Privacy Policy – DataPolicy
We, DATAPOLICY TECNOLOGIA E DESENVOLVIMENTO DE PROGRAMAS S.A., headquartered in the City of Brasília, Federal District, at SHCGN CLR 705 – Bloco E – Loja 08 – Parte UK, Asa Norte, CEP (postal code) 70730-555, enrolled in the National Register of Legal Entities (CNPJ) under No. 25.340.504/0001-81, website https://www.datapolicy.co, are committed to safeguarding your privacy.
Whereas:
The purpose of this policy is to clarify what information is collected from users of our websites https://datapolicy.co and https://app.datapolicy.co – and their respective services and sign-up forms – and how such data is handled and used.
This policy is an integral part of the Service Agreement and License of Use available at https://datapolicy.co/contrato-e-licenca.
Clause One – General Information
1.1. This Privacy Policy contains information about how we process, in whole or in part, whether by automated means or not, the personal data of users who access our application. Its purpose is to inform interested parties about the types of data collected, the reasons for collection, and how users may update, manage or delete this information.
1.2. This Privacy Policy was prepared in accordance with Federal Law No. 12,965 of April 23, 2014 (Brazilian Internet Civil Framework – Marco Civil da Internet), Federal Law No. 13,709 of August 14, 2018 (Brazilian General Personal Data Protection Law – LGPD) and Regulation (EU) 2016/679 of April 27, 2016 (General Data Protection Regulation – GDPR).
1.3. This Privacy Policy may be updated as a result of changes in applicable regulations; users are therefore invited to consult this section periodically.
Clause Two – User Rights
2.1. The application undertakes to comply with the rules set forth in the GDPR, in observance of the following principles:
2.1.1. The user’s personal data will be processed lawfully, fairly and in a transparent manner (lawfulness, fairness and transparency);
2.1.2. The user’s personal data will be collected only for specified, explicit and legitimate purposes and may not be further processed in a manner incompatible with those purposes (purpose limitation);
2.1.3. The user’s personal data will be collected in a manner that is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimization);
2.1.4. The user’s personal data will be accurate and kept up to date whenever necessary, so that inaccurate data are erased or rectified whenever possible (accuracy);
2.1.5. The user’s personal data will be kept in a form that permits identification of data subjects only for as long as necessary for the purposes for which they are processed (storage limitation);
2.1.6. The user’s personal data will be processed securely, protected against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (integrity and confidentiality).
2.2. Users of the application have the following rights, granted by the LGPD and the GDPR:
2.2.1. Right of confirmation and access: the user’s right to obtain from the application confirmation as to whether or not personal data concerning them are being processed and, where that is the case, the right to access such personal data;
2.2.2. Right to rectification: the user’s right to obtain from the application, without undue delay, the rectification of inaccurate personal data concerning them;
2.2.3. Right to erasure (right to be forgotten): the user’s right to have their data deleted from the application;
2.2.4. Right to restriction of processing: the user’s right to restrict the processing of their personal data, which may be obtained when the user contests the accuracy of the data, when the processing is unlawful, when the application no longer needs the data for the stated purposes, when the user has objected to the processing, and in the event of processing of unnecessary data;
2.2.5. Right to object: the user’s right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them, including the right to object to the use of their personal data for marketing profiling;
2.2.6. Right to data portability: the user’s right to receive the personal data concerning them that they have provided to the application, in a structured, commonly used and machine-readable format, and the right to transmit those data to another application;
2.2.7. Right not to be subject to automated decision-making: the user’s right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
2.3. Users may exercise their rights by written communication sent to the application with the subject line “RGDP-”, specifying:
2.3.1. Full name or corporate name, CPF number (Individual Taxpayer Registry of the Brazilian Federal Revenue Service) or CNPJ number (National Register of Legal Entities of the Brazilian Federal Revenue Service), and the e-mail address of the user and, where applicable, of their representative;
2.3.2. The right they wish to exercise with the application;
2.3.3. The date of the request and the user’s signature;
2.3.4. Any document that may demonstrate or justify the exercise of their right.
2.4. The request must be sent to the e-mail address sucessocliente@datapolicy.co, or by mail to the following address:
Brasília, Federal District, SHCGN CLR 705 – Bloco E – Loja 08 – Parte UK, Asa Norte, CEP 70730-555, Brazil.
2.5. The user will be notified in the event of rectification or erasure of their data.
Clause Three – Duty Not to Provide Third-Party Data
3.1. While using the application, in order to safeguard and protect the rights of third parties, the user must provide only their own personal data and not those of third parties.
Clause Four – Information Collected
4.1. User data will be collected in accordance with the provisions of this Privacy Policy and will depend on the user’s consent, which may be waived only in the cases provided for in Article 11, item II, of the LGPD.
4.1.1. The types of data collected are:
4.1.1.1. User identification data for registration: The use of certain features of the application by the user will require registration, in which case the following user data may – if necessary – be collected and stored:
a) name
b) date of birth
c) e-mail address
d) postal address
e) social media details
f) telephone number
g) CPF number
h) CNPJ number
i) corporate name
j) company address
l) company logo
m) company name
n) regulations of interest to users
o) files and notes made by users
p) users’ positions and explanations on regulations of interest
q) users’ strategic actions.
4.1.1.2. Data provided in the contact form: Any data provided by the user through the contact form available in the application, including the content of the message sent, will be collected and stored.
4.1.1.3. Data related to the performance of contracts entered into with the user: For the performance of any purchase and sale or service agreement entered into between the application and the user, other data related to or necessary for its performance may be collected and stored, including the content of any communications with the user.
4.1.1.4. Access logs: In compliance with Article 15, caput and paragraphs, of Federal Law No. 12,965/2014 (Marco Civil da Internet), the user’s access logs will be collected and stored for at least six months.
4.1.1.5. Newsletter: The e-mail address registered by a user who chooses to subscribe to our Newsletter will be collected and stored until the user requests to unsubscribe.
4.1.1.6. Sensitive data: No sensitive data will be collected from users, understood as those defined in Articles 9 and 10 of the GDPR and in Articles 11 et seq. of the LGPD. Accordingly, among others, the following data will not be collected:
a) data revealing the user’s racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership;
b) genetic data;
c) biometric data for the purpose of uniquely identifying a person;
d) data concerning the user’s health;
e) data concerning the user’s sex life or sexual orientation;
f) data relating to criminal convictions or offences or related security measures.
4.1.1.7. Collection of data not expressly provided for: Other types of data not expressly provided for in this Privacy Policy may occasionally be collected, provided they are supplied with the user’s consent, or that their collection is permitted or required by law.
4.2. Legal basis for the processing of personal data: By using the application’s services, the user consents to this Privacy Policy.
4.3. The user has the right to withdraw their consent at any time, without affecting the lawfulness of the processing of their personal data prior to withdrawal. Consent may be withdrawn by e-mail to sucessocliente@datapolicy.co, or by mail sent to the following address:
Brasília, Federal District, SHCGN CLR 705 – Bloco E – Loja 08 – Parte UK, Asa Norte, CEP 70730-555, Brazil.
4.4. Consent from persons who are relatively or absolutely incapable, especially children under 16 (sixteen) years of age, may only be given if they are duly assisted or represented, respectively.
4.5. Personal data will be processed without the user’s consent only on the grounds of legitimate interest or in the cases provided for by law, including, among others, the following:
a) for compliance with a legal or regulatory obligation by the controller;
b) for studies carried out by a research body, ensuring, whenever possible, the anonymization of personal data;
c) when necessary for the performance of a contract, or of preliminary procedures related to a contract, to which the user is a party, at the request of the data subject;
d) for the regular exercise of rights in judicial, administrative or arbitral proceedings, the latter under Law No. 9,307 of September 23, 1996 (Arbitration Law);
e) for the protection of the life or physical safety of the data subject or a third party;
f) for the protection of health, in a procedure carried out by health professionals or health authorities;
g) when necessary to serve the legitimate interests of the controller or a third party, except where such interests are overridden by the fundamental rights and freedoms of the data subject that require the protection of personal data;
h) for credit protection, including under the provisions of the relevant legislation.
4.6. Purposes of the processing of personal data: The user’s personal data collected by the application are intended to facilitate, expedite and fulfill the commitments established with the user and to carry out requests made through the completion of forms.
4.7. Personal data may also be used for commercial purposes, to personalize the content offered to the user, and to support the application in improving the quality and operation of its services.
4.8. Registration data will be used to allow the user to access certain content of the application that is exclusive to registered users.
4.9. The collection of data related to or necessary for the performance of a purchase and sale or service agreement entered into with the user is intended to provide the parties with legal certainty, as well as to facilitate and enable the conclusion of the transaction.
4.10. Personal data will be processed for purposes not provided for in this Privacy Policy only upon prior notice to the user; in any case, the rights and obligations set forth herein will remain applicable.
4.11. Retention period of personal data: The user’s personal data will be kept for no longer than is required to fulfill the purposes for which they are processed.
4.12. The data retention period is defined according to the following criteria:
The period during which the Service Agreement and License of Use, as defined in the Adhesion Agreement, remains in force.
4.13. Users’ personal data may only be retained after the end of their processing in the following cases:
a) for compliance with a legal or regulatory obligation by the controller;
b) for studies by a research body, ensuring, whenever possible, the anonymization of personal data;
c) for transfer to a third party, provided that the data processing requirements set forth in the legislation are observed;
d) for the exclusive use of the controller, with access by third parties prohibited, and provided the data are anonymized.
4.14. Recipients and transfer of personal data: The user’s personal data will not be shared with third parties. They will therefore be processed solely by this application.
Clause Five – Processing of Personal Data
5.1. The controller (data controller), responsible for processing the user’s personal data, is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
5.2. In this application, the party responsible for processing the personal data collected is DATAPOLICY TECNOLOGIA E DESENVOLVIMENTO DE PROGRAMAS S.A., represented by Eduardo Reis Alexandre, who may be contacted by e-mail at sucessocliente@datapolicy.co or at the following address:
Brasília, Federal District, SHCGN CLR 705 – Bloco E – Loja 08 – Parte UK, Asa Norte, CEP 70730-555, Brazil.
5.3. The controller will be directly in charge of processing the user’s personal data.
5.4. The data protection officer is the professional in charge of informing, advising and monitoring the controller, as well as the employees who process data, regarding the application’s obligations under the GDPR, the LGPD and other data protection provisions in national and international legislation, in cooperation with the competent supervisory authority.
5.5. In this application, the data protection officer is Eduardo Shindi, who may be contacted by e-mail at privacidade@datapolicy.co.
5.6. Without limiting the foregoing, DataPolicy undertakes to maintain appropriate administrative, physical and technical safeguards to protect the security, confidentiality and integrity of Personal Data.
5.7. DataPolicy undertakes not to alter, disclose or access Personal Data, except as required by law or with the express permission of the data subject, such as when providing customer support.
5.8. DataPolicy guarantees that any storage, use and processing of Personal Data collected during the provision of the services covered by this Agreement will take place in accordance with the purposes set forth in the Agreement and in the applicable legislation, protecting such data against loss, disclosure and unauthorized access, whether accidental or not; such measures must ensure adequate security for the risks arising from the nature of the Personal Data collected.
5.9. Upon signing the agreement and accepting the Terms of Use and this Privacy Policy, DataPolicy may use users’ Personal Data to improve its products and algorithms, and to prepare reports, metrics, other solutions and business intelligence software for its own use.
Clause Six – Security in the Processing of Users’ Personal Data
6.1. The application undertakes to apply technical and organizational measures capable of protecting personal data from unauthorized access and from situations of destruction, loss, alteration, communication or dissemination of such data.
6.2. To ensure security, solutions will be adopted that take into account: appropriate techniques; implementation costs; the nature, scope, context and purposes of the processing; and the risks to the user’s rights and freedoms.
6.3. The application uses an SSL (Secure Socket Layer) certificate, which ensures that personal data are transmitted securely and confidentially, so that data transmission between the server and the user, and vice versa, is fully encrypted.
6.3. However, the application disclaims liability in cases of the exclusive fault of a third party, such as an attack by hackers or crackers, or the exclusive fault of the user, such as when the user transfers their own data to a third party. The application further undertakes to notify the user within a reasonable time if any breach of the security of their personal data occurs that may result in a high risk to their personal rights and freedoms.
6.4. A personal data breach is a breach of security leading, accidentally or unlawfully, to the destruction, loss, alteration, disclosure of, or unauthorized access to, personal data transmitted, stored or otherwise processed.
6.5. Finally, the application undertakes to treat the user’s personal data confidentially, within legal limits.
Clause Seven – Browsing Data (Cookies)
7.1. Cookies are small text files sent by the application to the user’s computer, where they are stored, containing information related to the user’s browsing of the application.
7.2. Through cookies, small amounts of information are stored by the user’s browser so that our server can read them later. For example, data about the device used by the user, as well as the location and time of access to the application, may be stored.
7.3. Cookies do not allow any file or information to be extracted from the user’s hard drive, nor do they make it possible to access personal information that did not originate from the user or from the way the user uses the application’s resources.
7.4. It is important to note that not every cookie contains information that allows the user to be identified; certain types of cookies may be used simply so that the application loads correctly or so that its features work as expected.
7.5. Any information stored in cookies that allows a user to be identified is considered personal data. Accordingly, all rules set forth in this Privacy Policy also apply to such information.
7.6. Application cookies: Application cookies are those sent to the user’s and administrator’s computer or device exclusively by the application.
7.7. The information collected through these cookies is used to improve and personalize the user experience; some cookies may, for example, be used to remember the user’s preferences and choices, as well as to offer personalized content.
7.8. Third-party cookies: Some of our partners may set cookies on the devices of users who access our application.
7.9. These cookies generally aim to enable our partners to offer their content and services to users who access our application in a personalized manner, by obtaining browsing data extracted from their interaction with the application.
7.10. Users may obtain more information about third-party cookies and how the data obtained from them is processed, as well as access a description of the cookies used and their characteristics, at the following link:
7.11. The entities responsible for collecting cookies may share the information obtained with third parties.
7.12. Cookie management and browser settings: Users may object to the recording of cookies by the application simply by disabling this option in their own browser or device.
7.13. Disabling cookies, however, may affect the availability of some of the application’s tools and features, compromising its correct and expected operation. Another possible consequence is the removal of any user preferences that may have been saved, impairing the user experience.
7.14. Below are some links to the help and support pages of the most widely used browsers, which users interested in learning more about managing cookies in their browser may access:
a) Internet Explorer: https://support.microsoft.com/pt-br/help/17442/windows-internet-explorer-delete-manage-cookies
b) Safari: https://support.apple.com/pt-br/guide/safari/sfri11471/mac
c) Google Chrome: https://support.google.com/chrome/answer/95647?hl=pt-BR&hlrm=pt
d) Mozilla Firefox: https://support.mozilla.org/pt-BR/kb/ative-e-desative-os-cookies-que-os-sites-usam
e) Opera: https://www.opera.com/help/tutorials/security/privacy/
Clause Eight – Complaint to a Supervisory Authority
8.1. Without prejudice to any other administrative or judicial remedy, all data subjects have the right to lodge a complaint with a supervisory authority. The complaint may be filed with the authority of the application’s headquarters, of the user’s country of habitual residence, of their place of work, or of the place where the infringement allegedly occurred.
Clause Nine – Amendments
9.1. This version of the Privacy Policy was last updated on July 24, 2019.
9.2. The publisher reserves the right to modify the application and these rules at any time and without prior notice, especially to adapt them to developments in the Regulatory Risk Management application (Gestão de Risco Regulatório), whether through the release of new features or the removal or modification of existing ones.
9.3. Users are therefore invited to consult this page periodically to check for updates.
9.4. By using the service after any modifications, the user demonstrates their agreement with the new rules. If the user disagrees with any of the modifications, they must immediately request the cancellation of their account and, if they so wish, submit their objection to the customer service team.
Clause Ten – Governing Law and Jurisdiction
10.1. Brazilian law shall apply in its entirety to the resolution of disputes arising from this instrument.
10.2. Any disputes shall be brought before the courts of the judicial district in which the application publisher’s headquarters is located.