Informational translation. This is a courtesy translation of our Privacy Notice. The official version is the one in Portuguese; if there is any difference between the two, the Portuguese version prevails.
Your right to privacy is important to us at Rampfy. With your security in mind, and based on the principles of preserving integrity, transparency and responsibility, we have prepared this document to explain how we process your personal data.
Welcome to the Privacy and Personal Data Protection Notice! Its main purpose is to explain the procedures involving the personal data that you, as a user or reader, share with us while using our website and our services.
If you have any questions when reading this Privacy Notice, or wish to exercise your rights as the data subject of the personal data processed by our organization, please contact us through our Encarregado de Dados (Data Protection Officer), whose contact details are specified below and in the Data Protection Officer section.
Controller. Rampfy Tecnologia Ltda, registered with the CNPJ (Cadastro Nacional da Pessoa Jurídica, Brazil's National Registry of Legal Entities) under No. 31.251.533/0001-70, with its registered office at Rua Olavo Bilac, 164, Bairro Velha, Blumenau — SC, CEP 89.036-730.
Data Protection Officer (DPO). VTBS | Soluções em Compliance — Luciano Bridi — dpo.webdealer@vtbs.com.br.
Commercial contact. comercial@rampfy.com.
This document supplements our Internal Personal Data Protection Policy. The personal data processed by Rampfy as controller of this information is categorized as specified below.
1. Identification as data controller
We will be the controllers of the personal data to which we have access within the scope of this Policy.
As controllers of this data, and in compliance with the Lei Geral de Proteção de Dados Pessoais (LGPD, Brazil's General Personal Data Protection Law, Law No. 13,709/2018), we have developed this Policy to explain, objectively and transparently, how we carry out this processing, for what purposes your personal data is used and with whom it will be shared.
2. When we are the controller and when we are the processor
Rampfy is engaged by companies — stores, dealerships and sales teams — to organize their sales customer service. This creates two different roles, and the distinction matters for knowing to whom you should address a request:
| Situation | Who the controller is | Our role |
|---|---|---|
| You are a customer or prospect of a company that uses Rampfy, and you talk to it via WhatsApp, by telephone, form or ad | The company that serves you | Processor. We process the data according to its instructions |
| You are a user of the platform (salesperson, manager, administrator), visit our website, or are a supplier, employee or applicant for a job opening | Rampfy | Controller |
| Technical data of the integration: access tokens, account identifiers and platform usage records | Rampfy | Controller |
3. About the data collected
Due to the nature of our activities, we may process the most varied types of personal data, which are substantiated and organized by our organization and populated with all the substantial information on the respective data processing process.
The personal data collected is used to provide a better interaction with you, as it allows us to administer your user registration, manage purchases, comply with legal obligations, respond to any inquiries and, if you so wish, send our personalized communications.
On this website, our visitors' data is collected when you enter it or voluntarily agree to access, use and interact with the features or services made available online by Rampfy. We may collect your personal data when you, for any reason, carry out a direct transaction with us, whether through a direct relationship or through access to our website.
We process two distinct categories of personal data:
Ordinary personal data
Data: name, CPF (Cadastro de Pessoas Físicas, the Brazilian individual taxpayer number), address, city, state, CEP (postal code), email and telephone number.
Purpose: contact with and registration of suppliers and customers, payments, customer service, training, contact with and registration of employees, contact with and registration of applicants for job openings, newsletter.
Digital identification data
Data: cookies, IP address (and logical source port), records of interaction with Rampfy's brands and mobile device data, if authorized (geolocation, installed applications and device, connection and other necessary data).
Purpose:
- Management of registration on the platform — to become a user of the platform, it will be necessary to process data to identify you and allow access to the features, products and services, as well as to improve your experience and protect you.
- Development and performance of services — the data will be used to send information about products, conduct satisfaction surveys, manage sales, payments and logistics, ensure security against fraud, provide customer service and carry out marketing actions, such as sending newsletters with personalized offers.
4. Customer service via WhatsApp and artificial intelligence assistant
Rampfy offers the companies that use our CRM a sales assistant that serves their customers through the company's own WhatsApp Business, by means of the WhatsApp Business Platform, from Meta Platforms, Inc.
Data processed in customer service via WhatsApp
- Data of the customer served: WhatsApp telephone number and profile name, content of the messages exchanged (text, audio and media sent in the conversation) and information provided during the service, such as name, city and product or vehicle of interest.
- Company data received from Meta: identifiers of the WhatsApp Business account and of the telephone number, status and quality indicators of the number, message templates and access tokens necessary to operate the integration.
Purpose: to respond to messages from the company's customers, provide information about what is available, identify purchase interest and hand the service over to a salesperson, logging the conversation in the company's CRM. Message templates approved by Meta are used only to contact people who have requested contact (for example, through a form on a portal or website) and to inform them that a salesperson will continue the service.
Roles in the processing
With regard to the data of the customers served, the contracting company is the data controller and Rampfy acts as processor, processing the data according to the company's instructions and for the purposes above.
With regard to the data received from Meta to operate the integration with WhatsApp (such as access tokens and account identifiers), Rampfy Tecnologia Ltda is the controller.
Use of artificial intelligence
The assistant's responses are generated by language models provided by OpenAI, which is also used to transcribe the audio messages received in the conversation. OpenAI acts as processor and receives only the content necessary to generate each response.
The assistant does not make decisions that produce legal effects on the customer: the purchase interest identified is always forwarded to a human salesperson. The data subject may request the review of any processing carried out in an automated manner, pursuant to Article 20 of the LGPD, through our Data Protection Officer.
How to stop the service
The customer may ask, at any time and in the conversation itself, not to be contacted anymore. From that request onward, the assistant stops sending messages to that number.
Sharing of WhatsApp data
The data received through the WhatsApp Business Platform is shared only with the processors necessary for the provision of the service: Amazon Web Services (hosting and storage), OpenAI (generation of responses and transcription of audio) and Meta Platforms (delivery of the messages via WhatsApp).
This data is not sold, is not shared with advertising or marketing partners and is not used for advertising purposes.
When the company disconnects WhatsApp from Rampfy or terminates the contract, the access tokens cease to be used, and the data may be deleted upon request, subject to the legal retention periods.
5. Customer service by telephone
When the contracting company activates the integrated telephony, the calls made and received through its corporate telephony system are also logged in the CRM.
Data processed in the call
- Call metadata: originating and destination number, direction, date, time, duration and outcome of the call.
- Content of the call: the audio is transcribed and from it a summary is generated, analyzed to identify the customer's interest and to log in the pipeline what was discussed in the negotiation.
Purpose: to log the service in the company's CRM without depending on typing by the salesperson, identify purchase interest, support the conduct of the negotiation and allow the company to monitor the quality of its own customer service.
Corporate channel and responsibility for the notice
Capture occurs only on calls made and received through the telephony system (VOIP) of the contracting company itself — a corporate channel, operated by it. No personal line of a salesperson or of a customer is captured by Rampfy.
As controller of this channel, it is up to the contracting company to inform the participants, at the beginning of the call, that it is recorded, transcribed and analyzed, to obtain consent where applicable and to comply with the other rules of use of its own telephony. Rampfy provides the technical processing according to the company's instructions.
Limits of the analysis
The analysis is limited to matters related to the business. Content that does not concern the negotiation is discarded and is not logged in the CRM.
Processors and roles
The transcription and the generation of the summary use OpenAI services, under the same conditions described in the previous section. As with WhatsApp, the contracting company is the controller of the content of the call and Rampfy acts as processor.
6. About the processing of personal data of children and adolescents
According to the law, for the processing of data of minors (data subjects under 18 years of age), one of the parents or the legal guardian must give specific consent for us to be able to carry out certain processes that involve the processing of this type of personal data.
For this reason, we have developed our own procedures to obtain this authorization from one of the parents and/or the legal guardian, addressing the actions that will be taken, so that he or she understands and agrees with all the conditions specified in the dedicated form, in accordance with the legislation and this Privacy Notice.
The website and the services provided by Rampfy are not directed at data subjects under 18 (eighteen) years of age.
7. Legal grounds for processing
All the purposes for which the data is processed by our organization must comply with the conditions described in Law No. 13,709/2018 — Lei Geral de Proteção de Dados Pessoais (LGPD). As controller of this personal data, we use one of the following legal grounds established in the LGPD:
- Compliance with legal or regulatory obligations, notably those related to fiscal, tax and sector-specific obligations;
- Performance of contracts or preliminary procedures necessary for the provision of the services inherent to the activities carried out;
- Protection of the life and physical safety of the data subject or of third parties;
- Regular exercise of rights in judicial, administrative or arbitration proceedings;
- To meet the legitimate interests of the data controller;
- For credit protection;
- With the consent of the data subject or of his or her legal representative.
8. With whom we share personal data
The data collected may be shared with public and private entities for compliance with rules and contractual obligations, and with a view to the maintenance and management of our activities.
We seek to respect all operations that involve the sharing of personal data, carrying it out with recipients that commit to adopting technical and administrative measures capable of protecting the shared data.
We send personal and/or sensitive data of data subjects, depending on the situation, to:
- Providers of services related to customer support;
- Advertising and marketing partners;
- Logistics, transportation and delivery partners;
- Technology service providers, such as Amazon Web Services (hosting and storage), OpenAI (artificial intelligence) and Meta Platforms (WhatsApp Business Platform);
- Financial institutions;
- Internal sales campaign and groups of sales managers.
The data received through Meta's WhatsApp Business Platform, as well as the content and the summary of telephone calls, are not shared with advertising and marketing partners, as described in sections 4 and 5.
If you have any questions about the sharing of your personal data, we ask that you contact our Data Protection Officer, through the means of contact available.
9. Data storage
Due to our activities, the data we collect is stored in database infrastructure, mainly in Fairfax and Loudoun Counties, Northern Virginia, USA, and in cloud environments (cloud computing), operated by the company Amazon Web Services (AWS). The content of the WhatsApp customer service conversations and the audio of the telephone calls are also processed by OpenAI, in the United States, for the generation of the assistant's responses, the transcription of audio and the generation of the summary of the calls.
We may share this data abroad, taking care that the laws of the countries receiving this information have the same level of protection as Brazilian law. The data collected by means of physical files is kept on our premises.
10. Storage period
We process the data collected within a given period, mapped by our organization and updated by our Data Protection Officer, minimizing it so that the storage time is that which is necessary to achieve the purpose of the collection carried out.
The data processed in accordance with consent will be retained until the data subject issues a notice of revocation or until another period duly set out in the form itself has elapsed, unless retention is mandatory on the grounds of another basis for processing provided for in the LGPD.
After the fulfillment of the purposes for which the data was collected, we undertake to erase or anonymize the respective information processed.
If you have any questions about the retention period in our database, please contact us through our Data Protection Officer.
11. How we protect your data
To improve the security of the data processed by our organization, all control measures, systems, technologies and processes of the processing activities must comply with market standards to ensure the confidentiality, integrity and availability of the respective information.
As controllers, we implement technical, physical and organizational measures capable of protecting your personal data against possible loss, alteration or misuse.
We have the responsibility to comply with the legal requirements and to prove that we take the necessary measures and strive to protect the personal data collected and stored by our organization.
12. Data subject's access to the personal data collected
The personal data subject or his or her legal guardian may make a request to our Data Protection Officer by means of a simple and free-of-charge inquiry in order to understand how his or her information is processed.
As a security measure, we may require the requester to provide certain information to confirm his or her identity and ensure that the lawful data subject can exercise the rights set forth in the LGPD.
It is important to note that we bear no responsibility for the accuracy, up-to-dateness or truthfulness, or lack thereof, of the information that users provide to Rampfy. It is the visitor who is the data subject who must contact us through our channels to, when necessary, request the correction and updating of his or her data in our records.
To access this information, contact our Data Protection Officer through the available channels.
13. Rights of the data subject
Data subjects have basic rights provided for in the LGPD, which we list below for your understanding:
- Confirmation of the existence of processing of data of which they are the data subject;
- Which data is processed;
- Correction of incomplete, inaccurate or outdated data;
- Anonymization, blocking or erasure of unnecessary or excessive data, subject to the situations provided for by the legislation in force;
- Portability of personal data, in accordance with the regulation of the controller;
- Information on the public and private entities with which the controller shares the personal data;
- Information on the possibility of not providing consent for the processing of any data that requires this legal basis and on the consequences of the refusal;
- Revocation of consent for the processing of the data processed under such circumstance, subject to the conditions provided for in this document;
- Review of decisions made solely on the basis of automated processing, pursuant to Article 20 of the LGPD.
Requests must be made by the data subject or by the legal guardian, by contacting our Data Protection Officer, through the communication channels for this purpose.
14. How to request the deletion of your data
To request the deletion of your personal data, including the data from conversations held via WhatsApp or by telephone with the assistant of a company that uses Rampfy, send an email to our Data Protection Officer at dpo.webdealer@vtbs.com.br, stating:
- the telephone number used in the conversation or the registered email address;
- the name of the company with which you talked, if you know it.
We will respond within 15 (fifteen) days. When Rampfy acts as processor on behalf of a company, we will forward the request to the controller company and carry out the deletion according to its instruction, subject to the legal retention periods.
Companies that wish to disconnect WhatsApp from Rampfy may do so at any time through Meta's own WhatsApp Manager or by requesting it from our support.
15. Data Protection Officer
If you believe that the way your personal information is processed is incorrect in relation to the purpose for which we collect this data, or if you have other questions, comments and suggestions, we ask that you contact our Data Protection Officer for any clarifications and information:
VTBS | Soluções em Compliance
Name: Luciano Bridi
Email: dpo.webdealer@vtbs.com.br
Important: all communications made between our company and the data subject will be considered true between the parties, as legitimate valid instruments for the expression of their will.
16. Use of cookies on our websites and platforms
We use technologies called "cookies" to collect information and store your online preferences. Cookies are small pieces of information sent from a web server to a web browser, which allow the server to identify the browser as being unique on each page.
Cookies are also responsible for collecting information about your browsing habits in order to make our ads more relevant to you according to your interests. These cookies are not under our responsibility. Check how the privacy policy of your personal social networks works.
If you wish to delete the cookies already installed on your computer, seek help and support from your internet browser for instructions on how to locate the cookie file and storage directory. If you would like to know more about the use of cookies, we suggest reading our Cookie Policy.
17. About our Privacy Notice
This Privacy Notice aims to provide readers with clear and objective information.
However, if you have any questions or complaints about the processing of personal data carried out by our organization, we ask that you contact us to address your needs, by contacting our Data Protection Officer.
This Privacy Notice will continue to be reviewed in accordance with the dynamics of the existing processes, with news added and adjusted in accordance with legal requirements, and its objective is always the protection of the privacy of data subjects and the assurance of the lawful use of this information.
The present version of this Privacy and Data Protection Notice was published on October 21, 2024 and updated on October 13, 2026, with the change of the corporate name to Rampfy Tecnologia Ltda, the migration of the brand to Rampfy and the inclusion of customer service by telephone with transcription and summary of calls.