Purpose and scope
This Cookie Policy explains how PM RUN uses cookies and similar technologies across its institutional website, blog, landing pages, forms, and other digital pages under its responsibility. Its purpose is to clearly inform which technologies may be used, which data may be processed, for what purposes, for how long, and how the visitor can accept, reject, or change their preferences.
- Controller: ITSS INFORMAÇÃO, TECNOLOGIA E SERVIÇOS LTDA. (sole owner of PM RUN);
- Company registry (CNPJ): 09.426.633/0003-00;
- Address: Avenida Pará, No. 57, Quadra 59A, Lote P006, Sala 01, Setor Oeste, Goiânia/GO, Brazil, ZIP 76.385-196;
- Version / update: 1.0 / July 14, 2026;
- Privacy channel: elisa.zafalao@pmrun.com.br.
This Policy does not apply to data processing carried out inside the PM RUN platform and application, which has its own Privacy Policy.
What cookies and similar technologies are
Cookies are small files stored in the visitor's browser. Similar technologies include pixels, tags, campaign identifiers, local storage (localStorage/sessionStorage), URL parameters, and event records processed in the browser or on a server. These technologies can enable the site to work, store preferences, measure audience, attribute campaigns, prevent fraud, and support the commercial relationship.
Not every processing described here relies on a cookie file. Server-side tracking tools may process events and identifiers on the server. Data submitted through forms is not a "cookie" either, although it may be associated with browsing history after a conversion, depending on configuration and the visitor's choice.
Categories used
| Category | Purpose | Activation | Predominant legal basis |
|---|---|---|---|
| Essential | Security, navigation, site operation, and recording cookie preferences. | Always active. | Legitimate interest, compliance with obligations, and provision of the digital service. |
| Functional | Enable requested features, such as chat, preferences, and forms. | Only when required by the feature or upon consent, as applicable. | Consent or execution of a requested feature. |
| Experience and performance (first-party analytics) | Measure audience, traffic source, pages visited, sessions, and performance, on an aggregated basis and with no advertising purpose. | Active by default; can be disabled at any time under "Cookie settings". | Legitimate interest (first-party audience measurement, with anonymized IP). |
| Marketing and advertising | Measure campaigns, attribute conversions, build audiences, and personalize the commercial relationship. | Only after consent. | Consent. |
Google's experience-measurement cookie (Google Analytics 4, _ga / _ga_<ID>) is used solely as a first-party audience and performance metric — with anonymized IP and ad-identifier redaction (Google Consent Mode v2) — and is not used for advertising. It is therefore treated as an experience cookie under the legitimate-interest basis, and the visitor may disable it at any time under "Cookie settings". Marketing and advertising cookies, on the other hand, are only activated after consent and remain blocked in the tag manager (Google Tag Manager) until the visitor manifests a choice.
Cookie and technology inventory
The inventory below reflects the tools and configurations reported for the PM RUN website. Names and durations may vary depending on vendor updates, browser, domain, campaign, or technical configuration. PM RUN will review this inventory whenever a relevant change occurs.
| Category | Technology / identifier | Vendor | Main purpose | Typical duration | Consent |
|---|---|---|---|---|---|
| Essential | pmrun_consent_v1 (localStorage) | PM RUN | Record, in the browser, the accepted or rejected categories. | Until the browser data is cleared or the consent version changes. | No |
| Essential | __hs_opt_out / __hs_cookie_cat_pref / security cookies, when applicable | HubSpot / infrastructure providers | Record privacy preferences and protect the service against abuse or malicious automation. | Generally session, 30 minutes, 7 days, or 6 months, depending on the identifier. | No, when strictly necessary |
| Analytics | hubspotutk / __hstc / __hssc / __hssrc | HubSpot | Distinguish visitors, count sessions, and associate browsing with the contact after form submission. | 6 months / 6 months / 30 minutes / session. | Yes |
| Functional | messagesUtk, if chat is active | HubSpot | Recognize the chat user and retrieve the conversation history. | Up to 6 months. | Yes, subject to chat configuration |
| Analytics / Marketing | rdtrk / __trf.src / _rdlps_pp and equivalent identifiers | RD Station | Lead tracking, attribution, browsing history, segmentation, and marketing automation. | Generally 1 year / 2 years / 6 months, depending on the identifier. | Yes |
| Experience | _ga / _ga_<ID> | Google Analytics 4 | Distinguish visitors, keep session state, and produce usage statistics on an aggregated basis. | Up to 2 years, subject to configuration and browser limits. | No — legitimate interest (can be disabled under "Cookie settings") |
| Marketing | _gcl_* / gclid / gbraid / wbraid | Google Ads | Attribute clicks and conversions and measure campaign performance. | _gcl_* cookies: generally 90 days. | Yes |
| Marketing | _fbp / _fbc / fbclid / event_id | Meta | Measure campaigns, deduplicate events between browser and server, attribute conversions, and build audiences. | Generally up to 90 days for campaign identifiers. | Yes |
| Marketing | LinkedIn Insight Tag and related identifiers, if active | Measure campaigns, conversions, and professional audiences. | According to vendor configuration and policy. | Yes |
Data that may be processed
Depending on the technology and the visitor's choices, the following may be processed: technical and browsing information (IP address, date and time, page URLs and titles, referrer, language, screen resolution, browser, operating system, device type, sessions, pageviews, scrolls, clicks, downloads, and interaction events); identifiers and campaign data (UTMs, gclid, gbraid, wbraid, fbclid, _fbp, _fbc, internal visitor, lead, event, and conversion IDs); data provided by the visitor in forms; recruitment data when the visitor uses the "Work With Us" area; and conversion and relationship data (form submitted, commercial contact, WhatsApp click, download, scheduling, funnel stage, campaign source, score, tags, and communication preferences).
Server-side tracking and hashed data
PM RUN may use server-side integrations with Meta, Google, and other platforms to measure and attribute conversions. In such cases, events such as visit, form submission, contact, download, or scheduling may be processed by our own server or by contracted infrastructure.
When configured, data provided by the visitor, such as email or phone, may be transformed by a cryptographic hash function before being sent to the vendor, for matching and measurement. Hashing reduces exposure but does not necessarily remove the data's nature as personal data where association is possible; such data therefore remains subject to the LGPD, to security controls, and to the data subject's choice.
Forms and association of browsing history
The visitor may browse pseudonymously until they choose to fill out a form. After the conversion, tools such as HubSpot or RD Station may associate with the contact the browsing history captured in the same browser, provided the optional cookies were accepted and according to the technical configuration. Submitting a form does not automatically authorize promotional communications: when required, the communication preference is collected in a dedicated field, and the data subject may unsubscribe at any time.
Sharing and international transfer
Data may be shared with technology, hosting, analytics, advertising, CRM, and marketing-automation vendors, strictly for the purposes described in this Policy and according to the applicable contracts and configurations. The vendors that may take part in the processing include HubSpot, RD Station, Google, Meta, and LinkedIn.
Some vendors may process data in other countries. In such cases, PM RUN will adopt measures compatible with the LGPD, including analysis of the purpose, minimization, access controls, contractual obligations, and mechanisms applicable to international data transfers.
How consent is obtained
When you access the site, a banner is shown allowing you, with equivalent prominence, to: (i) Accept all cookies; (ii) Reject optional ones; or (iii) Customize the available categories separately. Marketing and advertising cookies are not activated before the visitor's valid manifestation. Rejecting optional cookies does not prevent access to the main content of the site, although some personalization, chat, measurement, or advertising features may be unavailable or work in a limited way.
How to change or withdraw your preferences
You may change or withdraw your preferences at any time through the permanent "Cookie settings" link available in the site footer, which reopens the preferences panel. You may also delete cookies and site data directly in your browser settings. Withdrawal does not affect the lawfulness of processing carried out before the change.
Your choice is recorded in your browser (key pmrun_consent_v1 in localStorage, with the policy version, date, and chosen categories) and is also kept in an internal PM RUN record — the server-side consent receipt, containing the version, date, categories, and the manifestation in pseudonymized form — for evidentiary purposes under the LGPD.
Security, minimization, and retention
PM RUN adopts technical and organizational measures to reduce the risks of unauthorized access, misuse, alteration, loss, or disclosure. Data is processed according to the purpose, the necessity, the applicable retention period, and the vendors' configurations.
PM RUN will seek to limit collection to what is necessary, avoid sending unused fields, review events and tags, restrict access to marketing platforms, and keep the cookie inventory up to date. Form and CRM data will observe the applicable retention periods, legal obligations, and commercial-relationship needs.
Data subject rights and DPO channel
Under the LGPD, the data subject may request confirmation of processing, access, correction, information on data sharing, objection, withdrawal of consent, deletion of data processed based on consent, and other applicable rights. Requests and questions about privacy and cookies may be sent to PM RUN's Data Protection Officer (DPO), Elisa Miranda Zafalão, through the privacy channel: elisa.zafalao@pmrun.com.br. Phone: (62) 3998-3452.
Policy updates
This Policy may be updated to reflect legal, regulatory, technological, contractual, or site-configuration changes. The current version and the date of the last update will be kept on this page. When there is a material change that requires a new manifestation from the visitor, the preferences banner will be shown again.
Applicable law
This Policy is governed by Brazilian law, in particular Law No. 13,709/2018 (LGPD), Law No. 12,965/2014 (Brazilian Civil Rights Framework for the Internet), and the guidance of the Brazilian Data Protection Authority (ANPD) applicable to the use of cookies and similar technologies. Any dispute shall be submitted to the courts of Goiânia/GO, Brazil, to the extent permitted by applicable law.
Transparency references
- Guidance "Cookies and Personal Data Protection" — ANPD;
- Brazilian General Data Protection Law (LGPD) — Law No. 13,709/2018;
- Brazilian Civil Rights Framework for the Internet — Law No. 12,965/2014.