Chang Consulting is a boutique consultancy specialised in Governance, Risk and Compliance (GRC), ESG, Data & BI and Software Development. This Privacy, Personal Data Processing & Cookies Policy explains, clearly and transparently, which personal data we collect on this website, how we use it, who we share it with, how long we keep it and what your rights are as a data subject, in compliance with Brazil's General Data Protection Law (Law No. 13,709/2018 — LGPD) and the rules of the Brazilian Data Protection Authority (ANPD). By using the website and its features, you declare that you have read, understood and agreed to this Policy; if you do not agree, please do not use the website or send data through our contact channels.
Who the controller is
Data controller: Chang Consulting Ltda (“Chang Consulting”), a Brazilian company registered under CNPJ No. 68.033.484/0001-09, based in Rio de Janeiro, RJ — Brazil.
Data Protection Officer (DPO): Alam Daniel Correa Chang — alam@changpartner.com.
Personal data we collect and why
We collect only the data strictly necessary for the purposes described below, in line with the data minimisation principle (LGPD art. 6, III).
Contact form: name, email, company (optional) and the message you send — to identify the sender, understand the request and reply properly. First-consultation offer: name and email — to schedule the conversation. Maturity assessment: name, email, company (optional) and the scores obtained — to present the result and follow up on the contact.
This data is processed to carry out preliminary steps related to a contract at the data subject's request (LGPD art. 7, V) and on the basis of our legitimate interest in replying to those who reach out (art. 7, IX). It is kept for up to 2 years after the last contact or the end of the business relationship. We do not use it to send unsolicited communications (spam).
Technical browsing data: the hosting infrastructure may automatically log the IP address, date, time and duration of access, browser type and operating system, referring page and URL accessed, for security, technical diagnostics and site maintenance, on the basis of legitimate interest (art. 7, IX). The IP address is also used transiently to limit abusive form submissions.
Data we do not collect: we do not collect sensitive data (LGPD art. 11), data from children and adolescents or payment data, and we carry out no behavioural monitoring or automated profiling of visitors.
Cookies and tracking technologies
Cookies are small text files stored on your device by the browser, used to remember preferences, keep sessions active or collect browsing information.
This website follows a minimal-cookie policy: it uses no tracking, analytics, social media or targeted advertising cookies, no conversion pixels and no visitor profiling technology. Only cookies strictly necessary for the technical operation of the site may be present; they do not identify visitors individually and are not passed on to third parties.
We store in your browser only a technical flag that prevents the first-consultation offer from appearing more than once. It contains no personal data and is never sent to our servers.
Videos embedded in articles use YouTube's privacy-enhanced mode (youtube-nocookie.com), which only interacts with YouTube when you play the video.
You can set your browser to refuse, block or delete cookies at any time, in the privacy settings of Chrome, Firefox, Safari or Edge (under “Cookies and site data”). Disabling cookies may affect some features of the site.
Third-party integrations — WhatsApp and LinkedIn
WhatsApp button: you are redirected to WhatsApp with a pre-filled message. The conversation takes place outside our website and is governed by the WhatsApp/Meta Privacy Policy.
LinkedIn link: you are redirected to Chang Consulting's public LinkedIn profile, and LinkedIn may collect data under its own privacy policy.
We have no control over the data these platforms collect after you click. We recommend reading their privacy policies before interacting with them.
Sharing data with third parties
Chang Consulting values the confidentiality of personal data and, as a principle, does not share data with third parties for commercial purposes.
Processors: Vercel (hosting) and Supabase (the database where enquiries are stored) handle data on our behalf so the site can work. These providers are bound by contractual confidentiality and security obligations and do not use the data for their own purposes.
Legal obligation: we may share personal data with public authorities or regulators when required by law, court order or an ANPD determination, or for the regular exercise of rights in judicial, administrative or arbitration proceedings (LGPD art. 7, VI).
International transfers: these processors may process data on servers located outside Brazil. When that happens, we apply the safeguards set out in LGPD arts. 33 to 36 to ensure an adequate level of protection for your data.
Data security
We apply technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, disclosure or destruction: transmission over encrypted channels (HTTPS/TLS); access to form data restricted to the DPO, through an authenticated admin panel; a database with rules that prevent public reading of enquiries; no storage of personal data in spreadsheets or unprotected systems; and periodic review of the measures in place.
No security system is absolutely infallible. In the event of a security incident that may affect your personal data, we will notify the affected data subjects and the ANPD within the deadlines and in the manner set out in the LGPD and ANPD rules.
Retention and deletion
Personal data is kept for the shortest period necessary to fulfil the purpose for which it was collected, according to the following criteria:
Form enquiry with no commercial follow-up: up to 2 (two) years after the initial contact.
Enquiry that leads to a commercial proposal: up to 5 (five) years after the end of the relationship or the rejection of the proposal.
Established contractual relationship: for the term of the contract plus 5 (five) years (limitation period).
Legal retention obligation: for the period defined in the applicable legislation.
Once the retention period ends, the data is securely deleted or anonymised so that it can no longer identify the data subject.
Your rights as a data subject
The LGPD grants data subjects the following rights, which may be exercised at any time by request to our DPO:
Access (art. 18, I and II): request confirmation that processing exists and access to your personal data.
Correction (art. 18, III): request the update or correction of incomplete, inaccurate or outdated data.
Anonymisation, blocking or deletion (art. 18, IV): request the anonymisation, blocking or deletion of data that is unnecessary, excessive or processed in breach of the LGPD.
Portability (art. 18, V): request the transfer of your data to another service or product provider.
Deletion (art. 18, VI): request the deletion of data processed on the basis of consent, except where the law allows it to be kept.
Information on sharing (art. 18, VII): obtain information about the public and private entities with which we share your data.
Withdrawal of consent (art. 18, IX): withdraw consent at any time, through a free and simple procedure.
Petition to the ANPD (art. 18, §1): lodge a petition with the Brazilian Data Protection Authority (gov.br/anpd) in case of non-compliance with this Policy.
To exercise any of these rights, send your request to alam@changpartner.com with the subject “LGPD — Data Subject Request”. We will reply within 15 (fifteen) calendar days.
Legal basis for processing
We process personal data on the following legal bases set out in LGPD art. 7:
Preliminary steps related to a contract, at the data subject's request (art. 7, V): to serve those who ask for a conversation, an assessment or a proposal.
Legitimate interest (art. 7, IX): to reply to enquiries received through the forms and keep up communication related to the provision of consulting services, within the limits of the controller's legitimate interest.
Compliance with a legal or regulatory obligation (art. 7, II): when processing is necessary to comply with an obligation set out in law or regulation.
Regular exercise of rights (art. 7, VI): when necessary in judicial, administrative or arbitration proceedings.
Data Protection Officer (DPO)
Chang Consulting has appointed Alam Daniel Correa Chang, Lead Consultant, as its Data Protection Officer (DPO).
Contact: alam@changpartner.com · +55 (21) 93618-0728. Availability: Monday to Friday, 9am to 6pm (Brasília time).
Updates to this policy
This Policy may be updated from time to time to reflect changes in our data processing practices, in the applicable legislation or in the site's features. When we make relevant changes, we will publish the new version here, with the update date shown at the top.
We recommend reviewing this Policy regularly. Continued use of the site after a new version is published implies acceptance of the changes.
Governing law and jurisdiction
This Policy is governed by Brazilian law, in particular Law No. 13,709/2018 (LGPD), Decree No. 11,491/2023, the rules and resolutions issued by the ANPD and, where applicable, the Consumer Protection Code (Law No. 8,078/1990).
Any dispute arising from this Policy shall be settled by the courts of the Capital District of the State of Rio de Janeiro, to the exclusion of any other.