Privacy Policy
Last updated: July 31, 2026
In compliance with Brazil’s General Data Protection Law (LGPD — Law No. 13,709/2018)
Introduction
Organização Souza e Pagotto S/S Ltda, Brazilian taxpayer ID (CNPJ) 49.431.299/0001-28, registered with the Regional Accounting Council of São Paulo and operating under the OSP brand, respects your privacy.
This Policy explains what personal data we process, why, whom we share it with, and how you can exercise your rights.
It applies to our website, our service channels, our recruitment processes and the services we provide.
In short
If you only want the essentials, here they are:
- We collect what you tell us (forms, WhatsApp, phone calls, job applications) and how you browse our website.
- Once you provide your email, we start linking your browsing to your record, in order to serve you better. You may object — item 3.3.
- Phone calls with our commercial team may be recorded, with notice at the start; meetings, subject to notice to participants — item 3.1.
- We never sell your data. We share it with vendors working on our behalf and with the advertising platforms you authorise in the banner — item 5.
- If you applied for a job, item 8 explains in detail what we do and what we deliberately do not ask.
- You may request access, correction or deletion of your data at any time, free of charge, at privacidade@osp.com.br — item 9.
1. Who is responsible for your data
The controller of your data is Organização Souza e Pagotto S/S Ltda.
In recruitment processes and employment relationships, processing may be carried out jointly with the group company responsible for hiring, which will be identified to you during the process. In any case, the contact channel is the same.
2. Data Protection Officer (DPO)
Guilherme Pagotto — Chief Executive Officer
The DPO is the channel of communication between you, OSP and the Brazilian Data Protection Authority (ANPD). Use this address for any question, request or complaint about your data.
3. Data we collect
3.1. Data you provide
- Contact forms: name, email, phone, company and message
- Quote requests: registration details and tax information about your company
- Newsletter: email address and, optionally, name
- Downloading educational materials and using calculators: name, email, phone, company and area of interest. The material is delivered by email; receiving further content depends on you ticking the specific authorisation, and not ticking it does not prevent the download
- Job applications: name, contact details, CV, professional history, role of interest and public professional profile
- WhatsApp support: the content of messages exchanged through our official channels
- Phone calls with our commercial team may be recorded and transcribed, and their content summarised by an artificial intelligence tool to document the interaction and train the team. When a call is recorded, you are told at the start. If you would rather not be recorded, the call is ended and we continue by email or WhatsApp
- Meetings: when recorded or transcribed, subject to prior notice to participants
3.2. Data collected automatically
- Browsing: IP address, browser, operating system and pages visited
- Cookies: preferences, session and behavioural analysis
- Tracking pixels from advertising platforms
- Campaign click identifiers: gclid (Google), fbclid (Meta) and msclkid (Microsoft), captured from the URL for attribution
3.3. Once you identify yourself, this data is linked together
While you are only browsing, the data in item 3.2 is not linked to your name.
From the moment you provide your email — by downloading a material, using a calculator, subscribing to the newsletter or filling in a form — we begin associating that email with your browsing. In practice, this means we record, linked to you:
- which materials you downloaded
- which calculators and simulators you used and completed
- how long you stayed on the results page
- when you returned to the website
- which campaign or advertisement brought you here
Why. To understand your interest and provide relevant commercial support — rather than approaching everyone the same way. Legal basis: legitimate interest (art. 7, IX). We do not use this data for automated decisions about you.
How to stop it. You may object to this processing at any time at privacidade@osp.com.br, while continuing to use the website and the free tools. Declining non-essential cookies in the banner also prevents your browsing from being associated with your record.
3.4. When the data is not ours: we provide services to your company
Much of what we do is accounting, payroll and bookkeeping for other companies. In those cases we process data of partners, employees and contractors of our clients.
Here OSP is a processor, not a controller: the company that hired us decides what is done with that data. If you are an employee or partner of a client of ours and wish to exercise your rights, the request should be directed to them — but you may write to us anyway and we will support the response.
4. What we use it for, and on what legal basis
- Responding to your enquiry and preparing a quotePreliminary contractual procedures (art. 7, V)
- Providing the accounting services you contractedPerformance of a contract
- Documenting the interaction and training the team (call and meeting recordings)Legitimate interest
- Assessing your job applicationPreliminary contractual procedures (art. 7, V)
- Complying with accounting, tax and labour obligationsLegal obligation
- Understanding your interest to provide relevant commercial support (item 3.3)Legitimate interest
- Security, service improvement and active recruitmentLegitimate interest
- Newsletter, non-essential cookies and talent poolConsent
5. Whom we share it with
We rely on vendors who process data on our behalf and under our instructions:
- Cloud infrastructure — hosting, database and file storage
- Communication — email delivery and support via WhatsApp and telephone
- Artificial intelligence — generating the responses of our virtual assistants
- Advertising and measurement — Google (Ads and Analytics), Meta, LinkedIn and Microsoft Clarity. In these activities, those companies act as independent controllers, not as our vendors. Clarity also records browsing sessions (mouse movement, clicks and scrolling) for usability analysis; form fields are masked and their content is not captured.
- Electronic signature — name, email and Brazilian taxpayer ID (CPF) of signatories to contracts and documents
- Public authorities — where required by law
A named list of our vendors is available on request to the DPO ( privacidade@osp.com.br).
Our careers portal is operated by Sólides. When you apply, you are directed to osp.vagas.solides.com.br, an environment run by Sólides. According to Sólides’ own privacy policy, it also processes that data for its own purposes, including keeping your CV in a talent pool that other client companies can search. We recommend reading their policy before applying.
We never sell your personal data.
6. Cookies and advertising
Advertising, remarketing and measurement cookies and pixels are only activated with your consent, collected in the banner on your first visit, and can be reviewed at any time. Cookies strictly necessary for the website to function do not depend on consent.
To measure conversions, we may send those platforms your email and phone number in pseudonymised form (SHA-256 hash). Pseudonymisation reduces exposure, but such data remains personal data.
7. International transfers
Part of your data is processed outside Brazil, mainly in the United States, by cloud infrastructure, artificial intelligence and communication vendors.
We adopt the Standard Contractual Clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024) with our main cloud infrastructure and artificial intelligence vendors. You may ask the DPO for information about the safeguards applied to a specific processing activity.
8. If you applied for a job
What we collect
Name, contact details, CV, role of interest, professional profile and any information you share with us during the process — through our careers portal, the HR WhatsApp channel or by email.
Why we may process this data
- If you applied: the processing is necessary for preliminary procedures of an employment contract, at your own request (art. 7, V). We do not rely on your consent to assess your application.
- If we approached you: when we take the initiative, using professional information you have made public, the processing relies on our legitimate interest in recruiting (art. 7, IX). You may object at any time and, in that case, we delete your data.
- Talent pool: relies exclusively on your consent (art. 7, I).
What we use it for
Exclusively to run the selection process: screening, interviews and assessment. We do not use your application data for marketing.
What we do not ask
We do not ask about marital status, family situation, children, pregnancy or family planning, age, race or colour, origin, religion, sexual orientation, union or political affiliation, health or disability.
The only exception concerns disability: if you volunteer that information so that we can provide adjustments during the selection process or consider you for an affirmative-action role, we ask for your specific authorisation and use the data solely for that purpose.
Salary expectations
Providing it is optional. When provided, it does not form part of the comparative material generated by our systems, and your pay follows the range for the role and our job and salary structure.
Support and use of artificial intelligence
The first contact through the HR WhatsApp channel is handled by a virtual assistant, which identifies itself as such in its first message. It welcomes you, shares information about openings and records data. We also use artificial intelligence tools to organise and compare information from applications.
At any time you may: ask to speak to a person; request information about the criteria used; and request a review of any decision that relied on automated processing (art. 20 of the LGPD).
If you need a different channel or an adjustment due to a disability, let us know — we also assist by email and telephone.
What the virtual assistant can and cannot say
It does not make job offers, does not disclose salary or benefits, does not confirm approval, rejection or stage, and does not promise a reply, a deadline or an interview.
No message exchanged with the assistant constitutes an offer of employment or a guarantee of a position. Offers are made exclusively in writing, by a named member of the HR team.
To make this verifiable and to ensure consistent treatment between candidates, we keep the full conversation history.
Confidentiality of your application
Your application is confidential: access is restricted to our recruitment team and to the manager of the role you applied for. We do not disclose it to your current employer, even if they are our client.
We do not request confidential information from your current or former employer — client lists, pricing, methods, databases — and we ask that you do not share such information with us.
Talent pool (optional, opt-in)
Once the process ends, your CV only remains in the talent pool if you expressly authorise it. The authorisation is requested separately, has a single purpose — notifying you of future openings — and does not influence the assessment of your current application.
You may withdraw it at any time and free of charge, in which case we delete your CV promptly.
We do not add anyone under 18 to the talent pool — such authorisation requires the assistance of a legal guardian to be valid.
Why we ask whether you are of legal age at that point. Only then, and only for that reason: authorisation from someone under 18 requires the assistance of a legal guardian to be valid. It is a yes-or-no confirmation — we do not ask for your date of birth, we do not record your age, and it plays no part in assessing your application, which proceeds normally either way.
We do not keep in the talent pool any note about reasons for rejection, profile assessments or candidate rankings.
If you are under 18
Our openings are for adults — OSP does not run an apprenticeship or internship programme.
Even so, our channels are open and an adolescent may write to us. If that happens, we process the data in their best interest, limited to what is strictly necessary and in accessible language (art. 14 of the LGPD), and we do not add the CV to the talent pool — that authorisation requires the assistance of a legal guardian to be valid.
How long we keep it
We keep your application for as long as necessary for the selection process and, afterwards, for the period during which we may need to demonstrate the criteria applied — with restricted access and no use for any other purpose.
You may request deletion at any time, except for that minimum record, which the law allows us to retain for the defence of rights (arts. 16 and 7, VI).
9. Your rights
You may ask us, at any time and free of charge, for:
- confirmation that we process your data, and access to it
- correction of incomplete, inaccurate or outdated data
- anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law
- portability to another provider
- deletion of data processed on the basis of your consent, except in the retention cases of art. 16
- information about whom we share your data with
- information about the possibility of withholding consent and the consequences of refusal
- withdrawal of consent
- objection to processing based on legitimate interest
How to exercise them. Send your request to privacidade@osp.com.br.
We respond immediately, in simplified form, to confirmation and access requests, and within 15 days when you request a full statement. When we correct or delete data at your request, we notify the vendors with whom we shared it.
If you are not satisfied with our response, you may file a complaint with the ANPD (gov.br/anpd).
10. How long we keep your data
We keep your data for as long as necessary for the purposes of this Policy and to comply with our legal obligations. Clients’ accounting records and documents are kept for 5 years, as required by tax legislation. Once the purpose is fulfilled and the legal periods have elapsed, the data is deleted.
You may request deletion of your data at any time through the DPO’s contact details. We honour the request, except for what the law requires us to retain — in particular tax documents and the minimum record necessary for the defence of rights (arts. 16 and 7, VI), which is kept with restricted access and is not used for any other purpose.
11. Security and incidents
We adopt technical and administrative measures to protect your data: encryption in transit, role-based access control and periodic review of permissions.
If a security incident occurs that may cause relevant risk or harm to you, we will notify the ANPD and you within 3 business days of becoming aware of it, describing the nature of the data affected, the risks involved and the measures taken (art. 48 of the LGPD and Resolution CD/ANPD No. 15/2024).
12. Changes to this Policy
We may update this Policy from time to time. Significant changes will be flagged through a notice on the website and, where appropriate, by email.
Contact
OSP — Organização Souza e Pagotto S/S Ltda
Phone: +55 19 3272-5747
Personal data: privacidade@osp.com.br
This policy complies with Law No. 13,709/2018 (LGPD) and applies to all users of ospcontabilidade.com.br.