Privacy and data protection

Privacy Policy

What we do with personal data on this site — and what you can require from us.

Last updated

July 29, 2026

This policy explains which personal data APLAN Sistemas Industriais processes when you visit www.aplan.eng.br or contact us, for what purpose, for how long and what your rights are. It covers this corporate website and not the industrial systems APLAN deploys at its clients’ plants, whose processing is governed by each project contract.

01Who controls your data

APLAN Sistemas Industriais is the controller of the personal data processed on this site — it decides the purposes and means of processing (art. 5, VI of the LGPD; art. 4(7) of the GDPR).

The role of "encarregado" — the person in charge of personal data processing under art. 41 of the Brazilian LGPD — is held by Plínio Fagundes, managing partner of APLAN. He is also the company’s contact point for data protection matters under the GDPR and other applicable legislation.

Data subject requests, questions about this policy and communications from authorities should be addressed to the privacy channel listed at the end of this page, handled by the company’s management.

02What data we process

This site has no forms, no sign-up, no logged-in area and no shopping cart. What exists is the following:

Data you send us: when you write to our e-mail address, call us or start a WhatsApp conversation, we process whatever you provide — typically name, company, phone, e-mail and the technical description of your requirement.
Browsing data: if you allow analytics cookies, Google Analytics records pages viewed, visit duration, traffic source, language, device type and approximate location by country or region. Without that permission, none of this is collected.
Server access logs: our hosting provider automatically records IP address, date and time, the address requested and the browser identification. This is a technical log, kept for site security and availability.

03Purposes, legal bases and retention

Each processing operation has a specific purpose and a matching legal basis:

Purpose	Data	Legal basis (LGPD / GDPR)	Retention
Answering your enquiry and preparing proposals	Identification and message content	Pre-contractual steps — art. 7, V / art. 6(1)(b)	5 years after the last contact
Measuring audience and improving the site	Browsing data	Consent — art. 7, I / art. 6(1)(a) and art. 5(3) ePrivacy Directive	14 months
Ensuring security and availability	Access logs	Legitimate interests — art. 7, IX / art. 6(1)(f)	6 months
Complying with legal obligations and defending claims	As applicable	Legal obligation and legal claims — art. 7, II and VI / art. 6(1)(c) and (f)	As required by law

We do not carry out automated decision-making producing legal effects on you, nor do we build individual behavioural profiles.

04Cookies and similar technologies

Necessary cookies are used without consent because the site cannot work without them. Analytics cookies are only written after you accept: as long as no decision has been made, no Google script is downloaded and your browser does not even connect to Google’s servers.

The full list — name, purpose and lifetime of each item — is in the Cookie Policy. You can change or withdraw your choice at any time through the "Cookie preferences" link in the footer of every page.

06International data transfers

Google, Meta and Hostinger process data outside Brazil, including in the United States and the European Union. For those transfers APLAN relies, in Brazil, on standard contractual clauses and the other instruments set out in art. 33 of the LGPD and ANPD Resolution 19/2024; and, in the European Union, on the EU-U.S. Data Privacy Framework adequacy decision — under which Google LLC is certified — and on the standard contractual clauses of art. 46 of the GDPR.

07How long we keep data

Retention periods are in the purposes table. Once the period ends — or consent is withdrawn, where that is the legal basis — data is deleted or anonymised, unless the law requires longer storage or the data is needed to defend legal claims (art. 16 of the LGPD).

08Information security

The site is served over HTTPS only, with HSTS, and is static: there is no database, form or admin panel exposed to the internet, which drastically reduces the attack surface. Messages you send us are kept in corporate e-mail accounts with access restricted to the team that needs them.

No system is infallible. In the event of a security incident with relevant risk, APLAN will notify the ANPD and the affected data subjects within the deadline of ANPD Resolution 15/2024 and, where the GDPR applies, the competent authority within 72 hours.

09Your rights as a data subject

At any time and free of charge, you may:

confirm whether we process your data and access it;
correct incomplete, inaccurate or outdated data;
request anonymisation, blocking or deletion of unnecessary, excessive or non-compliant data;
request portability of your data to another provider;
withdraw consent and be informed about the consequences of refusal;
find out which public and private entities we have shared your data with;
object to processing based on legitimate interests;
lodge a complaint with the data protection authority.

We reply in simplified form immediately and, for full access, within 15 days (art. 19 of the LGPD). Where the GDPR applies, the deadline is 1 month, extendable by 2 further months in complex cases (art. 12(3)). We may ask for additional information to confirm your identity before acting — this is a safeguard, not an obstacle.

10Complaints to authorities

If you believe your rights have not been honoured, you may complain to the Brazilian National Data Protection Authority (ANPD) or, in the European Union and the United Kingdom, to the supervisory authority of your country of residence or of the place of the alleged infringement (art. 77 of the GDPR).

11Notice for United States residents

APLAN does not sell or share personal information for cross-context behavioural advertising as those terms are defined in the CCPA/CPRA and other US state privacy laws, and does not use sensitive personal information to infer characteristics.

This site honours the Global Privacy Control (GPC) signal: if your browser sends it, analytics cookies are automatically disabled and the banner is not displayed.

Commercial e-mail identifies the sender, includes a physical address and offers an opt-out. Promotional WhatsApp or SMS messages are sent only to those who have given prior consent.

12Children

This is a B2B corporate website aimed at industry professionals. It is not directed at anyone under 18 and we do not knowingly collect children’s data. If we become aware that we have, we will delete it.

13Changes to this policy

We may update this policy to reflect changes to the site or to the law; the date at the top shows the last revision. Changes that broaden the purposes subject to consent restart consent collection, and the banner will be displayed again.

Exercising your rights

Talk to APLAN about your data

Requests for access, correction, deletion, portability or withdrawal of consent — and any question about this policy — should be sent through one of the channels below. Mark the subject as "Privacy / Data Protection" to speed up handling.

Data protection contact (LGPD art. 41): Plínio Fagundes
Email: aplan@aplan.eng.br
Phone: +55 (31) 3318-6409
Address: Rua Paraíba, 1000 — Savassi, Belo Horizonte/MG, Brazil