Privacy Policy
Version 2 — effective 16 August 2026. Replaces the previous version.
Mirow & Co. do Brasil Consultoria Ltda., registered under CNPJ 15.353.236/0001-89, at Rua Lauro Müller, 116, suite 1504, Rio de Janeiro, Brazil ("Mirow"), is the controller of personal data processed through https://mirow.com.br (the "Site").
This policy sets out specifically what the Site collects, why, on what legal basis, who it is shared with, how long it is kept and how you can object.
1. Data you give us
- Job applications (Careers page): name, e-mail, phone, education, experience and the CV you attach. Submissions go to Mirow infrastructure on Amazon Web Services, São Paulo region, in Brazil.
- Mirow CX Index: the answers you give the customer-experience maturity tool and any identifying details you choose to provide.
- Direct contact: whatever you write to us by e-mail, WhatsApp or LinkedIn from the links on the Site.
2. Data collected automatically as you browse
- Browsing data: IP address, browser and device type, language, pages viewed, time on page and traffic source.
- Visitor company identification. We use Leadfeeder (Dealfront) to match your IP address against corporate IP range databases and infer which company the visit came from. The service does not identify you as an individual — where it succeeds, it identifies the organisation. The IP is not anonymised, because it is precisely the data that inference needs. The service also receives your browser's Google Analytics identifier.
- Audience measurement. We use Google Analytics 4 with Consent Mode v2. The advertising axis is switched off: Mirow runs no ads and no Site data feeds ad personalisation.
3. Purposes and legal bases
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Assessing job applications | Section 1 | Pre-contractual procedures — art. 7, V |
| Replying to your enquiry | Section 1 | Pre-contractual procedures — art. 7, V |
| Providing the Mirow CX Index | Answers and identification | Performance of a requested service — art. 7, V |
| Measuring audience and improving the Site | Section 2 | Legitimate interests — art. 7, IX |
| Identifying the visitor's company for business purposes | IP and browsing | Legitimate interests — art. 7, IX |
| Complying with legal obligations or orders | As required | Art. 7, II |
For the two purposes based on legitimate interests, you may object at any time, without giving reasons, using the button in section 7.
4. Who we share with, and in which country
| Processor | Purpose | Country |
|---|---|---|
| GitHub, Inc. (Microsoft) | Site hosting | United States |
| Google LLC | Audience measurement (GA4) | United States |
| Dealfront Group GmbH | Visitor company identification | European Union |
| Amazon Web Services | Receiving applications and CVs | Brazil |
International transfers follow art. 33 of the LGPD and the standard contractual clauses of ANPD Resolution 19/2024.
Mirow does not sell personal data and does not share it for third-party advertising.
5. Cookies
| Cookie | Source | Purpose | Lifetime |
|---|---|---|---|
_ga, _ga_* | Google Analytics | Distinguish visitors and sessions | up to 2 years |
lfClientId | Leadfeeder | Recognise the same browser across pages | up to 2 years |
pll_language | Site | Remember your language choice | 1 year |
You can block cookies in your browser settings. Blocking does not stop you reading the Site, but it may make it forget your language choice.
6. How long we keep it
| Data | Retention |
|---|---|
| CVs and applications | 6 months after the selection process ends, unless you allow us to keep them for future openings |
| Google Analytics browsing data | 14 months for individual-level data. Aggregated reports, which identify no one, remain for as long as the property exists |
| Leadfeeder data | 7 days (limit of the plan in use) |
| Messages you send us | For as long as the relationship lasts and thereafter for applicable legal periods |
7. How to object to tracking
Company identification (Leadfeeder). Click the button below. The choice is stored in this browser and takes effect immediately across the whole Site.
Global Privacy Control. If your browser or an extension sends the GPC signal, we honour it automatically and the identification service is not loaded — you need do nothing.
Audience measurement. You can install the Google Analytics opt-out add-on or block cookies in your browser.
8. Your rights
Under art. 18 of the LGPD you may request: confirmation that we process your data; access to it; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary or excessive data or data processed unlawfully; portability; information on who we share with; information on the consequences of refusing consent; withdrawal of consent; and objection to processing based on legitimate interests.
To exercise any of these, write to contato@mirow.com.br.
Data Protection Officer (art. 41 LGPD): reachable at the same address, contato@mirow.com.br.
9. Security
We apply technical and administrative measures to protect the data, and access is restricted to authorised people who need it. No system is infallible; in the event of a security incident with relevant risk we will notify you and the Brazilian Data Protection Authority, under art. 48 of the LGPD.
10. Links to other sites
The Site links to third-party pages — press outlets, social networks and partners. This policy does not apply to them.
11. Changes to this policy
This policy may be updated. The current version and its effective date always appear at the top of this page.
12. Contact
contato@mirow.com.br · Rua Lauro Müller, 116, suite 1504, Rio de Janeiro, Brazil.