Skip to content
Sign inSign up
Talk to Axzon
  1. Home
  2. Privacy policy

Privacy policy

Version: 1.1 Effective Date: October 27, 2026 Official Website: https://www.axzon.com.br (and https://axzon.com.br) Customer Area: https://www.axzon.com.br/en/my-account/ License Portal: https://licencas.axzon.com.br (and https://license.axzon.com.br)

This Privacy Policy explains how AXZON TECNOLOGIA LTDA. processes personal data when you browse our website, contact us, create an account in the Customer Area, download installers and manuals, use the License Portal and Axzon software, or purchase our products and services. It has been prepared in compliance with the Lei Geral de Proteção de Dados Pessoais (Brazilian General Data Protection Law, Law No. 13,709/2018 — “LGPD”), the Marco Civil da Internet (Brazilian Internet Civil Rights Framework, Law No. 12,965/2014 and Decree No. 8,771/2016), the resolutions of the Agência Nacional de Proteção de Dados (Brazilian National Data Protection Authority — “ANPD”) and, where legally applicable to the processing, the European Union General Data Protection Regulation (Regulation (EU) 2016/679 — “GDPR”), the UK GDPR and the state privacy laws of the United States.

This Policy is drafted in Portuguese. The English and Spanish versions are faithful convenience translations. In the event of any discrepancy between versions, the Portuguese version shall prevail, without prejudice to the mandatory rights provided under the law applicable to the data subject.

1. Who the Controller Is and What the Privacy Channel Is

1.1. Controller. The controller of the personal data processed in the activities described in this Policy is AXZON TECNOLOGIA LTDA. (trade name AXZON Technology), a limited liability business company (sociedade empresária limitada) registered with the CNPJ (Brazilian National Register of Legal Entities) under No. 60.495.408/0001-03, State Registration (Inscrição Estadual) Exempt, Municipal Registration (Inscrição Municipal) 4.BO982-9 (Barueri/SP), enrolled in the Simples Nacional (Brazilian simplified tax regime for small businesses), headquartered at Alameda Rio Negro, nº 503, Sala 2011, Alphaville Centro Industrial e Empresarial, Barueri/SP, CEP 06454-000, Brasil, telephone +55 (11) 95078-6367 (“Axzon”).

1.2. Privacy and Data Subject Rights Channel: privacy@axzon.com.br Through this free and permanent channel, you may exercise all of your rights under the LGPD and applicable laws, ask questions, submit requests or file complaints about the processing of your personal data. The same channel receives communications from the ANPD and other competent authorities.

1.3. Regulatory exemption from appointing a data protection officer (encarregado). Axzon is a company enrolled in the Simples Nacional and declares that it qualifies as a small-scale processing agent (agente de tratamento de pequeno porte) for as long as the conditions of Articles 2, 3 and 4 of the Regulation approved by Resolution CD/ANPD No. 2/2022 are maintained. For this reason, it relies on the legal exemption from formally appointing a person in charge of processing personal data (encarregado) provided for in Article 11 of Resolution CD/ANPD No. 2/2022 and in Article 3, § 3, of Resolution CD/ANPD No. 18/2024, while maintaining the Privacy and Data Subject Rights Channel (privacy@axzon.com.br) to deal directly with data subjects and the ANPD, pursuant to Article 41, § 2, I, of the LGPD. This e-mail address is an institutional communication channel and is not to be confused with an individual acting as encarregado (DPO). If this qualification ceases or Axzon formally appoints an encarregado, that person’s identity and contact information will be published in this section.

1.4. Other institutional channels:

2. When Axzon Acts as Processor of Business Customers’ Data

2.1. When providing services of engineering, industrial integration and automation, supervisory systems (SCADA/HMI), robotics, NR-12 (Brazilian machinery and equipment safety standard) compliance, custom software development and technical support on customer systems, Axzon may have strictly operational access to personal data controlled by the contracting customer (for example, names, employee numbers or logins of machine operators and of users registered in supervisory systems or databases at the customer’s plant).

2.2. In these cases, the business customer is the controller of the personal data and Axzon acts exclusively as processor (LGPD, Art. 5, VII, and Art. 39), processing the data only in accordance with the customer’s lawful instructions and within the limits of the contract or commercial proposal, under a duty of confidentiality and without using the data for its own purposes. If you are an employee, agent or collaborator of a company that is an Axzon customer and wish to exercise rights over data held in your employer’s systems, we recommend directing your request to your employer directly; if the request is sent to Axzon, we will forward it to the controller customer for appropriate action.

2.3. Axzon remains the controller of the personal data of the customer company’s commercial representatives, managers and technical contacts needed for the commercial, contractual, financial and tax management of the project, as well as of the registration and attendance data of participants in training courses offered by Axzon, for organizing classes and issuing certificates.

Axzon processes only the personal data necessary for legitimate, specific and informed purposes. We do not use generic consent as the basis for operating the website or the contracts: the record that you have read this Policy on the contact form, at registration or at purchase demonstrates transparency (LGPD, Art. 9), but does not turn processing grounded in performance of a contract, legal obligation or legitimate interest into consent.

3.1. Website Browsing, Security and Aggregated Statistics

  • Data processed: IP address, source logical port (when necessary and available for unambiguous identification of the connection), date and time with time zone, address of the requested page (URL), HTTP response code and technical information about the browser and operating system.
  • Purposes: delivering the requested pages and files, protecting the infrastructure against cyberattacks, automated scans and fraud, complying with the legal duty to retain access logs for internet applications, and generating aggregated visitor statistics.
  • Statistics without tracking: we use Cloudflare Web Analytics in a configuration that does not use advertising tracking cookies and does not create individual cross-site browsing profiles.
  • Legal bases: compliance with a legal or regulatory obligation (LGPD, Art. 7, II, in conjunction with Art. 15 of Law No. 12,965/2014 and Art. 15-A of Decree No. 8,771/2016) for retaining access logs; and legitimate interest (LGPD, Art. 7, IX) for cybersecurity, abuse prevention and aggregated measurement of website performance.

3.2. Contact Form and Commercial or Technical Assistance

  • Data processed: full name, company (optional), e-mail address, telephone or WhatsApp (optional), subject, message content, page language and technical anti-spam signals (hidden honeypot field and form completion time).
  • Purposes: answering technical or commercial questions, preparing requested quotes and proposals, sending an automatic confirmation of receipt of the message (via the transactional e-mail service Brevo, sender noreply@avisos.axzon.com.br) and blocking automated spam submissions.
  • Minimization guidance: do not send through the contact form passwords, full credit card numbers, sensitive personal data (such as health or biometric data) or industrial secrets that are unnecessary for the initial assistance.
  • Legal bases: preliminary procedures related to a contract to which the data subject is a party, at the data subject’s request (LGPD, Art. 7, V); legitimate interest in responding to requests initiated by the data subject, including when acting as a representative of a legal entity, and in protecting the form against spam (LGPD, Art. 7, IX); and regular exercise of rights (LGPD, Art. 7, VI) for preserving evidence of the assistance provided.

3.3. Registration and Customer Area (/en/my-account)

  • Data processed:
    • full name and username (login);
    • CPF (Brazilian individual taxpayer registration number) (mandatory when the country entered is Brazil, validated by check digit);
    • e-mail address and telephone or WhatsApp (international format);
    • access password (minimum of 12 characters, stored exclusively as a PBKDF2 cryptographic hash; Axzon never stores or views your password in plain text);
    • optional data about the company represented (corporate name and CNPJ in Brazil, or equivalent tax identification — Tax ID/VAT — abroad);
    • full address (country, CEP or postal code, street, number, address line 2, neighborhood, city and state);
    • preferred language;
    • record of acceptance of the Terms of Use and acknowledgment of this Policy (accepted version, date and IP address at registration);
    • dates of e-mail confirmation and of registration approval, records of password recovery, e-mail change and downloads performed; the links and codes sent by e-mail are stored in the license server database only in hashed form.
  • Purposes: creating and authenticating the customer’s single account; providing evaluation installers through signed temporary links; reviewing requests for release of complete technical manuals; linking and managing purchased licenses; issuing tax documents for purchases; providing technical support; and preventing registration fraud.
  • Why we request the CPF of residents in Brazil: the CPF is required for three concrete reasons: (i) to uniquely identify the data subject responsible for the account and the software licenses; (ii) to prevent the automated or fraudulent creation of multiple accounts by the same person to artificially restart the 90-day and 30-day free evaluation periods; and (iii) to enable the mandatory issuance of a Nota Fiscal (Brazilian tax invoice) when there is a paid purchase. The CPF is not used for credit profile checks or shared for advertising purposes.
  • Legal bases: performance of a contract or preliminary procedures at the data subject’s request (LGPD, Art. 7, V); compliance with legal and tax obligations in purchases (LGPD, Art. 7, II); Axzon’s legitimate interest in fraud prevention, protection of intellectual property and verification of representatives of legal entities (LGPD, Art. 7, IX); and regular exercise of rights (LGPD, Art. 7, VI).

3.4. Automatic CEP and Postal Code Lookup (/api/endereco)

  • How it works: when you enter the country and the CEP (Brazilian postal code) or postal code on the registration or profile form, the website server performs an automatic server-to-server lookup on public addressing APIs (BrasilAPI and ViaCEP for Brazil; Zippopotam.us for other countries) to fill in street, neighborhood, city and state.
  • Protection of your privacy: the lookup sends only the country and the postal code to these external services. Your name, CPF, e-mail and the IP address of your device are not sent to the CEP APIs. The street result is kept in a technical cache for up to 24 hours.
  • Legal basis: preliminary procedures or performance of a contract (LGPD, Art. 7, V).

3.5. Licensing, Activation and Verification of Software (licencas.axzon.com.br)

  • When it occurs: during the issuance, activation, renewal, return, reissuance or verification of licenses for Axzon software (AxPLCcomm and AxUSBshare), whether directly through the browser/application or through license files (AxRequest.dat / AxUSBshareRequest.dat / request.dat, AxLicence.dat / license.dat, AxRenewRequest.dat and AxRelease.dat).
  • Data processed:
    • cryptographic digests of technical identifiers. The original value of these identifiers is not sent to Axzon. These digests remain linked to the installation and to the account and are not treated as anonymous data;
    • public key generated by the software at installation and its scope (only the system user who made the request or all users of the computer), without the user’s name;
    • product, identification code, edition, contracted limits, status and validity of the license, request and return identifiers, and dates of request, issuance, reissuance, renewal and return;
    • version of the installed software;
    • upon confirmation of the installation (AxInstall), the license identifier, the installation and the date;
    • source and method of each operation (License Portal, file, dashboard or the software itself) and who recorded it (the customer account or an administrator);
    • optional note identifying the installation (for example, “Line 3 PC”); do not include names or other data about individuals in it;
    • proof of return (AxRelease.dat), kept in the license history;
    • link to the customer account and the associated purchase;
    • IP address, origin address of the call (Origin) and date and time of each operation with the license server, including verifications.
  • Detection of simultaneous use: the software checks whether the same licensed installation is in use on more than one computer and records technical license events in a local file on the machine. This verification does not send data to Axzon; data is sent to Axzon only when the user or the software performs an activation, renewal, return or verification operation with the license server.
  • License verification: once a day, or when it is opened, the software verifies the license with Axzon. Axzon records the date of the last verification, the IP address, the software version and the verification method (online or by file).
  • Industrial data we do NOT collect: Axzon software does not collect, does not monitor and does not send to Axzon industrial process data, PLC tag addresses or values, machine parameters, customer application code, or contents of SQL databases or shared USB devices. Nor are the computer name, the operating system user name, the MAC address or customer files sent to Axzon. Once activated, the license operates without the need for a permanent internet connection, without prejudice to the verification described above.
  • Purposes: performing the per-computer license agreement, verifying the license, allowing regular machine transfer through return of the license, providing technical support and protecting Axzon’s intellectual property against cloning or unauthorized simultaneous use.
  • Legal bases: performance of a contract (LGPD, Art. 7, V), Axzon’s legitimate interest in fraud prevention and technical protection of the licensed software (LGPD, Art. 7, IX) and regular exercise of rights (LGPD, Art. 7, VI).

3.6. Purchases, Subscriptions, Payments and Issuance of Nota Fiscal

  • Data processed: buyer identification, CPF/CNPJ or foreign tax identification, billing address, items and plans purchased, amounts, currency, subscription billing cycle, automatic renewal option, transaction status and identifier code, tax invoices issued and proofs of payment sent by the customer (for payments by Pix, boleto (Brazilian bank payment slip) or bank transfer); for purchases with automatic renewal, the e-mail addresses designated to receive renewal notices and the history of those sendings.
  • Security of credit card data: full credit card data (number, expiration date and CVV security code) is entered and processed exclusively in the encrypted environment of the payment platform (such as Mercado Pago, Stripe, Asaas, Paddle or a similar platform displayed at checkout). Axzon does not collect, does not receive and does not store the full number or the security code of your card, receiving from the platform only the payment confirmation and partial reconciliation data (such as status, card brand and last digits).
  • Purposes: processing orders, releasing licenses, managing subscription billing and expiration notices, processing cancellations and refunds, complying with tax and accounting obligations (issuance of NFS-e/NF-e, Brazilian electronic service and goods invoices) and preventing financial fraud.
  • Legal bases: performance of a contract (LGPD, Art. 7, V); compliance with a legal or regulatory obligation before the tax authorities (LGPD, Art. 7, II); regular exercise of rights (LGPD, Art. 7, VI); and credit protection and fraud prevention (LGPD, Art. 7, IX and X). When the address designated for renewal notices belongs to a person other than the account holder, the processing of that address and the sending of the notices rely on the legitimate interest of Axzon and of the customer in managing the subscription (LGPD, Art. 7, IX); whoever designates another person’s address must inform that person.

3.7. Service Communications and Commercial Communications

  • Transactional and service messages: we send e-mails strictly necessary for operating the account and the contracts, such as e-mail confirmation, password reset, security codes, order confirmation, license delivery, tax invoices, advance notices of subscription expiration or renewal and technical or security alerts. These messages arise from the performance of a contract or of preliminary procedures at the data subject’s request, from a legal obligation or from the legitimate interest indicated in sections 3.2 and 3.6 (LGPD, Art. 7, II, V and IX).
  • Recording of delivery and anonymous counting of openings and clicks in automatic e-mails: the automatic e-mails from the website and the account are sent through the Brevo service, from the senders noreply@avisos.axzon.com.br (contact form confirmation) and noreply@licencas.axzon.com.br (registration confirmation, password reset, security codes and renewal notices). Brevo records, for each recipient, the delivery of the message (sent, delivered or bounced), with the date and time. Openings and clicks are counted only anonymously, as overall totals, without being associated with the recipient: Axzon does not know whether you, specifically, opened a message or clicked a link. The account and License Portal e-mails are sent as plain text, without images, and the links they contain lead directly to the website or the Portal, without passing through Brevo. Axzon uses these records only to verify whether service messages arrived, to diagnose delivery failures and to provide support regarding these messages. They are not used for advertising, profiling, engagement scoring or decisions about your account or license, and they are automatically deleted by Brevo after 1 month (section 7). Legal bases: for the sending and the recording of delivery, the same basis as that of the corresponding message, indicated in this section 3; for the anonymous counting of openings and clicks, Axzon’s legitimate interest (LGPD, Art. 7, IX, and Art. 10). You may request information about these records or object to them via the e-mail privacy@axzon.com.br (section 8).
  • No automatic mass mailing: filling out the contact form or creating an account for evaluation does not automatically include you in third-party advertising lists. Any informational or commercial communications from Axzon itself about new versions or related products are intended only for customers or users who request them, always with an immediate and free unsubscribe option (opt-out) in the message itself or via the e-mail privacy@axzon.com.br (LGPD, Art. 7, I and IX; GDPR, Art. 21).

4. Cookies and Local Storage in the Browser

4.1. No advertising or tracking cookies on the website. The website, the Customer Area and the License Portal do not use behavioral advertising cookies, tracking pixels or third-party cookies to monitor you on other websites. The contact form confirmation, sent in HTML, may contain an invisible image and Brevo links used only to count openings and clicks anonymously, without identifying the recipient; the account and License Portal e-mails are plain text, without images (section 3.7).

4.2. Strictly necessary resources. We use only technical resources indispensable for the secure operation of the Platform:

  • Authenticated session cookie: used exclusively after logging in to the Customer Area and the License Portal, configured with the security attributes HttpOnly (inaccessible to malicious scripts), Secure (transmitted only under HTTPS encryption) and SameSite=Lax, to keep your session active and protect your requests against forgery. The browsing language is set directly by the page address (/, /en/ or /es/), without the need for a cookie or local storage;
  • Edge protection cookies (Cloudflare): triggered only when necessary to distinguish legitimate visitors from automated attacks and malicious bots;
  • Local storage only in demonstration mode: while the Customer Area is in demonstration mode (account server not yet connected to the website), the browser stores only the name typed at login, on this computer (localStorage), so that the screens remain navigable. This record stays only in the browser, does not authenticate any account, purchase or license, and is deleted upon logging out. With the real login, the session uses only the cookie described above.

4.3. Because they are strictly necessary to provide the service requested by the user and to ensure the security of the connection, these technical resources do not depend on an advertising consent banner. You may block or delete cookies in your browser settings at any time, bearing in mind that blocking the session cookie will prevent logging in to the Customer Area. If Axzon starts using any non-essential cookie in the future, it will update this Policy and implement a prior specific consent mechanism.

5. With Whom We Share Personal Data

5.1. Axzon does not sell, does not rent and does not share your personal data for behavioral advertising purposes.

5.2. We share only the strictly necessary data with the following categories of recipients, according to the purpose of each operation:

Recipient / Category Role under the LGPD Purpose of sharing Data shared
Cloudflare, Inc. Processor Content delivery network (CDN), website execution (Workers), protection against attacks (WAF/DDoS), cookie-free aggregated statistics and storage of the website’s access logs (Customer Area sign-in and contact form submission) IP address, source port, HTTP headers and technical connection metadata; in the access logs, date and time, IP, port, event type, result and a minimal identifier
Oracle Cloud Infrastructure (OCI) Processor Hosting of the license server and account database (VM) and secure storage of installers and manuals (Object Storage) Account registration data, license records and access logs
Brevo (Sendinblue) Processor Sending of automatic e-mails: contact form confirmation (sender noreply@avisos.axzon.com.br) and account and License Portal e-mails (sender noreply@licencas.axzon.com.br: registration confirmation, password reset, security codes and renewal notices), with recording of delivery per recipient and anonymous counting of openings and clicks (section 3.7) Name, e-mail, telephone/company (if provided), subject and message from the form; name and e-mail of the account holder and addresses designated for renewal notices; delivery records
Microsoft Corporation (Microsoft 365) Processor Hosting of corporate e-mail mailboxes (@axzon.com.br) and productivity tools E-mails and documents exchanged with Axzon’s official channels
Payment platforms and authorized resellers (e.g., Mercado Pago, Stripe, Asaas, Paddle or a similar platform indicated at checkout) and financial institutions Independent controllers (at checkout and for card data) / Processors for reconciliation Processing of payments by card, Pix, boleto or transfer, fraud prevention, chargebacks and, where applicable (Merchant of Record), international billing Purchase identification data, amount, payment status and data provided directly by the buyer at checkout
Accounting firm and tax authorities (Municipality of Barueri/SP, Receita Federal (Brazilian Federal Revenue Service) and State Finance Departments) Legal recipients / Accounting processors Issuance of Notas Fiscais (tax invoices), bookkeeping and compliance with tax obligations Name/corporate name, CPF/CNPJ, address, items and amounts invoiced
WhatsApp (Meta Platforms) Independent controller of the messaging application Commercial or support assistance, only when the data subject chooses to start a conversation via WhatsApp Telephone number, profile name and content sent by the user in the conversation
Public or judicial authorities, or legal counsel Legal recipients / Exercise of rights Compliance with a court order or legal request (Marco Civil and LGPD) and defense of rights in proceedings Only the records or documents strictly required by law or necessary for the defense

5.3. The public postal code lookup APIs (BrasilAPI, ViaCEP and Zippopotam.us) receive from Axzon’s server only the country and the CEP/postal code, without your IP address and without any data that identifies you.

5.4. The processors engaged by Axzon are subject to contractual obligations of confidentiality, information security and prohibition on using the personal data for their own purposes.

6. International Transfer of Personal Data

This section states, in a highlighted manner, when personal data may leave Brazil, where it goes, for what purpose and on what legal basis (LGPD, Art. 33, and the International Data Transfer Regulation approved by Resolution CD/ANPD No. 19/2024).

6.1. Existence and form of the transfer. Axzon is headquartered in Brazil, but some of the providers listed in section 5 may process or store personal data on servers outside Brazilian territory. The data travels by encrypted electronic transmission (HTTPS/TLS). Even when storage takes place in Brazil, the provider may access the systems from abroad, for example for support and maintenance.

6.2. Providers, possible destinations and purposes:

Provider Possible destinations Purpose
Cloudflare Global network of edge servers, including the United States; as a rule, access is served by the server closest to the visitor Delivery of pages, website execution, protection against attacks and storage of the website’s access logs
Oracle Cloud Infrastructure (OCI) Cloud region contracted by Axzon, which may be in Brazil or abroad (such as the United States); if the region is in Brazil, there is no international transfer for storage Hosting of the License Portal, the account database and the installation files and manuals
Brevo European Union Sending of automatic e-mails (contact form confirmation and account and License Portal e-mails) and recording of delivery
Microsoft 365 Region of the service contracted by Axzon, which may be in Brazil or abroad (such as the European Union or the United States) Institutional e-mail and customer assistance
Payment platforms (such as Mercado Pago, Stripe, Asaas, Paddle or a similar platform displayed at checkout) Countries in which the platform processes the transaction, which may include the United States, the European Union or the United Kingdom; the platform and its privacy policy are indicated on the payment screen Payment processing, fraud prevention and, where applicable, international billing

6.3. Legal grounds (LGPD, Art. 33). The ground depends on the destination and purpose of each flow:

  • destination in the European Union: ANPD adequacy decision recognizing the level of data protection of the European Union (ANPD Resolution No. 32/2026; LGPD, Art. 33, I). This decision does not extend to the United Kingdom or the United States;
  • other destinations: the transfer relies on Art. 33, IX, of the LGPD only when it is necessary to perform a contract or preliminary procedure requested by the data subject, to comply with a legal or regulatory obligation of Axzon, or for the regular exercise of rights (Art. 7, II, V and VI). This ground does not cover processing based solely on legitimate interest or on credit protection.

When a flow outside Brazil and the European Union does not fall under these grounds (for example, protection against attacks on Cloudflare’s global edge network, based on legitimate interest), it will depend on another mechanism under Art. 33 of the LGPD, which will be indicated in this section.

6.4. Contractual clauses. In this version, Axzon does not indicate the ANPD standard contractual clauses (LGPD, Art. 33, II, “b”, and Annex II of Resolution CD/ANPD No. 19/2024) as the ground for any transfer. If it starts adopting them with any provider, this section will be updated to indicate the corresponding flow.

6.5. Duration of the transfer: for as long as the processing lasts for the respective purposes, subject to the retention periods in section 7.

6.6. Responsible controller: AXZON TECNOLOGIA LTDA. (contact: privacy@axzon.com.br).

6.7. Your rights in international transfers: you may exercise all the rights described in section 8 through the channel privacy@axzon.com.br, including requesting information about the region in use by each provider and the ground applied to that flow. If any transfer comes to be based on contractual clauses, you may request the full text of the clauses, subject to commercial and industrial secrecy, under the Regulation approved by Resolution CD/ANPD No. 19/2024. You may also petition the ANPD.

7. Retention Periods and Disposal of Personal Data

Personal data is kept only for the period necessary to fulfill the purposes for which it was collected or to meet legal and tax obligations and the regular exercise of rights (LGPD, Arts. 15 and 16):

Data category Retention period and criterion
Application access logs (IP, logical port where applicable, date and time), including the records of each operation and verification with the license server (IP, origin of the call, date and time) Minimum of 6 months (legal obligation under Art. 15 of the Marco Civil da Internet and Art. 15-A of Decree No. 8,771/2016) and maximum of 12 months for security and auditing, unless there is a court order or an ongoing incident investigation
Contact form messages or quotes without subsequent purchase Up to 2 years after the last relevant interaction, or earlier upon a deletion request
Customer Area accounts with no purchases, no licenses and inactive Deleted or anonymized after 24 consecutive months without access, upon prior notice by e-mail 30 days in advance
Accounts with purchases, contractual history, acceptance records and license data General account data is kept during the relationship and for 5 years after its termination (CDC (Brazilian Consumer Protection Code), Art. 27, and Civil Code, Art. 206, § 5). The date of the last verification and the date, method and author of license events (issuance, activation, renewal and return) follow this row. The minimum set of contractual evidence (acceptance record and version of the terms, order, license issued, proofs of return and renewal/cancellation notices, with the history of sendings) may be kept on a restricted basis for up to 10 years after termination for defense in contractual claims (Civil Code, Art. 205), and the minimum record of ownership of a perpetual license remains for as long as the license exists
Tax documents, tax invoices and proofs of payment For the period required by tax and accounting legislation, as a rule 5 years counted from the legal milestone (CTN (Brazilian National Tax Code), Arts. 173 and 174, and Civil Code, Art. 1,194)
Technical files and logs sent in one-off support tickets Up to 90 days after the technical ticket is closed, unless they form part of a warranty or defense record
Internal security incident records At least 5 years (Resolution CD/ANPD No. 15/2024)
Technical cache of CEP lookups Up to 24 hours
Delivery records of automatic e-mails (Brevo) Automatically deleted by Brevo after 1 month; Brevo does not keep the preview of message content. The history of renewal notice sendings kept by Axzon follows the row for accounts with purchases
Backup copies (Backups) Automatically overwritten according to the operational rotation cycle (up to 90 days after deletion from the main database). If a backup needs to be restored, the deletions already recorded are reapplied

7.1. If there is a judicial proceeding, administrative proceeding, inspection or complaint in progress, the relevant data will be kept on a restricted basis until the matter is finally concluded.

8. Your Rights as a Personal Data Subject (LGPD)

8.1. Under Articles 18 and 20 of the LGPD, you may request from Axzon, free of charge and at any time:

  • confirmation of the existence of processing of your personal data;
  • access to your personal data;
  • correction of incomplete, inaccurate or outdated data (contact and address data can be edited directly in the Edit profile option of the Customer Area, and validated tax data can be corrected upon a free request to support or to the Privacy Channel);
  • anonymization, blocking or deletion of unnecessary or excessive data or data processed in non-compliance with the LGPD;
  • portability of the data to another provider of services or products, subject to commercial and industrial secrecy and ANPD regulations, or a full electronic copy of your data when the processing is based on consent or on a contract (LGPD, Art. 19, § 3);
  • deletion of personal data processed on the basis of your consent, where applicable, except in the legal cases of retention (LGPD, Art. 16);
  • information about the public and private entities with which Axzon has shared data;
  • information about the possibility of not giving consent and about the consequences of refusal, when consent is requested;
  • withdrawal of consent, at any time, when this is the legal basis used;
  • objection to processing carried out on the basis of one of the cases in which consent is waived (such as legitimate interest), in the event of non-compliance with the LGPD, as well as objection to receiving commercial communications;
  • review of decisions made solely on the basis of automated processing (LGPD, Art. 20), including verification by a natural person if a technical license block results in a false positive or an application error.

8.2. How to exercise your rights and response times:

  • Send your request to privacy@axzon.com.br (preferably from the e-mail address registered in your account). To protect your privacy against fraudulent access by third parties, we may request proportionate confirmation of identity or of powers of representation.
  • Time limits: we confirm receipt of the request and respond to requests for confirmation or access in simplified format immediately (or within 15 calendar days, under Art. 15 of Resolution CD/ANPD No. 2/2022) and deliver the clear and complete statement within 15 calendar days from the request as our standard of service (and may use, when necessary, the doubled legal time limit of up to 30 days granted to small-scale processing agents by Art. 14, III, of Resolution CD/ANPD No. 2/2022 in conjunction with Art. 19, II, of the LGPD).
  • If any data cannot be deleted immediately (for example, Notas Fiscais within the 5-year tax period or access logs within the mandatory 6 months under the Marco Civil), we will transparently inform you of the legal basis for retention and keep the data blocked for other purposes.
  • You also have the right to file a petition regarding your data against the controller before the Agência Nacional de Proteção de Dados — ANPD (https://www.gov.br/anpd) and before consumer protection agencies.

9. Information Security and Incident Communication

9.1. Axzon adopts technical and administrative security measures compatible with the nature of the data processed, including:

  • encryption in transit on all pages, APIs and portals (HTTPS/TLS);
  • storage of passwords exclusively as a PBKDF2 cryptographic hash and a requirement of passwords with at least 12 characters;
  • session cookies protected with the HttpOnly, Secure and SameSite=Lax attributes, protection against forged requests (CSRF) and automatic invalidation of other sessions when the password is changed;
  • e-mail confirmation by temporary token and validation by 6-digit code for e-mail changes, with links and codes stored in the license server database only in hashed form;
  • delivery of installers through short-lived signed temporary links (10 minutes) and publication of SHA-256 hashes;
  • logical separation between the public website at the edge (Cloudflare) and the license server, with restricted access control.

9.2. Although no system connected to the internet is completely immune to risks, Axzon maintains an incident response procedure. If any security incident occurs that may result in relevant risk or damage to data subjects, Axzon will communicate the fact to the ANPD and to the affected data subjects within the time limits and under the conditions established by Art. 48 of the LGPD and by Resolution CD/ANPD No. 15/2024 (observing the time limit applicable to small-scale processing agents).

10. Children and Adolescents

The Platform, the industrial software and the engineering services of Axzon are intended exclusively for companies and for professionals over 18 years of age. Axzon does not intentionally collect or process personal data of children or adolescents. If it becomes aware of a registration made by a person under 18 without valid legal representation, Axzon will close the account and delete the personal data, except for legal retention obligations.

11. Specific Provisions for Data Subjects Residing Outside Brazil

11.1. Persons in the European Economic Area (European Union, Iceland, Liechtenstein and Norway) and in the United Kingdom

Axzon is established in Brazil and does not direct the offering of its products or services, whether paid or free, to the European Economic Area or to the United Kingdom (Terms of Sale, clause 2.5). The website can be accessed from these regions, and persons located in them may create an account and make purchases. The application of the GDPR and the UK GDPR is determined by law, according to the activities actually carried out, and not by this Policy or by the way in which the data subject arrived at the website. The rights and the time limit indicated below are honored for any data subject in these regions; the legal bases indicated apply when one of these regimes is applicable:

  • Legal bases (GDPR, Art. 6(1)): performance of a contract or pre-contractual steps at the data subject’s request — Art. 6(1)(b) (registration, downloads, licensing, sales and support); compliance with a legal obligation — Art. 6(1)(c), when the requirements of the applicable regime are met; Axzon’s legitimate interest — Art. 6(1)(f) (information security, fraud prevention, protection of intellectual property and anonymous counting of openings and clicks of automatic e-mails, as detailed in section 3); and specific consent where applicable — Art. 6(1)(a).
  • Data subject rights (GDPR, Arts. 15 to 22): in addition to the rights provided for in section 8, you have the rights of access, rectification, erasure (right to be forgotten), restriction of processing, data portability in a structured format, objection to processing based on legitimate interest or direct marketing, and the right to request human intervention, express your point of view and contest any automated license verification decisions.
  • Time limits and exercise: requests are handled free of charge through the channel privacy@axzon.com.br within up to 1 month (extendable by up to 2 additional months in complex cases, upon reasoned notice within the first month, pursuant to Art. 12(3) of the GDPR).
  • Transfer, representative and complaint: the data is processed by Axzon in Brazil and by the providers indicated in sections 5 and 6, at the destinations stated there. The European Commission has recognized Brazil as a country with an adequate level of data protection (adequacy decision of January 26, 2026), which allows personal data to be sent from the European Economic Area to Brazil without additional safeguards. This decision concerns only transfers and does not apply to the United Kingdom: for data subjects in the United Kingdom, the specific rules of the UK GDPR apply. Axzon has not designated a representative in the European Economic Area or in the United Kingdom (GDPR and UK GDPR, Art. 27). This assessment takes into account that the offering is not directed to these regions (Terms of Sale, clause 2.5), that the website, the Customer Area and the License Portal do not use behavioral advertising cookies or tracking pixels (section 4.1) and that the automatic e-mails record per recipient only the delivery, with openings and clicks counted only anonymously, without identifying the recipient, with the purposes and the retention period described in section 3.7. The assessment is reviewed periodically. If Axzon starts directing its offering to these regions, if any Axzon activity constitutes monitoring of the behavior of persons in them, or if the designation is required for another reason, it will designate a representative before starting the activity that requires it and will publish the contact details in this section; if it identifies an already existing obligation, it will regularize the designation immediately. The channel privacy@axzon.com.br deals directly with data subjects and does not replace the representative when the designation is mandatory. You may petition the ANPD and lodge a complaint with the data protection authority of your country of habitual residence, of your place of work or of the place of the alleged infringement (GDPR, Art. 77); in the United Kingdom, the authority is the Information Commissioner’s Office (ICO).

11.2. United States of America (Including California — CCPA/CPRA)

For residents of the United States (including California and other states with their own privacy legislation):

  • No sale and no sharing (Do Not Sell or Share): Axzon expressly declares that it does not sell personal data (“sell”) and does not share personal data for cross-context behavioral advertising (“share” / cross-context behavioral advertising), nor does it offer financial incentives in exchange for the collection of personal data.
  • Categories and purposes: the categories of data collected (registration identifiers, commercial purchase information, technical connection data and hardware license identifiers), their sources, business/commercial purposes and retention periods are fully described in sections 3, 5 and 7 of this Policy.
  • Rights and non-discrimination: to the extent that state legislation applies, you may request knowledge of/access to, correction or deletion of your personal data via the e-mail privacy@axzon.com.br, without suffering any discrimination in price or quality of service for exercising your rights.

12. Changes to This Policy, Governing Law and Jurisdiction

12.1. Axzon may update this Privacy Policy periodically to reflect legislative, regulatory or operational changes. The current version will always be available at https://www.axzon.com.br/en/privacy/ with an indication of the version and the effective date. Substantial changes will be communicated to registered data subjects by e-mail or by a prominent notice in the Customer Area before they take effect.

12.2. This Policy is governed by the laws of the Federative Republic of Brazil. Any judicial disputes shall be submitted to the courts of the Judicial District (Comarca) of Barueri, State of São Paulo, without prejudice to the consumer’s right to bring an action in the courts of the consumer’s domicile (Código de Defesa do Consumidor (Brazilian Consumer Protection Code), Art. 101, I) and to the data subject’s right to petition the ANPD or the competent data protection authority in the data subject’s jurisdiction of residence.

AXZON TECNOLOGIA LTDA. CNPJ 60.495.408/0001-03 · State Registration (Inscrição Estadual): Exempt · Municipal Registration (Inscrição Municipal): 4.BO982-9 Alameda Rio Negro, nº 503, Sala 2011, Alphaville Centro Industrial e Empresarial, Barueri/SP, CEP 06454-000, Brasil Telephone: +55 (11) 95078-6367 Privacy and Data Subject Rights Channel: privacy@axzon.com.br Other channels: contact@axzon.com.br · sales@axzon.com.br · support@axzon.com.br Website: https://www.axzon.com.br · License Portal: https://licencas.axzon.com.br