Privacy Policy

Who the controller is

The controller of the personal data processed on this site is Triplet Soluções em Biotecnologia Ltda, registered under CNPJ 43.946.114/0001-31, with its registered office at Rua Monsenhor Claro, 6-18, Centro, Bauru/SP, Brazil.

Contact for privacy matters: contato@tripletbs.com, phone +55 14 91005-1223.

What data we process

Data you provide: the contact form asks for name, email, organisation, segment of interest and your message. The hydroxyapatite specification form, being a formal technical request, also asks for a Brazilian tax ID (CPF or CNPJ), phone number, postcode and city, and the requester's field of work.

IP address: held only in the server's memory, for up to one hour, to limit automated bulk submissions, and passed to Cloudflare when the anti-bot check described below is confirmed. It is not stored alongside the message and is not used for any other purpose.

Technical signals from the anti-bot check: when you start filling in a form, your browser loads the Cloudflare Turnstile check, which collects your IP address, the fingerprint of the TLS connection and the browser identifier (User-Agent) to tell a person from an automated submission. These signals go from your browser straight to Cloudflare. The site's server receives only a single-use verification code and confirms it with Cloudflare. Name, email and the content of the message are not part of this check.

Technical data: a first-party cookie stores your language preference, and the language declared by your browser is read to choose the initial version of the site. We use no audience analytics and no advertising cookies.

We do not process sensitive personal data and we do not collect data from children. This site is aimed at professionals and organisations.

What each item of data is used for

Name, email and organisation: to identify who is getting in touch and to answer through the channel given.

Tax ID, phone, postcode and city, on the specification form: to formally identify the requester, assess the technical and logistical feasibility of supply, and issue the quotation.

Segment of interest and message: to understand the technical request and route it to the right person at Triplet.

Language preference: to show the site in the language you chose on subsequent visits.

Technical signals from the anti-bot check: to stop bots from using the forms for automated bulk submissions. This is an automated decision about the submission: if the check turns it down, the form shows Triplet's email address, so you can make the same request there, with no check at all. Triplet does not use these signals to identify you or for any other purpose.

Apart from that check, none of this data is used for advertising, profiling or automated decision-making, and none of it is sold.

Legal basis

Contact form data: processed on the basis of preliminary procedures related to a contract, at the data subject's request, under article 7, item V of Brazilian Law 13.709/2018. Where the contact has no contractual purpose, processing rests on the legitimate interest in replying to those who approach us, under item IX of the same article.

Anti-bot check on the forms: it is a step of the submission you request and rests on the same basis as the form, article 7, item V of Law 13.709/2018, together with the legitimate interest in keeping the contact channel protected against automated abuse, under item IX of the same article. The signals collected are the minimum for that purpose, and the check only starts when you start filling in the form.

Language preference cookie: legitimate interest in keeping the site working according to the visitor's choice. It is a strictly functional cookie and does not identify you.

Who we share it with

Messages from the forms reach Triplet by email and stay in the @tripletbs.com mailboxes, operated by Hostinger. Name, email and the content of the message pass through that infrastructure — both in the message that reaches the team and in the automatic confirmation sent to you. In this processing Hostinger acts as processor.

The sending of those emails goes through Resend, a transactional email provider: it is Resend that carries both the message reaching the team and the automatic confirmation sent to you. Name, email and the content of the message pass through that transmission and are recorded in Resend's sending logs for up to thirty days. In this processing Resend acts as processor, and the send is handled in the São Paulo region, in Brazil.

The supplier that operates the mailboxes also hosts the site, on a dedicated server. There is no third-party form host and no contact database: past the transmission described above, the messages exist only in Triplet's mailboxes.

The anti-bot check on the forms is performed by Cloudflare, Inc., through its Turnstile service: it receives the technical signals described above and tells the site whether the submission came from a person. In this processing Cloudflare acts as processor. According to Turnstile's own privacy policy, Cloudflare also uses these signals to improve the service's bot detection and, for that specific purpose, acts as controller, under its own policy.

Beyond that, we share no personal data with third parties. The site uses no audience analytics, tracking pixel, heatmap or any other external service that receives visitor data besides those described in this section. Should we adopt another supplier, this section will be updated with its name before that service goes live.

How long we keep it

Form messages: for as long as the enquiry and any resulting commercial relationship last, and for up to five years after the last contact, a period that follows the limitation period for related civil claims.

Sending records at the transactional email provider: thirty days, the term of the contracted plan. After that period the message exists only in Triplet's mailboxes.

Technical signals from the anti-bot check: Triplet does not keep them. When the check turns a submission down, the server records only the reason given by Cloudflare, without the IP address. Retention of these signals at Cloudflare itself follows Turnstile's privacy policy.

Language preference cookie: it stays in your browser until you remove it, which you can do at any time in your browser settings.

Once the period ends the data is deleted, unless a legal retention obligation applies.

Your rights

Brazil's General Data Protection Law grants you, as a data subject: confirmation that we process your data; access to it; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary data or data processed unlawfully; portability; deletion of data processed on the basis of consent; information about who we share it with; and withdrawal of consent.

To exercise any of these, write to contato@tripletbs.com. We reply within fifteen calendar days of receiving the request.

If our answer does not resolve the matter, you may petition Brazil's National Data Protection Authority.

Cookies

This site uses a single cookie, first-party and strictly functional.

NEXT_LOCALE. Purpose: to store the chosen language. Duration: until removed by the browser. Type: first-party, functional. It does not identify you and has no advertising purpose.

Cloudflare's anti-bot check sets no cookies. When you start filling in a form, it stores a technical record, cf.turnstile.u, in the browser's local storage, within Cloudflare's own domain. It belongs to the check, whose stated purpose, according to Cloudflare, is to detect and block bots.

There are no analytics, performance or advertising cookies, which is why the site shows no consent banner. Should that change, the banner will appear and this section will be updated beforehand.

Information security

The site is served exclusively over an encrypted connection, with a valid certificate and automatic redirection from HTTP to HTTPS.

The application runs on a dedicated server, inside a container without administrator privilege, and administrative access to the infrastructure is restricted and authenticated.

The forms go through an anti-bot check before sending. Form data leaves the site only for the two suppliers that carry and store it, Resend and Hostinger, and for nobody else: Cloudflare, which runs the check, receives only the technical signals described in this Policy, not the content of the form. There is no audience analytics, tracking pixel or heatmap, and the sending provider's open and click tracking is switched off.

No measure removes risk entirely. In the event of a security incident posing relevant risk to data subjects, we will notify those affected and the National Data Protection Authority as the law requires.

International transfer

The @tripletbs.com mailboxes are operated by Hostinger. Asked in September 2026, the company stated that it cannot indicate a specific country of storage: its email infrastructure is distributed and the contracted plan offers no region selection. The location of the domain and of the site's server does not determine where the mailboxes sit.

The sending of messages is handled by Resend in the São Paulo region, in Brazil. That shortens the international leg of the route but does not remove it: the destination is still the mailboxes described above.

The anti-bot check is processed on the global network of Cloudflare, a company headquartered in the United States, and may take place outside Brazil.

We therefore treat form submissions, the anti-bot check included, as a possible international transfer of personal data, under chapter V of Law 13.709/2018. The transfer rests on article 33, item IX, combined with article 7, item V: it is necessary to answer the request you yourself made by submitting the form — without transmitting the message there is no way to reply to it.

Anyone who would rather not have their data handled this way can reach Triplet by telephone, on the numbers published on the Contact page.

Data protection officer

Communications about personal data protection, including requests from data subjects and from the National Data Protection Authority, should be addressed to contato@tripletbs.com, a channel attended by the officer appointed by Triplet.

Changes to this policy

This policy may be updated to reflect changes to the site, to the services used or to applicable legislation.

The effective date at the top of the page marks the last update. Material changes, such as adopting a service that begins to receive visitor data, will be described in the relevant sections before they take effect.