We operate in compliance with Brazil's LGPD (Law 13.709/2018) and align practices with GDPR for international customers. This page details how Partenero collects, processes, protects and returns control over personal data, focused specifically on the context of Customer Success, Customer Experience and AI agents.
Last updated: May 15, 2026
The distinction between controller and processor is essential: it defines who decides purposes, who responds to rights requests, and who answers to authorities.
When you browse partenero.com, submit contact forms, attend webinars, apply to job openings or receive our commercial communications. In these cases, Partenero decides purpose and means of processing and responds directly to the ANPD/supervisory authority and to you.
When customer companies use the Partenero platform to manage their own end customers (accounts, contacts, conversations, healthscore, tickets, AI handling). In these cases, the customer company is the Controller of the data, and Partenero processes data strictly per contractual instructions, with no reuse for own purposes.
Each processing purpose is declared before collection. We do not repurpose data without a new legal basis.
Processing remains compatible with the stated purpose. Material changes trigger new communication to the data subject.
We collect the minimum necessary. Optional fields are marked as such in forms and screens.
Data subjects can review data, purposes, duration and sharing through a single, free channel.
We keep active channels for correction and deletion. Internal bases have routine sanitation.
This policy, the Privacy Policy and the Cookie Policy are public, updated and versioned.
Technical and organizational layers detailed in the Security section of this page.
Impact assessments (DPIA) precede material changes and new AI use cases.
We forbid use of data for discriminatory purposes or harm to vulnerable groups.
We keep records, evidence and a response plan to demonstrate compliance when requested.
We use the hypotheses of Art. 7 (personal data) and Art. 11 (sensitive data, when applicable) of LGPD, equivalents under GDPR Art. 6/9. The basis applied to each processing activity is available on request to the DPO.
Data necessary to deliver the platform to paying customers: provisioning, billing, support, integrations.
Tax and accounting retention, response to ANPD and other authorities.
B2B marketing with safeguards, fraud prevention, information security, product improvement based on aggregated and anonymized data.
Analytics and marketing cookies, newsletter, optional surveys. Always revocable in one click.
Applied only in specific cases, always documented and reviewed by the DPO.
As a data subject, you can exercise any of the rights below by writing to contato@partenero.com. The DPO responds within 15 days.
Know whether we process any personal data about you.
Obtain a copy of the personal data we process.
Request correction of incomplete, inaccurate or outdated data.
Request anonymization, blocking or deletion of unnecessary or non-compliant data.
Receive your data in a structured format (CSV or JSON) or have it sent directly to another vendor.
Request deletion of data processed under consent, subject to legal retention duties.
Know with which public and private entities your data has been shared.
Know the consequences of not granting consent and how to deny it.
Revoke any granted consent, at any time, at no cost.
Note: Requests related to operational data inserted by a Partenero customer (you are an end customer of a company that uses the platform) are first directed to the Controller company. We automatically forward when applicable.
We have operated AI agents in production since 2024. LGPD provides specific rights when automated decisions occur (Art. 20). Here is how we comply:
Contracts with OpenAI, Anthropic and Google include zero-retention clauses and prohibition of training use. Provider logs are kept at most 30 days for abuse detection. On Enterprise plans, we offer model pinning and dedicated deployments when required.
When an agent takes decisions with material effect on the data subject (e.g., exchange approval, discount granting, escalation), we offer review by a natural person upon request. The flow is configurable per customer.
Every agent action logs: prompt sent, sources consulted (RAG), tools called, parameters, generated response, confidence level and execution identifier. Logs remain available for 180 days.
PII detection, topic blocklists, automatic masking, and human fallback when the model indicates low confidence. Each customer configures their own guardrails without code.
We maintain a public, versioned list of subprocessors. Material additions are communicated to customers 30 days in advance, with a right to object.
Amazon Web Services (sa-east-1 primary, us-east-1 backup).
Cloudflare (DDoS, WAF, CDN).
OpenAI, Anthropic and Google (under zero-retention contracts).
Meta WhatsApp Business API, Twilio (SMS/voice), SendGrid (transactional email).
Datadog and Sentry (logs and errors, no PII in payload).
Stripe (card) and local provider for boleto and PIX.
Data of Brazilian customers resides in Brazil (AWS sa-east-1, São Paulo) by default. Encrypted backups may be replicated to us-east-1 (Virginia, USA) for resilience. In all cases, we adopt standard clauses aligned with ANPD recommendations and GDPR (SCCs) to ensure adequate protection.
São Paulo, Brazil (AWS sa-east-1).
Virginia, USA, encryption at rest (AES-256) and in transit (TLS 1.3).
Regional endpoints when available. For customers requiring full Brazilian residency, we offer models hosted in SP.
| Active account | For the duration of the contract, plus what is necessary to deliver the service. |
|---|---|
| After cancellation | 60 days for portability and export. After this period, we delete or anonymize. |
| Backups | Rolling 90-day window. Backups expire automatically. |
| Audit logs | 180 days for application logs, 12 months for security logs. |
| Legal obligations | Tax and accounting documents may be retained for up to 5 years, per applicable law. |
| Marketing | Marketing bases are reviewed every 12 months. Inactive contacts are anonymized. |
TLS 1.3 in transit, AES-256 at rest, key management via AWS KMS.
Granular RBAC, SSO/SAML, MFA mandatory for admins, IP allowlist on Enterprise.
Immutable logs of access, changes and exports. Trail by user, device and IP.
SOC 2 Type II underway (2026 completion), ISO 27001 underway, annual third-party pentest, private bug bounty program.
RPO 1h, RTO 4h. Semiannual DR tests with report available under NDA.
Mandatory annual training on LGPD and security. Background check for teams with production access. Principle of least privilege.
We update this page whenever we change relevant practices. Material changes are communicated to active customers 30 days in advance, by email and in-product. Previous versions remain available in history, accessible on request.
Partenero's DPO is the contact point for data subjects, customers and authorities. We do not use intermediate forms: you write, a person responds.
SLA
Reply within 15 business days (Art. 19, LGPD).
Postal address
Bizware Soluções em Informatica LTDA · Av. Pres. Juscelino Kubitschek, 2.041 · Torre B · São Paulo, SP · 04543-011 · Brazil
trust by design
30 minutes with a specialist, with a tour of privacy and audit controls. No generic demo.
