Privacy Policy - DevOps Services

This Privacy Policy explains how MATHEUS DA CONCEICAO HOFSTEDE (VAT MT31675812) ("Company", "we") collects, uses, stores, and protects your personal data when you access our website or contract our DevOps services. We comply with major data protection legislation, including the European Union's General Data Protection Regulation (GDPR) and applicable U.S. privacy laws.

Last updated: July 20, 2025

Overview

We collect personal data transparently and securely through our contact form and during commercial negotiation processes. We apply privacy-by-design principles and data minimization, ensuring compliance with both European and American regulations.

Data Collected

Through the Contact Form

Full name
Corporate email
Phone number (optional)
Company name
Project description or requirement

During Negotiation and Contracting

Identification data: Name, company tax document, position
Contact information: Corporate address, phone, email
Contractual data: Service scope, timeline, agreed values
Financial information: Billing data (when applicable)

Automatic Technical Data

IP address (anonymized when possible)
Browser information and operating system
Website navigation data

Legal Bases and Compliance

Legal Basis	Application	Article
Consent	Newsletter, analytical cookies	Art. 6(1)(a)
Contract performance	DevOps service provision	Art. 6(1)(b)
Legitimate interest	Website security, commercial communication	Art. 6(1)(f)
Legal obligation	Tax and accounting retention	Art. 6(1)(c)

For Users in the United States

We follow applicable federal and state laws, including:

California Consumer Privacy Act (CCPA) for California residents
Federal Trade Commission Act for commercial practices
Specific state laws where applicable

Processing Purposes

Response to inquiries via contact form
Development of personalized commercial proposals
Execution of contracted DevOps services
Client relationship management with active customers
Billing and collection of provided services
Communication about ongoing projects
Compliance with legal and tax obligations
Security and fraud prevention

Authorized Partners

Infrastructure providers (AWS, Azure, Google Cloud) — with adequate contractual clauses
Development tools (GitLab, GitHub) — only necessary technical data
Third-party accounting — financial data with confidentiality agreement
Specialized suppliers — minimal data for specific project execution

Government Authorities

Tax authorities — when required by law
Judicial authorities — under legal order

Commitment: We do not sell, rent, or commercialize personal data with third parties for marketing purposes.

International Data Transfers

European Union ↔ United States

We use the EU-US Data Privacy Framework of 2023 for secure transfers between EU and US. This mechanism:

Enables secure flow of personal data between EU and certified American companies
Establishes safeguards for access by American intelligence agencies
Offers redress mechanism through the Data Protection Review Court

Other Transfers

For countries outside EU/US, we apply:

Standard Contractual Clauses approved by the European Commission
International security certifications (ISO 27001)
Adequate technical security measures

Data Retention

Category	Period	Justification
Contact form	2 years	Future business opportunities
Contractual data	7 years after termination	Legal obligations and warranties
Tax information	10 years	Tax legislation
Security logs	12 months	Incident analysis and audit

Your Rights

Universal Rights

✅ Access to your personal data
✅ Rectification of incorrect information
✅ Erasure when there's no legal basis
✅ Portability in structured format

✅ Objection to processing based on legitimate interest
✅ Restriction of temporary processing
✅ Complaint to data protection authorities

US-Specific Rights

✅ Opt-out of data sales (where applicable)
✅ Non-discrimination for exercising privacy rights
✅ Information about categories of collected data

How to exercise: Send request to contato@mediato.dev

Response time: Up to 30 days

Security Measures

Technical Protections

TLS 1.3 encryption for data transmission
AES-256 encryption for stored data
Multi-factor authentication for critical systems
Continuous security monitoring

Organizational Protections

Need-to-know access basis
Regular training on data protection
Strict access controls
Incident response plan

Cookies and Tracking Technologies

Cookies We Use

Cookie	Purpose	Category	Duration
`cookie_consent`	Remembers your cookie preferences	Necessary	1 year
`_ga`, `_ga_*`	Google Analytics: pages visited, sessions	Performance	2 years
`_gcl_au`	Google Ads: conversion tracking	Marketing	90 days

Website functionality and forms
Security and attack prevention

Google Analytics 4 — pages visited, time on site, referring site, approximate country/region, and which page a contact form was opened and submitted from.

Google Ads — conversion tracking for form submissions and, where enabled, remarketing.

Before you make a choice in the cookie banner, Google's tags still load in a cookieless mode: no _ga or _gcl_au cookie is written, but a cookieless ping is sent to Google so it can produce aggregate, modeled statistics for visitors who have not yet consented (or who decline). Accepting Performance and/or Marketing cookies switches the relevant tags to normal, cookie-based tracking.

When you submit our contact form, we record — without using cookies or any device storage — the page you were on, the page you arrived from (referrer), any campaign parameters in the URL (UTM parameters, Google Click ID), and an approximate country derived from your IP address at the time of the request. This is stored together with your contact details in our CRM (Brevo) so we can understand which content and campaigns produce inquiries, under our legitimate interest in understanding and improving how we reach clients (Art. 6(1)(f)). You may object to this processing at any time — see "Your Rights" below.

Management

You can control cookies at any time through your browser settings or our cookie preference panel, available via the "Cookie preferences" link in the site footer.

Data Breach Notification

For EU Users

72 hours to data protection authorities
Without undue delay to affected data subjects
Detailed information about the incident

For US Users

According to applicable state legislation
Notification to competent authorities
Transparent communication to affected parties

Minors

Our services are exclusively directed to businesses (B2B). We do not intentionally collect data from minors under 16 years old (EU) or 13 years old (US). If we identify such data, it will be deleted immediately.

Policy Changes

Significant changes will be communicated through:

Prominent banner on the website
Email to registered contacts
30-day advance notice for substantial changes

Data Protection Officer

MATHEUS DA CONCEICAO HOFSTEDE

VAT: MT31675812
Email: contato@mediato.dev
Responsibility: Compliance supervision and data subject rights

Contact and Complaints

Company Details

MATHEUS DA CONCEICAO HOFSTEDE

VAT: MT31675812

Location: Malta

Questions or Requests

Email: contato@mediato.dev
Subject: Include "Data Subject Request" for faster processing

Supervisory Authorities

Malta:

Information and Data Protection Commissioner (IDPC): idpc.org.mt

European Union:

European Data Protection Board (EDPB): edpb.europa.eu
National authorities of each Member State

United States:

Federal Trade Commission (FTC): ftc.gov
State attorneys general where applicable

You have the right to lodge a complaint with competent authorities without prejudice to other available legal remedies.

This policy has been developed to ensure compliance with both European GDPR and major American privacy laws, ensuring adequate protection of your personal data regardless of your location.