Privacy policy

Published Last updated:

This policy explains how Haakon Group Ltda handles the personal data of people who visit haakongroup.com or contact us: which data, why, on what legal basis, who we share it with, how long we keep it and how you can exercise your rights under Brazil's General Data Protection Law (Law No. 13,709/2018, LGPD).

Who is the controller

Haakon Group Ltda, CNPJ 58.543.727/0001-03, Av. Prefeito Osmar Cunha, 416, Centro, Florianópolis/SC, Brazil, 88015-100. Contact: contact@haakongroup.com.

What data we collect

  • Contact form: name, email and message (required); company, WhatsApp or phone and interest (optional).
  • Contact by email or WhatsApp: whatever you send us, such as your name, phone number, email address and the content of the conversation.
  • Clients: the contact details of their representatives and the data needed for the contract and for tax, accounting and customs records.
  • Usage analytics, only if you accept cookies: Google Analytics 4 records browsing data such as pages visited, clicks on contact buttons, scroll depth, form submission, device and browser type and approximate location. Microsoft Clarity records on-page interactions such as clicks, scrolling and mouse movement, so we can understand how the site is used.
  • Technical access logs: our hosting provider (Vercel) records technical data such as IP address and browser to operate and protect the site.
  • Your cookie choice is stored in your own browser (key haakon_consent) so the notice does not reappear.

When you click a WhatsApp button, you leave the site. WhatsApp handles the conversation data under its own terms; what you write to us there is handled by us as described in this policy.

Why we use the data and on what legal basis

  • Replying to contact, quote and proposal requests made through the form, by email or on WhatsApp: preliminary steps toward a contract, at your request (LGPD art. 7, V).
  • Performing contracts with clients: performance of a contract (art. 7, V).
  • Keeping tax, accounting and customs records: compliance with a legal obligation (art. 7, II).
  • Analyzing how the site is used with Google Analytics and Microsoft Clarity: consent (art. 7, I). You can withdraw it at any time through "Cookie preferences" in the footer of every page.
  • Sending a newsletter, if we launch one: consent (art. 7, I). You will be able to unsubscribe at any time.
  • Recording your cookie choice and keeping the site secure: legitimate interest (art. 7, IX).

We only send marketing communications with your consent.

Who we share data with and international transfers

We do not sell personal data. To run the site and handle inquiries, we use the providers below, which process or may process data outside Brazil. For each one, we list the purpose, where the data is processed and how the international transfer takes place (LGPD art. 33). At the end of this section, we also explain the access made from New Zealand.

Vercel

  • Purpose: hosting the site and the function that receives the contact form.
  • What is recorded: on each visit, Vercel records technical data such as IP address, city and country estimated from the IP, browser, page requested, date and time. Form data passes through the function on its way to being sent by email.
  • Where: the form function runs in Washington, D.C., United States. Pages are served from the Vercel server closest to you. Vercel states that it stores and processes information in the United States and in other countries where it operates.
  • How the transfer takes place: for form data, it is necessary to handle your request (LGPD art. 33, IX). Technical logs are processed by Vercel in the United States and in other countries where it operates, under the Vercel Privacy Notice and the Vercel Data Processing Addendum.
  • Source: Vercel Privacy Notice (sections on information received from customers and on transfers), runtime logs documentation and Vercel Data Processing Addendum, section 13.

Resend

  • Purpose: delivering contact form messages to our mailbox.
  • Where: emails are sent from São Paulo, but Resend stores account data, including email metadata, logs and API records, in the United States.
  • Mechanism: the transfer is necessary to handle your request (art. 33, IX).
  • Source: Resend documentation on regions (Data Residency) and Resend Data Processing Addendum, section 6.1.

Google Workspace

  • Purpose: hosting the mailbox that receives form messages and emails sent to us.
  • Where: in any country where Google or its subprocessors maintain facilities.
  • Mechanism: standard contractual clauses approved by Brazil's data protection authority, the ANPD (art. 33, II, b), which Google has incorporated into its data processing addendum.
  • Source: Google Cloud Data Processing Addendum, section 10.1 and Appendix 3, "Brazil".

Google Analytics (only with your consent)

  • Purpose: measuring how the site is used.
  • Where: in any country where Google or its subprocessors maintain facilities.
  • Mechanism: your specific and highlighted consent to the transfer, given in the cookie notice (LGPD art. 33, VIII).
  • Source: Google Ads Data Processing Terms, which cover Google Analytics, section 10.1.

Microsoft Clarity (only with your consent)

  • Purpose: understanding how pages are used, through heatmaps and recordings of interactions.
  • Microsoft's role: Microsoft acts as a controller of Clarity data and also handles it under the Microsoft Privacy Statement.
  • Where: United States.
  • Mechanism: your specific and highlighted consent to the transfer, given in the cookie notice (LGPD art. 33, VIII).
  • Source: Clarity FAQ (Privacy) and Microsoft Clarity Security and Privacy FAQs (June 2022).

Access from New Zealand

  • Purpose: Haakon's partners access contact and client data from New Zealand to reply to requests and perform contracts.
  • Mechanism: the transfer is necessary to comply with legal obligations and to perform contracts or preliminary steps toward them (LGPD art. 33, IX, together with art. 7, II and V).

How long we keep data

  • Contacts that do not become business: up to 24 months after the last contact; then they are deleted.
  • Clients: for as long as the relationship lasts and then for the legal retention periods for tax and customs records (generally 5 years).
  • Google Analytics: 14 months for event and user data. Aggregated reports, which do not identify visitors, are not subject to this period.
  • Microsoft Clarity: recordings for 30 days. Recordings marked as favorites, a random sample of recordings, labels and heatmaps are kept for up to 9 months, according to Microsoft's documentation.
  • Vercel technical logs: runtime logs are available for 1 day (Pro plan), according to Vercel's documentation. For information it keeps on its own account, Vercel sets no fixed period: it says it keeps it for the minimum necessary period (Vercel Privacy Notice).
  • Your cookie choice: stays in your browser until you delete or change it.

Data protection officer and contact channel

Haakon Group Ltda is a small-scale processing agent (ANPD Resolution CD/ANPD No. 2/2022) and, as that regulation allows, has not appointed a data protection officer. To ask about your data or exercise your rights, email privacidade@haakongroup.com.

Your rights

Under the LGPD (art. 18), you may request:

  • confirmation that we process your data, and access to it;
  • correction of incomplete, inaccurate or outdated data;
  • anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
  • data portability;
  • deletion of data processed on the basis of your consent;
  • information about who we share your data with;
  • information about the option not to consent and its consequences;
  • withdrawal of consent.

To exercise these rights, email privacidade@haakongroup.com. You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

You can change your cookie choice at any time through the "Cookie preferences" link in the footer of every page. If you decline after having accepted, we delete this site's analytics cookies from your browser and the page reloads.

Changes to this policy

When this policy changes, the date at the top of the page changes too.