Privacy policy

Who controls the data

BOSSFIGHT LTDA, CNPJ 48.714.176/0001-31, is the controller of the personal data processed by this website.

Requests about personal data go to ajuda@bossfight.com.br.

What this policy covers

It applies to Bossfight's institutional pages. chatBOSS, at chat.bossfight.com.br, is a product with its own account. Agenda Xtal is the scheduling system for the health segment and for companies.

What each account stores inside, such as messages, patients, or support history, depends on the contracted operation. This page does not list those records. Questions about them go to the same email.

Data this website processes

The public pages do not ask you to create an account. The contact form does not save the message in a database on this website. It opens the email program of the person who filled it in, with the text ready. The conversation then exists in the cto@bossfight.com.br inbox and in the sender's inbox.

The server that delivers the site may log IP address, date, time, and page address, to keep the service running and to investigate abuse.

The sound button plays only after a click. That click does not create an account and does not store a profile.

What we use it for

Email is used to reply to the person who wrote and, if the conversation continues, to talk about a service, a product, or a contract.

Technical logs are used to operate the site and reduce abuse.

Bossfight does not sell a contact list from this website and does not place third-party ads on these pages.

LGPD legal bases

Replying to a message the person sent relies on steps prior to a contract, at their request, or on the legitimate interest of answering a commercial contact, depending on the case.

Keeping a technical connection log for security relies on legitimate interest and on the legal duties that apply to whoever operates the service.

If an activity depends on consent, we ask for it in a specific way. The data subject can withdraw consent. That does not erase processing already done on another legal basis.

Who we share it with

Providers that host the site or the email inbox receive only what they need for that service.

That provider list changes with the infrastructure contract. If you ask, we will say with whom a piece of your data was shared, within the limits of article 18 of Brazilian Law 13,709/2018.

This website does not advertise an international transfer of data. If a provider stores data outside Brazil, the transfer follows the LGPD, and we notify the data subject when the law requires it.

We may disclose data to a public authority when there is a legal duty or a valid order.

How long we keep it

Email messages stay for as long as needed to reply, negotiate, or meet a legal or accounting duty.

Technical logs stay for the period the law requires and for as long as needed for the security of the service.

When the period ends and there is no duty to keep the data, we delete it or anonymize it.

Data subject rights

You can ask for confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, and withdrawal of consent.

The request goes to ajuda@bossfight.com.br. The reply comes promptly, in a simplified form, or within 15 days, as the LGPD provides.

A complaint to the Brazilian National Data Protection Authority is also available.

Children and teenagers

The site is aimed at companies. We do not ask a child to register.

If we receive a child's data without the proper legal basis, we delete it after confirming the case.

Security and changes

Access to the company email and the server is limited to people who need to operate the service. No website is immune to an incident. If an incident could create relevant risk or harm, we notify the data subjects and the authority as the law requires.

When this policy changes, the date at the top of the page changes with it. The new version applies once it is published here.