PJMoney Serviços em Tecnologia Ltda., a company incorporated under Brazilian law, registered under CNPJ 40.870.650/0001-02, trading as Veertical Technologies and the developer of Lekkus ERP, presents its Privacy Policy.
This document explains, in plain language, what personal data we process, why, who we share it with, how long we keep it, and how you exercise your rights under Regulation (EU) 2016/679, the GDPR, and under Brazilian Law 13.709/2018, the LGPD.
It applies to the lekkus.com, lekkus.com.br, lekkus.pt and lekkus.es websites and to the Lekkus ERP platform. If you are a customer and you use the system to store data about your own customers, read the section on roles carefully: responsibility there is yours, and ours is a different one.
1. Who processes your data
- Controller
- PJMoney Serviços em Tecnologia Ltda. (Veertical Technologies), CNPJ 40.870.650/0001-02, Brazil
- Data Protection Officer
- contact@lekkus.com
- Representative in the European Union
- The designation of a representative in the European Union under Article 27 GDPR is in progress. Until it is complete, all data protection matters should be addressed to contact@lekkus.com.
The GDPR applies to our processing because we offer our services to people located in the European Union, under Article 3(2), regardless of the controller being established in Brazil.
2. What data we process
We process only what is adequate, relevant and limited to what is necessary, the data minimisation principle of Article 5(1)(c) GDPR:
- Data you type into the form
- name, e-mail address, company tax identification number, company name, industry sector and, if you write one, the text of your message. We deliberately do not ask for a phone number at this stage.
- Technical data collected automatically
- IP address, browser identification (user agent), the address of the page the form was submitted from, and the date and time of submission. Used for security and to evidence the origin of the enquiry.
- Public company data
- when you enter a Brazilian company tax number, we query a public database that returns the registered legal name and activity, so the form fills itself in for you. That is data about the legal entity, not about you.
We do not process special categories of personal data. We do not collect racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic, biometric or health data, or data concerning sex life, and no field in any of our forms collects them.
3. Purposes and legal basis
Every processing operation rests on one of the grounds in Article 6(1) GDPR, and on the corresponding ground in Article 7 LGPD:
- Answering your enquiry and presenting the product
- steps taken at your request prior to entering into a contract, point (b). You filled in the form precisely so we would get in touch, so we do not depend on your consent to reply.
- Security, fraud prevention and technical logging
- legitimate interests, point (f). This is what allows us to keep the IP address and browser identification to detect automated submissions and abuse.
- Providing the service you contracted
- performance of a contract, point (b).
- Tax, accounting and regulatory obligations
- compliance with a legal obligation, point (c).
- Marketing messages and product news
- consent, point (a), which you can withdraw at any time, without giving reasons and at no cost, through the unsubscribe link at the foot of every message. Withdrawal does not affect the lawfulness of processing carried out beforehand.
6. International transfers
The controller is established in Brazil, so your data is transferred outside the European Economic Area. Some providers also operate in the United States. The record of your enquiry is stored on servers located in Brazil, in the São Paulo region.
These transfers rely on the mechanisms in Chapter V GDPR, Articles 44 to 49, in particular Standard Contractual Clauses approved by the European Commission and the data protection commitments each provider takes on contractually. Under the LGPD, the corresponding provision is Article 33. The purpose of these instruments is simple: to make the level of protection travel with the data.
You may request information about the safeguards in place, and a copy of the instruments used, by writing to contact@lekkus.com.
7. How long we keep it
- An enquiry that did not become a contract
- up to 24 months from our last contact. After that, the record is deleted or anonymised.
- Application access logs
- six months. In Brazil this is a statutory obligation under Article 15 of the Marco Civil da Internet; elsewhere we keep the same period on security grounds.
- Customer data
- for the duration of the contract and, after it ends, for the statutory tax and accounting retention periods and the applicable limitation periods.
- Marketing consent
- until you withdraw it. The record of the withdrawal itself is kept, because that is what evidences that we stopped when you asked.
8. Security
We apply appropriate technical and organisational measures under Article 32 GDPR, among them end to end encrypted traffic, role based access control, isolation of each customer tenant, operation logging and regular backups.
No measure removes risk entirely, and promising otherwise would be dishonest. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify the supervisory authority and communicate with you, under Articles 33 and 34 GDPR and Article 48 LGPD.
9. When you are a Lekkus ERP customer
There is a distinction here that changes who answers for what, and it is routinely missed.
- Your own account data in Lekkus
- we are the controller. This policy applies in full.
- The data you enter into the system
- the records of your customers, suppliers and staff. There you are the controller and we are the processor, within the meaning of Article 4(8) GDPR. We process that data solely on your documented instructions and under the contract.
The practical consequence: it is the customer who must have a legal basis for the data they enter, and it is the customer the data subject must approach to exercise their rights over it. If they come to us directly, we will forward the request without delay.
10. Artificial intelligence
Lekkus ERP uses artificial intelligence in some features, notably the triage and analysis of support requests. Where it does, the content needed may be sent to specialised language model providers engaged as processors.
Two commitments we consider important enough to write down here:
- We do not use your data to train artificial intelligence models of our own.
- We take no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. The analyses and fixes our automation proposes are subject to human validation before they take effect, and you have the right set out in Article 22 GDPR and Article 20 LGPD.
11. Your rights
Articles 15 to 22 GDPR and Article 18 LGPD give you the following rights, free of charge. To exercise any of them, write to contact@lekkus.com.
- Access to the data we process about you, and a copy of it.
- Rectification of inaccurate or incomplete data.
- Erasure, also known as the right to be forgotten.
- Restriction of processing.
- Portability, receiving the data in a structured, commonly used format.
- Objection to processing based on legitimate interests, and an unconditional objection to direct marketing.
- Not to be subject to a decision based solely on automated processing.
- Withdrawal of consent at any time.
- Information about the public and private entities we have shared your data with.
So we can locate your record, please give at least your name, the e-mail address used in the enquiry and, where applicable, the company tax number. We reply within one month of receipt under the GDPR, extendable by up to two further months for complex requests, in which case we will tell you about the extension and why. Where the LGPD applies, its fifteen day deadline is the one we meet.
12. Children
Lekkus ERP is a product for businesses and is not directed at children. We do not knowingly collect data from minors. If you believe this has happened, write to us and the record will be deleted.
14. Changes to this policy
We may change this policy to keep pace with the product or with the law. The date of the last update is at the top of the page, and material changes are notified by e-mail to customers.