Privacy Policy
How 4Tax handles your personal data on our website, client portal, WhatsApp and e-mails, under Brazil’s General Data Protection Law (LGPD).
1. Who we are
4 TAX CONSULTORIA LTDA (“4Tax”, “we”), registered under Brazilian CNPJ no. 50.971.220/0001-30, with offices at Rua Gomes de Carvalho, 768, Vila Olímpia, São Paulo/SP, Brazil, ZIP 04547-003, is the controller of the personal data processed under this Policy, pursuant to Brazilian Law no. 13,709/2018 (General Data Protection Law, “LGPD”).
This Policy explains which personal data we process, why, with whom we share it, how long we keep it and how you can exercise your rights.
Data Protection Officer (DPO): Victor Barcelos, at vb@4taxgroup.com. This is the channel for questions, requests and complaints about your personal data.
2. Scope
This Policy applies to the personal data of clients, prospective clients, partners, company representatives and visitors who interact with 4Tax through:
- our website 4taxgroup.com, including the contact form;
- the 4Tax Portal (portal.4taxgroup.com), used by clients, partners and our team;
- 4Tax’s WhatsApp;
- e-mail, including newsletters and announcements;
- meetings, events and webinars.
Our employees’ data is covered by a separate internal policy.
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Identification and contact | Name, e-mail, phone, job title, company | You (form, WhatsApp, e-mail, meetings) or whoever referred you |
| Onboarding documents (KYC) | Passport, ID document, proof of address, Brazilian tax ID (CPF), shareholder and beneficial owner details | You or your representative, via the portal or e-mail |
| Tax and wealth data | Tax returns, income statements, bank statements, details of companies and structures abroad | You, your representative or institutions you indicate |
| Conversations | Messages, audio, photos and documents sent via WhatsApp or e-mail; WhatsApp profile name | You |
| Business relationship | History of contacts, meetings, proposals and team notes | Generated by 4Tax |
| E-mail communications | Subscription status, sends, link clicks | Generated by the send |
| Browsing and access | IP address, browser, portal access date and time, website cookies | Your device |
We do not ask for sensitive data (health, religion, biometrics and others listed in art. 5, II, LGPD). If such data appears in a document you send us, it will be processed only for the purpose of the service.
4. Purposes and legal bases
| Purpose | Legal basis (LGPD) |
|---|---|
| Responding to enquiries and preparing proposals | Pre-contractual steps at the data subject’s request (art. 7, V) |
| Providing the contracted services: accounting, tax compliance, corporate structures in Brazil and abroad | Performance of a contract (art. 7, V) |
| Verifying identity, shareholders and beneficial owners (KYC) and preventing money laundering | Compliance with legal or regulatory obligations (art. 7, II), including rules of the jurisdictions where we incorporate or manage companies |
| Keeping accounting and tax records | Compliance with legal obligations (art. 7, II) |
| Serving clients over WhatsApp and keeping the service history | Performance of a contract or pre-contractual steps (art. 7, V) and legitimate interest in continuity of service (art. 7, IX) |
| Managing the business relationship (history, meetings, next steps) | Legitimate interest (art. 7, IX) |
| Sending newsletters, invitations and announcements | Consent (art. 7, I) or legitimate interest in communicating with clients and contacts who reached out to us (art. 7, IX), always with an opt-out |
| Protecting the portal and preventing fraud and unauthorized access | Legitimate interest (art. 7, IX) and the data subject’s security |
| Exercising rights in judicial, administrative or arbitration proceedings | Regular exercise of rights (art. 7, VI) |
When we rely on legitimate interest, we first assess that it does not override your rights. You may object to such processing through the DPO channel.
5. WhatsApp
Our WhatsApp runs on the official WhatsApp Business Platform by Meta. When you write to us:
- we receive your number, your profile name and the content you send (text, audio, photos and documents);
- the conversation is recorded in 4Tax’s service system and linked to your record, so anyone on our team can follow up;
- if your number is not yet in our records, we create a contact record for it;
- files you send are kept in 4Tax’s private storage, accessible only to authorized team members.
We have no access to your profile photo, your contacts or your conversations with other people. We only start a WhatsApp conversation with people who already have a relationship with us, using message templates approved by Meta.
Meta processes message data as the platform provider, under the WhatsApp Privacy Policy and the WhatsApp Business terms. You can ask not to be contacted via WhatsApp at any time, by replying in the conversation or through the DPO channel.
6. E-mail communications
We send newsletters, event invitations and announcements to clients and to contacts who reached out to us or subscribed. Every e-mail includes an unsubscribe link that takes effect immediately; anyone who unsubscribes will not receive announcements again, even if they contact us later.
To learn what interests our audience, we record clicks on links in our e-mails. We do not track whether an e-mail was opened. Operational e-mails about contracted services (deadlines, pending documents) continue for as long as the contract lasts.
7. Who we share data with
We do not sell personal data. We share only what is necessary with:
| Who | Why |
|---|---|
| Microsoft (Azure and Microsoft 365) | Hosting of the portal, database, file storage, e-mail, calendar and sign-in |
| Meta (WhatsApp Business) | Sending and receiving WhatsApp messages |
| E-mail delivery providers (Azure Communication Services by Microsoft, with Brevo as backup) | Delivery of e-mail communications |
| Google (Google Ads) | Measuring whether a website visitor got in touch (without identifying the person by name) |
| Registered agents, banks, auditors and service providers abroad | Incorporating and maintaining the companies and structures you engaged us for, in the chosen jurisdictions |
| Public authorities and regulators | Complying with legal, tax and anti-money laundering obligations, or court orders |
Service providers process data on our behalf, under contract, and only for the purposes we specify.
8. International transfers
Some data may be processed outside Brazil:
- by technology providers with servers abroad, such as Meta (WhatsApp) and Microsoft and Google services;
- when you engage us to incorporate or manage companies in other jurisdictions, and sending data to local agents, banks and authorities is part of the service itself.
In these cases the transfer relies on art. 33 of the LGPD: performance of a contract at your request, compliance with legal obligations or contractual clauses with providers, under the rules of Brazil’s data protection authority (ANPD). The 4Tax Portal database and files are hosted on Microsoft servers in Brazil (Brazil South region). Automated reading of identity documents submitted during onboarding, such as passports, uses a Microsoft service located in the United States.
9. How long we keep data
| Data | Retention |
|---|---|
| Accounting and tax documents | For the duration of the contract and the legal retention period, at least 5 years |
| KYC records and documents | For the duration of the relationship and as required by applicable anti-money laundering rules, at least 5 years after the relationship ends |
| WhatsApp conversations and business history | While the relationship lasts and up to 5 years after the last contact |
| Contacts who never became clients | Up to 2 years after the last contact, unless actively subscribed to announcements |
| Subscription to announcements | Until you unsubscribe; we keep the unsubscribe record so we do not send again |
| Portal access logs | At least 6 months (Brazilian Internet Civil Framework, art. 15) |
At the end of the period, data is deleted or anonymized, unless the law allows us to keep it (art. 16, LGPD).
10. Security
We adopt technical and administrative measures to protect data, including:
- portal access only through corporate sign-in and role-based permissions;
- encrypted connections (HTTPS) and encrypted database connections;
- documents kept in private storage, opened only through temporary links generated for authorized people;
- verification of the authenticity of messages received from WhatsApp;
- audit logs of changes to records.
No system is completely immune to incidents. If an incident may pose a relevant risk or harm to you, we will notify you and the ANPD as required by art. 48 of the LGPD.
11. Your rights
Under the LGPD (art. 18), you may request at any time:
- confirmation that we process your data and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
- portability of your data to another provider;
- deletion of data processed based on consent;
- information about whom we share your data with;
- withdrawal of consent and objection to processing based on legitimate interest.
How to request: write to vb@4taxgroup.com. We may ask you to confirm your identity first. We reply within 15 days. Some data cannot be deleted while a legal retention obligation applies; in that case we explain why.
You may also file a complaint with Brazil’s National Data Protection Authority (ANPD).
12. Cookies and measurement
On our website we use:
- cookies required for the site to work and to remember your cookie choices;
- the Google Ads tag, which records when a visitor clicks WhatsApp or submits the form, so we can measure ad results;
- YouTube videos in privacy-enhanced mode (youtube-nocookie.com).
You choose which cookies to accept in the banner shown on the website and can change your choice at any time. On the portal we use only what is necessary to keep your session and your account secure.
13. Children and adolescents
Our channels are not directed to people under 18. When a service involves data of children or adolescents (for example, dependents in a tax return or heirs in succession planning), such data is processed in the minor’s best interest, with information provided by parents or guardians (art. 14, LGPD).
14. Changes to this policy
We may update this Policy when our services change or when required by law. The last update date is shown at the top. Relevant changes will be communicated to clients through the usual channels.