Privacy policy

1. Who we are

Golden Valley Consulting ("GVC", "we", "us") is a company based in Brazil, registered under CNPJ 50.770.217/0001-59, with offices at R. Madeira de Freitas, 90, Praia do Canto, Vitória, ES 29055-320, Brazil. We are responsible for the personal information described in this policy. As a Brazilian company, we process personal information under Brazil's General Data Protection Law (Lei 13.709/2018, the "LGPD"), and we describe below the rights available to you wherever you live.

This policy covers the website gvc.goldenvalleyc.com, our online course platform, e-book store, online booking calendar, forms and email communications. Digital Valley products with their own terms, such as Project Valley, are also governed by the policies published for those products.

When a consulting client shares personal information from its own operations with us so we can deliver a project, GVC acts as a service provider (processor) and handles that information only on the client's instructions and under our contract.

2. Information we collect

We collect only what each purpose requires:

• Contact form: name, email, phone number, company, subject and the content of your message.
• Meeting bookings: name, email, phone number, the date and time you choose and any answers you give when booking.
• Purchases of courses, e-books and services: name, email, phone number, billing address, order and payment history, and, when required for Brazilian invoicing, a Brazilian tax ID (CPF or CNPJ). Card details are entered with our payment provider; GVC does not store full card numbers.
• Course platform: login details, lesson progress, answers to exercises and assessments, and certificates issued.
• Newsletter and email communications: name, email, subscription preferences, and delivery, open and click records.
• Browsing and cookies: IP address, browser and device type, language, pages visited, date and time of access, and your choices in the cookie notice.
• Business information from third parties: name, job title, company and business contact details obtained from public sources and business data providers, used for business-to-business outreach.
• Clients and suppliers: contact details for representatives and people involved in contracts and projects.

Our forms do not ask for sensitive personal information (such as health, religion or biometric data). Please don't send it.

3. How we use information and why

• To respond to enquiries, schedule and hold meetings, and prepare proposals: steps you ask us to take before entering a contract, and our legitimate interests.
• To deliver courses, e-books, consulting and subscriptions, bill you, issue tax invoices and provide support: performance of a contract and compliance with legal obligations.
• To send our newsletter and educational content: your consent, which you can withdraw at any time through the unsubscribe link in every email.
• To send business communications and B2B outreach, limited to professional information: our legitimate interests, always with an option to unsubscribe.
• To keep the website secure, prevent fraud and keep access logs: compliance with legal obligations and our legitimate interests.
• To establish, exercise or defend legal claims: our legitimate interests and legal obligations.
• To improve our content, courses and services using aggregated information: our legitimate interests.

When we rely on legitimate interests, we consider whether the use is something you would reasonably expect and whether it respects your rights.

We do not sell personal information, and we do not share it for targeted advertising.

4. How we share information

We share personal information only with parties that need it to provide the service, and only to the extent necessary:

• Odoo: the cloud platform that hosts our website, CRM, store, courses, booking calendar, email marketing and billing.
• Stripe: payment and subscription processing.
• Microsoft (Azure and Microsoft services): hosting for the integrations between our systems, plus email and collaboration services.
• Tax service providers and Brazilian municipal authorities: tax calculation and issuance of electronic service invoices (NFS-e).
• Third-party content embedded on the site (such as YouTube videos and our Spotify podcast): these services load only after you accept them in the cookie notice.
• Government authorities: when required by law, regulation or court order.
• Corporate transactions: in a merger, acquisition or reorganisation, under the same protections described in this policy.

Our service providers process information on our behalf, following our instructions and their own data protection terms.

5. International transfers

GVC is based in Brazil. If you are in New Zealand or elsewhere, your information will be transferred to and processed in Brazil, and some of our service providers store or process information in other countries, including the United States and the European Union.

Privacy laws in those countries may differ from those where you live. We rely on our providers' contractual data protection commitments and, where applicable, on the transfer mechanisms recognised under Brazilian law.

6. How long we keep information

We keep personal information only as long as needed for the purpose it was collected for, or as long as the law requires:

• Contacts and sales opportunities: while there is an active relationship or a legitimate business interest. We review our records periodically and delete or anonymise what is no longer needed.
• Clients, contracts and tax records: for the periods required by tax, accounting and civil law.
• Website access logs: for the minimum period required by Brazilian law.
• Newsletter: until you unsubscribe.
• Course platform: while your account is active or until you ask us to delete it, except for records we are legally required to keep.

At the end of the retention period, information is deleted or anonymised.

7. How we protect information

We use technical and administrative safeguards appropriate to the risk, including role-based access, authentication, encrypted connections (HTTPS) and service providers with recognised security practices.

No system is completely secure. If a security incident creates a significant risk to you, we will notify you and the relevant authorities as required by applicable law.

8. Your privacy rights

Regardless of where you live, you can ask us to:

• confirm whether we process your personal information and give you access to it;
• correct information that is incomplete, inaccurate or out of date;
• delete, anonymise or restrict information that is unnecessary or excessive;
• provide a copy of your information in a portable format;
• tell you who we share your information with;
• withdraw your consent, where we rely on it, and opt out of marketing emails at any time.

New Zealand residents. If you are in New Zealand, the Privacy Act 2020 and its Information Privacy Principles (IPPs) may also give you rights, in particular the right to access the personal information we hold about you and to ask us to correct it. Whether and how the Act applies depends on the circumstances of the collection and handling. We review every request we receive and respond in good faith, and we will not treat you unfairly for exercising your privacy rights.

If you are unhappy with how we have handled your personal information or a request, please contact us first so we can try to resolve it. If you are still not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

To submit a request, email contato@goldenvalleyc.com. We may ask for information to verify your identity before acting on it.

9. Privacy contact

Data protection officer (encarregado, under the LGPD): [PRIVACY OFFICER NAME].

For questions about this policy, privacy requests or any concern about how we handle your information, email contato@goldenvalleyc.com.

10. Cookies

Cookies are small files stored by your browser. We use:

• Strictly necessary cookies: they keep your session, chosen language, shopping cart and cookie preferences. Without them, the site doesn't work properly.
• Third-party content: embedded videos, podcasts and maps load only after you accept them in the cookie notice, and those services may set their own cookies.

We do not currently use third-party analytics or advertising tools. If that changes, we will update this policy and the cookie notice first.

You can change your choice in the cookie notice at any time and delete or block cookies in your browser settings. More details are in our Cookie Policy.

11. Children

Our services are intended for businesses and adult professionals. We do not knowingly collect personal information from children under 13, or from anyone under 18 without the authorisation required by law. If we learn that we have collected such information, we will delete it.

12. Changes to this policy

We may update this policy to reflect changes in our services, providers or applicable law. The date of the current version appears at the top of this page. We will announce material changes on the website and, when we have an active relationship with you, by email.