encourage you to review this page periodically to stay informed about how we protect your information. Your continued use of the Website after a change has been published constitutes acceptance of the updated policy. If you disagree with a material change, you may exercise your rights as described in Section 8 or cease using the Website.

Previous versions of this Privacy Policy are available upon request by contacting us at the address in Section 11. We will provide prior versions within 10 working days of a written request.

11 Contact & Data Controller

The entity responsible for the collection and processing of personal data described in this Privacy Policy — acting as the data controller under the LGPD and GDPR — is:

We take privacy enquiries seriously. Our team aims to acknowledge all privacy-related correspondence within 3 business days and to provide a substantive response within the timeframes established by applicable law (see Section 8). If you have a concern that you feel has not been adequately addressed, you retain the right to escalate to the ANPD or the relevant supervisory authority in your jurisdiction at any time.