Chapter I
General Information
1.1. Purpose.
This Privacy Policy of Inflr Tecnologia S.A., a privately held corporation registered with the National Registry of Legal Entities of the Ministry of Economy (CNPJ/ME) under No. 35.061.031/0001-37, headquartered in the Municipality of São Paulo, State of São Paulo, at Avenida Angélica, No. 2133, suite 32, Consolação, ZIP Code 01228-200, contains information about how we process, in whole or in part, whether by automated means or not, the personal data of Users who access our application and platform. Its purpose is to inform interested parties about the types of data collected, the reasons for collecting them, and how users can update, manage, or delete this information.
1.2. Applicable Legislation.
This Privacy Policy was prepared in accordance with Federal Law No. 12,965 of April 23, 2014 (Brazilian Civil Rights Framework for the Internet – Marco Civil da Internet), Federal Law No. 13,709 of August 14, 2018 (Brazilian General Data Protection Law – LGPD), as amended by Law No. 13,853 of July 8, 2019, and European Union Regulation No. 2016/679 of April 27, 2016 (General Data Protection Regulation – GDPR).
1.3. Updates.
This Privacy Policy may be updated as a result of regulatory changes, and users are therefore encouraged to review this section periodically.
Chapter II
Principles and User Rights
2.1. Principles.
The application undertakes to comply with the rules set forth in the GDPR, in accordance with the following principles:
- The user's personal data will be processed lawfully, fairly, and transparently (lawfulness, fairness, and transparency); The user's personal data will be collected only for specified, explicit, and legitimate purposes and may not be further processed in a manner incompatible with those purposes (purpose limitation); The user's personal data will be collected in an adequate and relevant manner, limited to what is necessary for the purposes for which they are processed (data minimization);
- The user's personal data will be accurate and kept up to date whenever necessary, so that inaccurate data are erased or rectified whenever possible (accuracy);
- The user's personal data will be kept in a form that permits identification of data subjects only for as long as necessary for the purposes for which they are processed (storage limitation); The user's personal data will be processed securely, protected against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures (integrity and confidentiality);
2.2. User Rights.
Users of the application have the following rights, granted by the Brazilian General Data Protection Law (LGPD) and the GDPR:
- Right of confirmation and access: the user's right to obtain from the application confirmation as to whether or not personal data concerning them are being processed and, where that is the case, the right to access their personal data; Right to rectification: the user's right to obtain from the application, without undue delay, the rectification of inaccurate personal data concerning them;
- Right to erasure (right to be forgotten): the user's right to have their data deleted from the application; Right to restriction of processing: the user's right to restrict the processing of their personal data, which may be obtained when they contest the accuracy of the data, when the processing is unlawful, when the application no longer needs the data for the stated purposes, when they have objected to the processing, and in cases of processing of unnecessary data; Right to object: the user's right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them, including the use of their personal data for marketing profiling;
- Right to data portability: the user's right to receive the personal data concerning them that they have provided to the application, in a structured, commonly used, and machine-readable format, and the right to transmit those data to another application;
- Right not to be subject to automated decisions: the user's right not to be subject to any decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them.
2.3. Exercise of Rights.
Users may exercise their rights through a written communication sent to the application, or through the platform, with the subject “GDPR”, specifying:
- Full name or company name;
- CPF (Brazilian Individual Taxpayer Registry) or CNPJ (Brazilian National Registry of Legal Entities) number;
- the user's email address;
- The right they wish to exercise with the application;
- Date of the request and the user's signature; (vi) Any document that may demonstrate or justify the exercise of their right.
2.3.1. The request must be sent to the email:
[email protected], or by mail, to the following address: Avenida Angélica, No. 2133, suite 32, Consolação, ZIP Code 01228-200, São Paulo/SP, Brazil.
2.4. Outcome.
The user will be informed in the event of rectification or deletion of their data.
Chapter III
Duty Not to Provide Third-Party Data
3.1. User's Duty.
While using the platform or the application, in order to safeguard and protect the rights of third parties, the user must provide only their own personal data, and not those of third parties.
Chapter IV
Data Collected
4.1. Data Collected.
User data will be collected in accordance with the provisions of this Privacy Policy and will depend on the user's consent, which may be waived only in the cases provided for in art. 11, item II, of the Brazilian General Data Protection Law.
4.2. Registration Data.
The use of certain features of the application by the user will require registration, in which case the following user data will be collected and stored: full name, email address, mobile phone number, and payment information.
4.3. Interaction Data.
For the better provision of the services agreed between the application and the user, other data related to or necessary for their performance may be collected and stored, including the content of any communications with the user.
4.4. Access Logs.
In compliance with art. 15, caput and paragraphs, of Federal Law No. 12,965/2014 (Brazilian Civil Rights Framework for the Internet), the user's access logs will be collected and stored for at least 6 (six) months.
4.5. Other Data.
Occasionally, other types of data not expressly provided for in this Privacy Policy may be collected, provided that they are supplied with the user's consent or that their collection is permitted or required by law.
4.6. User Consent.
By using the services of the platform or the application, the user consents to this Privacy Policy. The user has the right to withdraw their consent at any time, without affecting the lawfulness of the processing of their personal data prior to withdrawal. Consent may be withdrawn by email: [email protected], or by mail, to the following address: Avenida Angélica, No. 2133, suite 32, Consolação, ZIP Code 01228-200, São Paulo/SP, Brazil. Consent from persons with relative or absolute legal incapacity, especially children under 16 (sixteen) years of age, may only be given, respectively, if they are duly assisted or represented.
4.6.1.
Personal data necessary for the performance and fulfillment of the services contracted by the user in the application may also be collected.
4.7. Data Processing.
Personal data will be processed without the user's consent only on the grounds of legitimate interest or in the cases provided for by law, namely, among others, the following:
- for compliance with a legal or regulatory obligation by the controller;
- for studies carried out by a research body, ensuring, whenever possible, the anonymization of personal data;
- when necessary for the performance of a contract or preliminary procedures related to a contract to which the user is a party, at the request of the data subject;
- for the regular exercise of rights in judicial, administrative, or arbitration proceedings, the latter under Law No. 9,307 of September 23, 1996 (Brazilian Arbitration Law);
- when necessary to serve the legitimate interests of the controller or of a third party, except where such interests are overridden by the fundamental rights and freedoms of the data subject that require the protection of personal data;
- for credit protection, including under the provisions of the applicable legislation;
- when necessary to serve the legitimate interests of the controller or of a third party, except where such interests are overridden by the fundamental rights and freedoms of the data subject that require the protection of personal data.
4.8. Purpose of Data Collection.
The user's personal data collected by the application are intended to facilitate, expedite, and fulfill the commitments established with the user and to carry out the requests made by filling out forms. In addition, personal data may also be used for commercial purposes, to personalize the content offered to the user, and to support the application in improving the quality and operation of its services.
4.8.1.
Registration data will be used to allow the user to access certain content in the application that is exclusive to registered users.
4.8.2.
The collection of data related to or necessary for carrying out the processing of the user's data will have the purpose of
- facilitating and enabling the performance of such services in a manner satisfactory to the user;
- sharing the data with clients of the platform;
- improving the user's experience in exchanging information and data with third parties interested in the user.
4.9. Other Purposes.
Personal data will be processed for purposes not provided for in this Privacy Policy only upon prior notice to the user, and in any case the rights and obligations set forth herein will remain applicable.
4.10. Data Storage.
The user's personal data will be kept for a period no longer than that required to fulfill the purposes for which they are processed. The data retention period is defined according to the following criteria: users' personal data may only be retained after the end of their processing in the following cases:
- for compliance with a legal or regulatory obligation by the controller;
- for studies by a research body, ensuring, whenever possible, the anonymization of personal data;
- for transfer to a third party, provided that the data processing requirements set forth in the legislation are respected; (d) for the exclusive use of the controller, with access by third parties prohibited, and provided that the data are anonymized.
4.11. Google API Services.
The use (application) and transfer of information received from Google APIs to any other application will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Chapter V
Data Processing and Protection
5.1. Data Processing.
The controller, responsible for processing the user's personal data, is the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing personal data. On the platform and in the application, the party responsible for collecting and processing the personal data collected is the Data Protection Department, which can be contacted by email at [email protected], or in person at Avenida Angélica, No. 2133, suite 32, Consolação, ZIP Code 01228-200, São Paulo/SP, Brazil.
5.2. Data Protection.
The data protection officer is the department responsible for informing, advising, and monitoring the controller, as well as the staff who process the data, regarding the application's obligations under the GDPR, the Brazilian General Data Protection Law, and other data protection provisions in national and international legislation, in cooperation with the competent supervisory authority. On the platform and in the application, the data protection officer is the Data Protection Department, which can be contacted by email at [email protected], or in person at Avenida Angélica, No. 2133, suite 32, Consolação, ZIP Code 01228-200, São Paulo/SP, Brazil.
Chapter VI
Data Security
6.1. Data Security.
The platform and the application undertake to apply technical and organizational measures capable of protecting personal data from unauthorized access and from destruction, loss, alteration, communication, or dissemination of such data.
6.2. Solutions and Methods.
To ensure security, solutions will be adopted that take into account: appropriate techniques; implementation costs; the nature, scope, context, and purposes of the processing; and the risks to the user's rights and freedoms. However, the platform and the application disclaim liability for the exclusive fault of a third party, such as in the case of attacks by hackers or crackers, or the exclusive fault of the user, such as where the user transfers their own data to a third party.
6.3. Notice to the User.
The platform and the application further undertake to notify the user within a reasonable time if any breach of the security of their personal data occurs that may pose a high risk to their personal rights and freedoms.
6.4. Data Breach.
A personal data breach is a breach of security that leads, accidentally or unlawfully, to the destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
6.5. Confidentiality.
Finally, the application undertakes to treat the user's personal data confidentially, within legal limits.
Chapter VII
Complaints to the Supervisory Authority
7.1. Complaints.
Without prejudice to any other administrative or judicial remedy, all data subjects have the right to lodge a complaint with a supervisory authority. The complaint may be filed with the authority of the place where the platform and application are headquartered, of the user's country of habitual residence, of their place of work, or of the place where the alleged infringement occurred.
Chapter VIII
Amendments
8.1. Current Version.
This version of this Privacy Policy was last updated on: July 22, 2020.
8.2. Amendments.
The publisher reserves the right to modify these rules at any time, especially to adapt them to developments in the platform and application, whether through the release of new features or through the removal or modification of existing ones.
8.3. Notification.
The user will be explicitly notified in the event of any change to this Policy. By using the service after any modifications, the user demonstrates their agreement with the new rules. If the user disagrees with any of the modifications, they must immediately request the cancellation of their account and, if they so wish, submit their objection to the customer service team.
Chapter IX
Governing Law
9.1. Governing Law.
Brazilian law will apply in full to the resolution of any disputes arising from this instrument.
9.2. Jurisdiction.
Any disputes must be brought before the courts of the district where the publisher of the application is headquartered, that is, the central courts of the district of the Capital of the State of São Paulo.
Carolina Filipe
Ligia Soares
Gustavo Mariano
Luisa Fernandes
Eduardo Calian
Gian Scarpelli
