Who controls the data
Controller: KOS Produtora e Agência LTDA, trading as KOS Produtora, Rua Pires da Mota, 565, Aclimação, São Paulo — SP, 01529-001, Brasil. Privacy requests: [email protected] or +55 11 93621-0698.
The marketing site is https://www.kosprodutora.com. We do not name a public DPO in this document; data-subject requests are handled by the commercial desk at the same email.
Data we collect
Contact form: first name, last name, phone, email, company and optional message. We use this only to answer the brief, quote and, if hired, produce the work. Submissions go through Resend email and may be copied into our internal CRM (KOS Financeiro / Vision) for the sales team.
WhatsApp: if you use the site shortcut, we log the click (including a session identifier) so we know the lead came from this page, then redirect to the commercial wa.me. The chat itself happens on WhatsApp under Meta’s terms.
Campaign attribution: the browser may store origin parameters (UTM, gclid and equivalents) and the landing URL in localStorage for up to 90 days, so a quote can be tied to the campaign that brought the visitor. We do not use this to sell third-party ads.
Form protection: Google reCAPTCHA v3 may score the submission (IP address, on-page behaviour) under Google’s policy. Analytics: if Google Tag Manager is enabled, Google may process page-usage data under the configured GTM/GA rules.
Legal basis, retention and sharing
We process contact data to take pre-contractual steps at your request (a quote) and, later, to perform the production contract. Technical logs and security rest on legitimate interest in keeping the site intact. We do not sell personal data.
Processors that may see data on our behalf: Resend (transactional email), Google (reCAPTCHA and, if enabled, Tag Manager), Meta (WhatsApp) and our internal leads stack. They act as processors or independent controllers depending on the product.
We keep briefs as long as needed to reply, produce and meet legal and tax duties. You may request access, correction, anonymisation, portability, information about sharing, and deletion of data we no longer need to keep, via the email above. You may also complain to Brazil’s ANPD.
Cookies and local storage: besides attribution, the site may use cookies or browser storage strictly tied to the URL locale, form session and measurement tags when GTM is configured. Locale is not chosen by cookie — the URL is the source of truth.