Percio Castelo.
PT Resume
← Back to Home

Privacy & Cookie Policy

Transparency, security, and our commitment to protecting personal data in compliance with LGPD and GDPR

Last Updated: September 19, 2026

Data Controller: Percio Castelo · sr00t3d · Contact: [email protected]

Regulatory Framework: Brazilian General Data Protection Law (LGPD - Law No. 13,709/2018), Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014), and EU General Data Protection Regulation (GDPR - Regulation EU 2016/679)

1. Commitment to Privacy

Data privacy, confidentiality, and technical information security are fundamental values across my professional work. This Privacy Policy clearly outlines how personal data is collected, processed, protected, and retained when you browse perciocastelo.com.br and its integrated technical utilities.

All data processing activities strictly adhere to the principles of purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, and non-discrimination, as mandated by Article 6 of the Brazilian General Data Protection Law (LGPD) and the European GDPR.

2. Data Controller Information

For the purposes of data protection regulations, the Data Controller responsible for decisions concerning your personal data is:

  • Individual / Controller: Percio Castelo (sr00t3d)
  • Profession: Linux Infrastructure Consultant, SysAdmin & DevSecOps Engineer
  • Official Privacy & DPO Contact: [email protected]
  • Location: Federative Republic of Brazil

3. Data Collection, Purpose & Lawful Bases

I operate under a strict data minimization philosophy: only data strictly necessary for secure website functionality and user-requested interactions is gathered. The breakdown below outlines our processing activities:

Feature / Module Data Collected Specific Purpose Lawful Basis (LGPD / GDPR)
Contact Form (sendmail.php) Name, email address, optional phone number, optional website URL, and your message description. Responding to user inquiries, technical questions, project scoping, and preliminary consulting discussions. Steps prior to entering into a contract at the request of the data subject (LGPD Art. 7, V / GDPR Art. 6(1)(b)) and Consent (LGPD Art. 7, I).
Blog Comments (blog-comments.php) Display name, optional email address, and comment message. Community engagement and technical Q&A. Email is used to compute an irreversible MD5 hash for fetching public Gravatar profile avatars, never displayed publicly on page. Consent upon form submission (LGPD Art. 7, I / GDPR Art. 6(1)(a)) and Legitimate interest (LGPD Art. 7, IX).
Donations & Sponsorship (doar.html / Stripe) Contribution amount, currency, and checkout metadata. Processing voluntary donations. The website does not process or store credit card numbers: checkout is handled directly by Stripe's certified PCI-DSS Level 1 infrastructure. IP addresses are temporarily hashed (SHA-256) locally to enforce brute-force protection (10 requests/min rate limit, discarded after 10 minutes). Contract fulfillment and Legitimate interest in platform fraud prevention (LGPD Art. 7, IX / GDPR Art. 6(1)(f)).
Bot Protection (Cloudflare Turnstile) Interaction telemetry, HTTP headers, and non-intrusive cryptographic challenges. Preventing automated spam abuse, DDoS attacks, and form tampering without invasive trackers. Legitimate interest in maintaining network integrity and platform availability (LGPD Art. 7, IX).
Site Analytics (Google Analytics / tracking.js) Pseudonymous device identifiers, pageviews, session duration, browser agent, and navigation events (data-track). Understanding which cybersecurity tutorials provide the most value, auditing navigation bottlenecks, and optimizing platform performance. IP addresses are automatically anonymized. Legitimate interest in enhancing educational resources and technical content (LGPD Art. 7, IX).

4. Cookies & Local Storage (localStorage) Policy

Cookies are minimal text markers stored on your device to remember preferences. We strictly minimize client-side storage:

  • Essential Session Cookies: A transient session cookie (PHPSESSID) is initiated only when interacting with the contact form modal to ensure request authenticity and mitigate CSRF attacks. It expires when closing the session.
  • Performance Analytics (Google Analytics 4): Statistical cookies (_ga, _ga_*) used to distinguish unique sessions pseudonymously. Technical opposition (Art. 18, LGPD): in addition to the e-mail channel, data collection can be disabled at any time via the Accessibility Hub (header icon or Alt + A shortcut), using the “Site Metrics” switch. When switched off, the pc_metrics_consent=denied signal is stored in first-party localStorage, Google Analytics loading is blocked (ga-disable), the _ga/_ga_* cookies and the local event queue are deleted, and the opt-out persists across sessions until re-enabled.
  • HTML5 Local Storage (localStorage):
    • site_lang_pref_v1: Stores language preference (pt-BR or en) so you do not have to reset language on each page visit.
    • sr00t3d_tracking_events: Strictly local circular buffer (capped at 300 entries) computing engagement counters without transmitting raw clickstreams to external databases.

Managing Cookies: You can configure your browser at any time to reject cookies or notify you before accepting them. Refer to your browser's privacy settings (Google Chrome, Mozilla Firefox, Microsoft Edge, or Apple Safari). Disabling essential session cookies may prevent sending inquiries via the contact modal.

5. Third-Party Data Sharing

I do not sell, rent, monetize, or disclose your personal data to third-party data brokers or targeted ad networks.

Data is shared exclusively with essential infrastructure providers required for secure site operations under strict data protection agreements:

  • Cloudflare, Inc.: Global CDN edge routing, DDoS shielding, and automated bot prevention (Turnstile);
  • Stripe, Inc.: PCI-compliant payment gateway processing voluntary community sponsorship;
  • Zoho Corporation: Encrypted enterprise transactional email delivery (TLS over SMTP);
  • Automattic Inc. (Gravatar): Displaying avatars for blog comments via non-reversible MD5 email hashes;
  • Google LLC: Aggregated, anonymized traffic diagnostics through Google Analytics;
  • Legal & Judicial Authorities: Only when strictly compelled by a valid court order under applicable law (Brazilian Civil Rights Framework for the Internet, Law No. 12,965/2014, Art. 15).

6. International Data Transfers

Because selected technical service providers (including Cloudflare, Stripe, and Google) maintain globally distributed networks, data may be processed on servers located in the United States or the European Union.

All international processing complies with Article 33 of the LGPD and Chapter V of the GDPR, utilizing Standard Contractual Clauses (SCCs) and robust security certifications to ensure adequate levels of protection.

7. Technical Information Security & Hardening

As a practitioner in DevSecOps and defensive systems engineering, I apply robust defensive controls to safeguard personal data against tampering, accidental loss, unauthorized disclosure, or cyber threats:

  • Encryption in Transit: End-to-end TLS 1.3 encryption across all traffic with strict HTTP Strict Transport Security (HSTS) headers;
  • Strict Content Security Policy (CSP): Defense-in-depth directives enforcing script white-listing to neutralize Cross-Site Scripting (XSS) and unauthorized iframe embedding;
  • Defensive HTTP Headers: Active protections on all responses (X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy: strict-origin-when-cross-origin);
  • Database Hardening: SQLite databases hosting blog comments are isolated outside public web roots and accessed exclusively via strictly parameterized PDO statements;
  • Automated Rate Limiting: Native backend rate-limiting layers in PHP mitigating automated scrapers and brute-force flooding.

8. Data Retention & Disposal

Personal data is retained solely for the duration required to achieve its legitimate collection purpose:

  • Contact Inquiries: Stored within encrypted mailboxes for the duration of the technical inquiry, purged periodically upon issue resolution;
  • Blog Comments: Maintained for the lifecycle of the technical article to preserve community context, removable at any time upon request;
  • Transaction Hashes: Stripe checkout rate-limiting records are automatically purged by server routines after 10 (ten) minutes;
  • Server Connection Logs: Retained securely for the statutory 6-month period mandated by Article 15 of the Brazilian Internet Civil Framework.

9. Your Rights as a Data Subject

Under the LGPD (Article 18) and the GDPR (Articles 15–22), you hold enforceable privacy rights that you may exercise free of charge at any time:

  • Confirmation & Access: Confirm whether your data is being processed and obtain copies of stored records;
  • Rectification: Request prompt correction of inaccurate, outdated, or incomplete data;
  • Anonymization or Erasure: Request the deletion or blocking of unnecessary, excessive, or unlawfully processed data;
  • Consent Withdrawal: Revoke previously granted consent for comment publication or correspondence;
  • Sharing Disclosures: Request detailed disclosure of any public or private entities with which data has been shared.

10. Data Protection Officer (DPO) & Inquiries

To exercise your privacy rights or request technical details regarding data handling practices, please contact the Data Protection Officer directly:

Data Protection Officer (DPO)

Name: Percio Castelo

Official Privacy Contact: [email protected]

Valid data subject requests will be acknowledged promptly and answered within the statutory timeframe of up to 15 (fifteen) business days.

11. Amendments to this Policy

We may update this Privacy Policy from time to time to reflect security upgrades or regulatory developments. We recommend reviewing this document regularly. The timestamp at the top of this page indicates when the current version took effect.