Effective date: 10 September 2026  |  This version replaces the policy of January 2018.

1. Who we are

This website is operated by two companies under common ownership, which act as joint controllers of the personal data described in this policy.

Aureon Group BV
Nachtegaallaan 38 bus 4, 1731 Zellik (Asse), Belgium
Enterprise number 1019.894.622
VAT BE 1019.894.622

Hertz Films e Marketing Ltda
Rua Guaicuí 26, Sala 1002, Módulo 27, Coração de Jesus, Belo Horizonte, MG, 30380-380, Brazil
CNPJ 37.422.871/0001-03

Together we operate under the brand Hertz Agency at hertz.digital.

How responsibility is divided between us

• Aureon Group BV is responsible for personal data of clients and visitors located in the European Economic Area, the United Kingdom and Switzerland, and is our point of contact for any matter arising under European data protection law.
• Hertz Films e Marketing Ltda is responsible for personal data of clients and visitors located in Brazil and in the rest of the world.

Because both companies use the same website, the same contact form and the same CRM, they determine jointly the purposes and the means of the processing described in this policy. This paragraph is the essence of our joint controller arrangement under Article 26 GDPR. Whichever company your data relates to, you may exercise every right described in section 10 against either of them, through the single address below, and we will handle your request internally.

Contact for all data protection matters: mkt@hertz.digital.

2. Scope of this policy

This policy covers:

• hertz.digital, our public website;
• app.hertz.digital, the client area hosted on our CRM.

Cookies and similar technologies are covered by our Cookie Policy, further down this page.

This policy does not cover the personal data that we process on behalf of our clients when we manage their advertising accounts, analytics properties or CRM. In that work we act as a processor, under the instructions and the privacy policy of the client concerned.

3. Which law applies

Personal data of people located in the European Economic Area, the United Kingdom or Switzerland is processed by Aureon Group BV under the General Data Protection Regulation (GDPR) and the equivalent national law.

Personal data of people located in Brazil is processed by Hertz Films e Marketing Ltda under the Brazilian General Data Protection Law (LGPD, Law 13.709/2018).

Where the two frameworks differ, we apply the stricter requirement to everyone.

4. Personal data we collect

4.1 Data you give us directly

Contact form on hertz.digital. Name, email address, telephone number and the content of your message, plus anything else you choose to type into it.

• Why: to answer you, prepare a proposal and, if you decide to work with us, start a commercial relationship.
• Legal basis: steps taken at your request prior to entering into a contract (GDPR art. 6(1)(b); LGPD art. 7, V).

Client area on app.hertz.digital. Name, professional email address, telephone number, company name, login credentials, and the records generated by the work we do for you: campaign data, files, messages, appointments and notes.

• Why: to deliver the services you contracted and to keep a record of them.
• Legal basis: performance of a contract (GDPR art. 6(1)(b); LGPD art. 7, V), and compliance with legal, tax and accounting obligations for the records we are required to keep (GDPR art. 6(1)(c); LGPD art. 7, II).

4.2 Data collected automatically

IP address and the approximate region derived from it, browser and device type, operating system, pages viewed, time spent on each page, the source that referred you, and the identifiers stored by the cookies described in our Cookie Policy below.

• Why: to keep the site working and secure, to measure audience, and to measure the results of our own advertising.
• Legal basis: your consent for analytics and advertising cookies (GDPR art. 6(1)(a); LGPD art. 7, I); our legitimate interest in a functioning, secure website for strictly necessary cookies (GDPR art. 6(1)(f); LGPD art. 7, IX).

4.3 Data we do not collect

We do not knowingly collect special category or sensitive personal data through this website: racial or ethnic origin, religious or philosophical belief, political opinion, trade union membership, data concerning health or sex life, or genetic or biometric data. Please do not include such information in the contact form.

We do not collect payment card details on this website.

5. Who we share personal data with

We do not sell personal data and we do not disclose it publicly. We share it only in the following situations:

• Between the two companies named in section 1, as joint controllers, to the extent necessary to run the website and serve you.
• Service providers acting on our instructions: website hosting, email, our CRM (which powers app.hertz.digital), and analytics and advertising platforms. They may process the data only for the purposes we define.
• Public authorities, when required by law, court order, or to establish or defend a legal claim.
• A successor entity, in the event of a merger, acquisition or transfer of business, in which case this policy continues to apply.

Our principal processors are Google (Analytics, Ads and Tag Manager), Meta Platforms, our hosting provider and our CRM provider.

6. Google API Services User Data

We operate an internal application, Hertz Agency Data Connector, which reads advertising and analytics data from the Google Ads, Google Analytics and Google Tag Manager accounts to which our clients have granted us access.

Our use and transfer of information received from Google APIs adheres to the <a href=”https://developers.google.com/terms/api-services-user-data-policy” rel=”nofollow”>Google API Services User Data Policy</a>, including the Limited Use requirements.

Data retrieved through those APIs is used solely to produce marketing performance analysis for the account owner it belongs to. It is not sold, transferred to third parties, used for advertising, or used to build any profile or derived product. Access is read only: the application cannot create, edit or delete campaigns, budgets, ads, audiences, conversion actions, tags, triggers or container versions. Credentials are stored locally on the workstation running the application and are never shared or embedded in distributed software.

7. International transfers

Personal data collected in the European Economic Area may be transferred to Brazil, where Hertz Films e Marketing Ltda is established, and to service providers established in the United States. Brazil is not covered by an adequacy decision of the European Commission, so these transfers are governed by the European Commission’s Standard Contractual Clauses, supplemented where necessary by additional technical and organisational measures. Transfers to providers in the United States rely on an adequacy decision or on Standard Contractual Clauses, depending on the provider.

Where personal data leaves Brazil, we rely on the transfer safeguards set out in LGPD arts. 33 to 36.

You may request a copy of the safeguards applicable to a given transfer by writing to the address in section 1.

8. How long we keep personal data

• Contact form submissions: up to 24 months from your last contact, unless a commercial relationship begins.
• Client records: for the duration of the contract and for 5 years afterwards, to comply with civil, tax and accounting obligations. Accounting records subject to a longer statutory period in Belgium are kept for 7 years.
• Analytics data: up to 14 months.
• Cookie consent record: up to 12 months, after which you are asked again.

When a retention period ends, data is deleted or irreversibly anonymised.

9. Security

We protect personal data with technical and organisational measures proportionate to the risk: encrypted connections (HTTPS), access restricted to the people who need it, individual credentials with multi-factor authentication where available, and periodic review of who has access to what. No system is completely secure, and we do not claim otherwise. If a breach occurs that is likely to create a risk to you, we will notify you and the competent authority as required by law.

10. Your rights

You may ask us to:

• confirm whether we process your personal data, and obtain access to it;
• correct data that is incomplete, inaccurate or out of date;
• delete data, where we have no lawful ground to keep it;
• restrict processing, or have data anonymised or blocked where it is unnecessary, excessive or processed unlawfully;
• receive your data in a portable, machine-readable format, or have it transferred to another provider;
• withdraw consent at any time, where consent is the basis we rely on;
• object to processing based on legitimate interest;
• be informed about the public and private entities with which we have shared your data;
• be informed of the consequences of refusing to provide consent;
• request human review of a decision taken solely on the basis of automated processing.

To exercise any of these, write to mkt@hertz.digital. We may need to confirm your identity before acting. We answer within one month under the GDPR and within 15 days under the LGPD, and we will tell you if we need longer.

11. Children

This website is not directed at children. We do not knowingly collect personal data from anyone under 16 in the European Economic Area or under 18 in Brazil. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Links to other websites

Our site links to websites we do not operate. We have no control over their content or their practices and we cannot be responsible for their privacy policies. Read them before providing personal data.

13. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The current version is always the one published on this page, with the date shown at the top. If a change is significant, we will make it visible on the site before it takes effect.

14. Complaints

If you are not satisfied with our response, you may lodge a complaint with a supervisory authority.

• Belgium and the European Economic Area: the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, <a href=”https://www.autoriteprotectiondonnees.be/” rel=”nofollow”>autoriteprotectiondonnees.be</a>, or the supervisory authority of the country where you live or work.
• Switzerland: the Federal Data Protection and Information Commissioner, <a href=”https://www.edoeb.admin.ch/” rel=”nofollow”>edoeb.admin.ch</a>.
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD), <a href=”https://www.gov.br/anpd/” rel=”nofollow”>gov.br/anpd</a>.

15. Contact

For any question about this policy or about how we handle personal data, write to mkt@hertz.digital, or to either company at the postal address given in section 1.

Hertz Agency Cookie Policy

Effective date: 10 September 2026

What cookies are

Cookies are small files that a website stores in your browser. They let the site remember things between page loads: whether you are logged in, which language you chose, or whether you have already answered the cookie banner. Some cookies are set by us, others by the services we use, such as Google and Meta.

How we ask for your consent

This site uses a consent banner with prior blocking. Cookies that are not strictly necessary, and the scripts that set them, do not run until you accept them. If you close the banner without choosing, or make no choice at all, only strictly necessary cookies are used.

Your choice is recorded so we do not ask again on every page. You can change or withdraw it at any time through the cookie settings link available on the site. Withdrawing consent does not affect the lawfulness of what was done before you withdrew it, and it does not prevent you from using the site.

The categories we use

Strictly necessary. Session management, security, and remembering your cookie choice. No consent required. They last from the browsing session up to 12 months.

Analytics. Google Analytics 4, to understand in aggregate how the site is used and which pages are worth improving. Consent required. They last up to 14 months.

Advertising. Google Ads and Meta tags, to measure the results of our campaigns and to show our ads to people who have visited the site. Consent required. They last up to 13 months.

Preferences. Remembering choices such as language. Consent required. They last up to 12 months.

Third party cookies

When you accept analytics or advertising cookies, the following providers may set cookies in your browser and receive data about your visit:

• Google (Analytics 4, Google Ads, Tag Manager). <a href=”https://policies.google.com/privacy” rel=”nofollow”>Google privacy policy</a>.
• Meta Platforms (Facebook and Instagram advertising tags). <a href=”https://www.facebook.com/privacy/policy/” rel=”nofollow”>Meta privacy policy</a>.

We have no control over the cookies these providers set once you have consented. Their own policies, linked above, describe what they do with the data.

Controlling cookies in your browser

Independently of our banner, every browser lets you block or delete cookies. Look for Privacy or Security in your browser settings, or open its help pages. Blocking all cookies will affect this and most other websites: some features stop working. Deleting cookies also deletes the record of your choice here, so the banner will appear again on your next visit.

Changes to this Cookie Policy

If we add or remove a service that sets cookies, we update this page and, where the change requires it, ask for your consent again.

Questions

Write to mkt@hertz.digital. The Privacy Policy above explains who we are and how to exercise your rights.