This Privacy Policy describes how George Eich Institute LLC, a company based in Florida, United States, and Vinners LTDA, a company based in Brazil, handle personal information in connection with georgeeich.com, campaign pages, business inquiry forms, diagnostic conversations, content subscriptions and related communications. It applies to website visitors, prospective clients, business contacts and representatives of organizations interacting with us. We follow privacy laws applicable to each processing activity, including Brazil's General Data Protection Law (LGPD) where it applies and relevant United States laws.
1. Organizations responsible for processing
George Eich Institute LLC (the “Institute”), based in the State of Florida, United States, and Vinners LTDA (“Vinners”), based in Brazil, participate in the activities described in this policy. Each organization may determine the purposes and methods of certain processing activities, and both may make decisions together where their business and operational activities overlap. Their respective responsibilities depend on the specific processing activity.
Website: georgeeich.com.
Data Protection Officer (DPO) and privacy contact: George Eich.
Email for privacy requests: dpo@georgeeich.com.
2. Personal information we may collect
Information you provide
- Identity and contact details: name, business email address, phone number and WhatsApp number.
- Professional and company details: company name, job title, business role, company revenue range and information relevant to business lead qualification.
- Details of your request: the strategic decision or topic you wish to discuss, expected decision timeline, business challenges and optional messages entered in forms.
- Subscriptions and preferences: name, email address and any preferences provided when you expressly subscribe to the Priority newsletter or request other content.
- Communications: messages, correspondence and information you choose to provide through forms, email, WhatsApp or similar channels.
Technical and website information
Depending on the page, configuration and your privacy choices, we may collect pages visited, interaction and conversion events, dates and times of access, IP address, browser and device information, traffic source, campaign parameters (such as UTM values), and advertising click identifiers (such as gclid, fbclid and li_fat_id). Attribution information may be associated with a form you voluntarily submit.
Please do not include sensitive personal information, unnecessary confidential documents or third-party personal information in free-text form fields.
3. Why we use information
We process information for the following purposes. Where Brazil's LGPD applies, the table indicates the potential legal bases, depending on the circumstances. In the United States and other locations, the processing is also subject to the privacy and marketing rules applicable to the individual and the activity.
| Purpose | How information is used | Potential LGPD legal basis (when applicable) |
|---|---|---|
| Respond to a business inquiry | Receive requests, contact you, arrange and hold a diagnostic conversation, and send information or proposals you requested. | Steps requested before a contract and/or consent, as appropriate. |
| Business qualification and CRM | Understand your company's context, evaluate service fit, organize follow-up and maintain relevant lead history, including through Vinners' Bubble-based workflows and RD Station. | Pre-contractual steps and, where appropriate, legitimate interests subject to the required assessment. |
| Requested newsletters and content | Manage an active subscription to Priority and send the content you separately requested, including subscription preferences and unsubscribe handling. | Consent where required; it can be withdrawn. |
| Website analytics and improvement | Assess website performance, understand navigation, identify errors and analyze engagement. | Consent for nonessential analytics technologies where required. |
| Advertising and conversion measurement | Measure campaign effectiveness, attribute conversions and, where permitted, support advertising audiences or remarketing. | Consent for nonessential advertising technologies and related processing where required. |
| Security, legal obligations and recordkeeping | Protect systems, prevent misuse or fraud, retain required records and respond to valid legal requests. | Legal obligation and/or legitimate interests, as appropriate. |
Some form information may be used for preliminary business qualification, for example based on a stated role, company revenue range or decision timeline. You can ask about this processing using the contact details below.
5. Who receives personal information
We disclose information only for the stated purposes or where lawfully required. Recipients may include:
- Vinners LTDA (Brazil): commercial and operational support for the Institute, including receiving and processing form submissions, coordinating follow-up and managing lead information.
- Bubble: the technology platform used for Vinners' initial form intake, API integrations, information processing and lead qualification workflows.
- RD Station: lead registration, CRM or lead management, communication history, marketing automation and email delivery when relevant to the relationship; recurring newsletters are not automatically authorized by a diagnostic request.
- Hosting and infrastructure providers: companies that provide website hosting, application operation, information security and storage.
- Google, Meta, LinkedIn and OpenAI (ChatGPT Ads): analytics, campaign attribution and advertising tools where configured, subject to applicable law and appropriate privacy choices.
- Professional advisers, technical vendors and public authorities: where necessary for operations, legal compliance, valid requests or the establishment and defense of rights.
Form data sent through the Vinners and RD Station workflow may include name, email, phone number, company and professional details, the content of the request, and available campaign attribution information. Access should be limited to personnel and service providers with an operational need to process that information.
Where advertising integrations are configured to use contact details, email addresses or phone numbers may be normalized and cryptographically hashed (for example, using SHA-256) before transmission for ad matching or conversion measurement. Hashing does not necessarily make such information anonymous, and these uses remain subject to applicable privacy rules and consent choices.
We do not sell contact lists for monetary payment. However, certain advertising or cross-context tracking disclosures may be treated as a “sale,” “sharing” or “targeted advertising” under some U.S. state privacy laws. Where such laws apply, we will provide required choices and handle valid requests accordingly.
6. International processing and data transfers
Because the Institute is based in Florida, United States, and Vinners is based in Brazil, personal information may be accessed, disclosed or processed in both countries. In particular, when you submit a form on an Institute page, information may be routed to the Bubble infrastructure used by Vinners and to RD Station for lead management and appropriate communications. Depending on their actual hosting arrangements and subcontractors, these services may also process information in other countries.
Purposes and retention: these cross-border operations support receiving and qualifying inquiries, arranging diagnostic conversations, lead management, requested communications, support and related legal obligations. Lead and CRM data are generally subject to the periods specified in Section 7.
Roles and safeguards: the Institute and Vinners are responsible for their respective decisions about processing, while technology providers may process data as service providers or under their own legally defined roles. We will use the legal transfer mechanisms, contractual provisions, vendor controls and security safeguards required for the actual transfer and applicable jurisdiction. For processing subject to Brazil's LGPD, international transfers must meet the relevant LGPD requirements, including the ANPD rules on international transfers, as applicable.
You may request further information about the destinations, purposes, recipients, applicable safeguards and your rights through dpo@georgeeich.com.
7. How long we keep personal information
We retain personal information only as long as reasonably necessary for the stated purposes and applicable legal obligations, using the following operational retention criteria:
| Data category | Retention criterion |
|---|---|
| Business inquiries with no contract | Up to 24 months after the last relevant interaction, unless an earlier valid deletion request is received or the law permits or requires retention. |
| CRM and lead qualification history with no contract | Up to 24 months after the last relevant interaction; then deleted or de-identified unless continued retention is justified. |
| Priority newsletter and other requested recurring emails | For as long as the subscription remains active, until you unsubscribe or withdraw consent. Minimal opt-out or suppression records may be retained as necessary to avoid sending unwanted emails or demonstrate compliance. |
| Technical access and security logs | Six months as a reference period for application access records governed by Brazil's Internet Civil Framework, where applicable. Other security and service logs may be governed by different legal or operational periods; legal holds or incidents may require longer preservation. |
| Contracts and service documentation | Throughout the business relationship and, where justified by applicable law, up to 10 years after termination. Certain categories of documents may have different mandatory or limitation periods. |
| Cookies and measurement data | According to actual provider settings, the applicable technology's lifespan and privacy preferences, with any mandatory retention requirements. |
These are upper limits or general criteria, not permission to keep information without a valid purpose. We may delete, de-identify or retain a limited subset of information where permitted or required by law. Deletion may not immediately remove lawful backups, suppression records or materials subject to a legal hold.
8. How we protect information
We seek to apply reasonable technical and organizational safeguards proportionate to the information involved and the relevant risks, including appropriate access controls, restricted operational access and protection of communications and systems. No website, storage platform or transmission method is entirely risk-free. We assess and respond to security incidents in accordance with applicable law.
9. Your privacy rights
Rights under Brazil's LGPD, when applicable
Subject to legal requirements and exceptions, Article 18 of the LGPD may provide rights to:
- Confirm whether personal data are being processed and request access.
- Correct incomplete, inaccurate or outdated information.
- Request anonymization, blocking or deletion of unnecessary or unlawfully processed data.
- Request portability, subject to applicable rules and protected business information.
- Request deletion of data processed on the basis of consent, subject to legal exceptions.
- Receive information about entities with which data have been shared.
- Learn whether consent can be refused and about the consequences of refusal.
- Withdraw consent when consent is the relevant legal basis.
Where appropriate, Brazilian data subjects may also contact the Brazilian National Data Protection Authority (ANPD).
Rights under applicable U.S. state laws
Depending on your state of residence, the nature of the data processing and whether the relevant law applies to the organization, you may have rights to request access, correction or deletion, to obtain a copy of certain information, or to opt out of qualifying targeted advertising, data sales or certain profiling activities. Some laws also provide an appeal process. We will evaluate and respond to requests under the laws that apply to the specific circumstances. We do not represent that every state privacy statute automatically applies to the Institute solely because it operates in Florida.
You may also opt out of marketing emails through the unsubscribe link in the message. We process valid unsubscribe requests in accordance with applicable rules, including the U.S. CAN-SPAM Act where relevant.
10. How to exercise your rights or contact us
For requests about access, correction, deletion, consent withdrawal, marketing preferences, advertising disclosures, international processing or any other privacy concern, contact George Eich, Data Protection Officer, at dpo@georgeeich.com using the subject “Privacy Request.” This contact covers the Institute and Vinners activities described in this policy.
We may request the minimum information reasonably necessary to verify your identity, locate relevant records and protect your privacy. We will respond within deadlines required by applicable law and explain any lawful limitations or reasons a request cannot be fulfilled.
11. Third-party services and children's information
Our pages may link to services outside our control, including WhatsApp and external platforms. Their own terms and privacy policies may apply when you use them. We encourage you to review those notices.
Our website and business services are intended for adults and professional audiences and are not directed to children under age 13. We do not knowingly request personal information from children under 13 through these business inquiry channels. If you believe such information has been provided, contact the DPO.
12. Updates to this Privacy Policy
We may update this Privacy Policy to reflect changes in our services, providers, processes or legal obligations. We will publish the current version and the date of the most recent update on this page and provide additional notice or seek renewed consent if required by applicable law.
Back to top ↑