Privacy Policy

1. Who processes your data

The controller is ROCO Indústria Metalplástica S.A., a manufacturer of plumbing and hydraulic solutions, headquartered at Rua Amsterdam, 853 - Itoupavazinha, Blumenau - SC, CEP 89070-490, with a factory in Gaspar, Santa Catarina, Brazil. Website: https://roco.com.br/.

2. What data we collect

We collect the data you enter in our forms and some technical data generated while you browse.

• Contact, quote and catalog forms: name, email, phone, company (optional), company tax ID / CNPJ (optional), subject, message (optional) and products of interest.
• Consent record: the confirmation you ticked in the form, with date and time.
• Technical data of the submission: IP address, website language, the website section you came from and campaign parameters (UTM).
• Sales representative pre-registration: name, email, phone, CNPJ, legal company name and password. The password is stored only as a protected code (hash).
• After pre-registration: service area (states, regions or cities) and the documents you upload.

3. What we use your data for

• Replying to your contact and quote request.
• Sending the catalog you requested.
• Following up commercially on your request.
• Reviewing sales representative pre-registrations, including email confirmation and approval by the ROCO team.
• Protecting the website against abuse, bots and improper access attempts.
• Complying with legal and regulatory obligations.

4. Legal bases

We process personal data based on your consent, when you tick the option in a form; on preliminary steps taken at your request, such as sending a quote and a catalog; on compliance with a legal or regulatory obligation; and on our legitimate interest in protecting the website against abuse.

You may withdraw your consent at any time. Withdrawal does not affect processing carried out before it.

5. Who we share data with

We do not sell personal data. We share data only with those needed for the purposes in this policy:

• RD Station, a CRM and marketing automation platform, which receives the contacts and requests sent through the website.
• The ROCO sales team's email inbox, when notification sending is configured.
• Cloudflare, which provides network services, firewall, request rate limiting and anti-bot verification (Turnstile).
• Public authorities, when required by law or a legal order.

6. International transfer

Some providers, such as Cloudflare, may process data outside Brazil. In those cases, the transfer follows the cases and safeguards provided for in the LGPD.

7. How long we keep data

We keep data for as long as needed for the purpose for which it was collected, and for as long as needed to comply with legal and regulatory obligations and to exercise rights.

Representative pre-registrations that do not confirm their email within 7 days are deleted automatically. Confirmation and password reset links store only a protected code (hash) and are deleted 30 days after being used or expiring.

8. ROCO Portal and accounts

People with an account on the ROCO Portal sign in with email and password. The password is stored as a protected code (hash), and access is kept in a session controlled by a cookie.

Password reset is done through a link sent to the registered email. Actions in the portal, such as changes to registrations, approvals and access to materials, are kept in an audit log with the user, the action, the date and, in some cases, the IP address.

Files uploaded by representatives are kept in private storage, not publicly accessible.

9. Cookies and similar technologies

We use cookies and browser storage to run the website, to remember preferences, for measurement and for security. Details are in the Cookie Policy.

10. Security

We adopt reasonable technical and administrative measures to protect data against unauthorized access, loss and misuse. The website uses HTTPS, Cloudflare edge protection, anti-bot verification and limits on attempts per IP address.

No system is immune to failures. If an incident occurs that may cause relevant risk, we will notify the data subjects and Brazil's National Data Protection Authority (ANPD), as the law requires.

11. Your rights

To exercise any right provided for in article 18 of the LGPD, write to [email protected]. You may ask for:

You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
• portability to another provider, under the applicable regulation;
• information about the entities with which we share your data;
• revocation of consent;
• objection to processing carried out without consent, where the law allows it.

12. Minors

The website is not directed at people under 18 and we do not intentionally collect data from minors. If you believe a minor has sent data, write to [email protected].

13. Changes to this policy

We may update this policy. The version in force is always the one published on this page, with the update date shown at the top.