PRIVACY AND DATA PROTECTION POLICY
INTRODUCTION
With this Policy, ÁGUAS NEGRAS aims to demonstrate the procedures and care it takes to ensure the privacy, protection of personal data and the security of the information of its customers, employees and partners.
As you can see, all data from individuals is properly processed and protected, all as provided below.
CONCEPTS AND ACRONYMS
LGPD: General Data Protection Law (Law 13.7019/2018);
ANPD: National Data Protection Agency;
Client/Holder/Consumer: Natural person to whom the personal data that are the object of processing refer;
ÁGUAS NEGRAS Client: Individual or legal entity that hires ÁGUAS NEGRAS services;
Controller: Natural or legal person, under public or private law, who are responsible for decisions regarding the processing of personal data;
Operator: Natural or legal person, under public or private law, who processes personal data on behalf of the controller;
Person in Charge: Person appointed by the controller to act as a communication channel between the controller, the data subjects and the National Data Protection Authority (ANPD);
Personal data: Information that can be linked to the identified or identifiable natural person (art. 5, item I, of the LGPD). Examples: name, marital status, profession, date of birth, personal documents (CPF, RG, CNH, Work Card, passport, voter registration, etc.), residential or business address, telephone, email, cookies and address IP;
Sensitive personal data: Personal data (information) that fits the definitions of subsection II of Article 5 of the LGPD. Personal data with the greatest potential harm in the event of an incident;
Information: Data, in a broad sense, contained in any and all media, support or format, which can be used for the production and transmission of knowledge;
Data processing: Any operation performed with personal data, such as those relating to the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation or control of information, modification , communication, transfer, broadcast or extraction;
Data Sharing: Transfer of personal data between ÁGUAS NEGRAS, ÁGUAS NEGRAS Clients and partners/third parties;
Legal basis: Legal basis provided for in the LGPD that makes the processing of personal data legitimate;
Consent: Express, unambiguous and specific authorization, given by the holder of personal data so that their personal data can be processed by ÁGUAS NEGRAS;
Privacy and Data Protection: Concept that deals with the act of using personal data and sensitive personal data without causing discrimination or damage of any kind to its holder. It will always be related to the existence, creation and implementation of laws, procedures, internal rules and policies that aim to guarantee the rights of data subjects in the form of the LGPD;
Stakeholders: These are all relevant audiences with interests relevant to ÁGUAS NEGRAS, or even individuals, community or entities that assume some type of risk, direct or indirect, in the face of the company;
Third parties: Natural or legal person that provides services or has a partnership agreement with ÁGUAS NEGRAS, on its premises or remotely, and in the exercise of their activities may have access to information regarding data subjects that are handled by ÁGUAS NEGRAS or by ÁGUAS NEGRAS Clients.
NAME AND CONTACTS OF CONTROLLER, OPERATOR AND IN CHARGE
CONTROLLER
ÁGUAS NEGRAS will be the Controller, for the purposes of the LGPD, when the personal data processed are collected directly by it. In this case, the information from the Parent Company follows:
ÁGUAS NEGRAS SA PAPER INDUSTRY
CNPJ: 82,757,907/0001-64
Address: Avenida Brasil, nº 1005, Municipality of Ituporanga, State of Santa Catarina, CEP. 88,400-000.
Contact email: ***
OPERATOR
ÁGUAS NEGRAS will have some partners as Data Operators, for the purposes of the LGPD, always with the aim of enhancing the quality of its services and data management, which are as follows:
a) DELSOFT SISTEMAS LTDA.
CNPJ: 73.593.857/0001-36
Address: Rua General Osório, nº 220 and 222, Bairro, Jardim América, Rio do Sul - SC, CEP. 89,160-224.
Contact email: daniel.scheidt@delsoftsistemas.com.br
******[1]
IN CHARGE
The person who acts as Manager, under the terms of the LGPD, within the general scope of this Privacy and Data Protection Policy is:
MULLER KIRCHNER E SOUZA ADVOCACIA EMPRESARIAL
CNPJ: 04.690.321/0001-16
Address: Alameda Aristiliano Ramos, nº 1091, 1st Floor, Bairro Jardim América, Municipality of Rio do Sul - SC, CEP. 89,160-240.
Contact email: eucio@mks.adv.br
Note: The holder who intends to contact ÁGUAS NEGRAS to claim any of the rights provided for in the LGPD, must make contact through the above mentioned communication channels relating to the Person in Charge or through the Communication Channel with the Holder [2] contained in the virtual page of the BLACK WATERS.
HOW AGUAS NEGRAS COLLECTS DATA, HOW IT IS TREATED AND WHICH LEGAL BASIS IS USED
ÁGUAS NEGRAS handles the processing of personal data:
Owners, partners, employees, representatives or agents of legal entities for prospecting purposes, always through the collection of consent. In this case, the legal basis for treatment is item I, of article 7, of the LGPD, so that the holder can exercise his right to revoke the consent at any time;
Data collected/treated: name, profession/position in the company, telephone (landline or mobile - Whatsapp), gender, organization in which they work, email address, address of the company where the person works, and any other data personnel that can be collected for prospecting purposes.
Owners, partners, employees, representatives or agents of legal entities that are partners or provide services for ÁGUAS NEGRAS. In this case, the legal basis for treatment is item V, article 7, of the LGPD;
Data collected/treated: name, marital status, CPF, RG, profession, telephone, address, gender, organization in which you work, position held in the company, email address, telephone (landline or cell phone - WhatsApp), and any other personal data that may be collected for the purpose of performing the contract;
Partners, administrators, employees, representatives or agents for the purpose of executing service contracts agreed with ÁGUAS NEGRAS Clients. In this case, the legal basis for treatment is item V, article 7, of the LGPD;
Data collected/treated: name, marital status, CPF, RG, profession, telephone, address, gender, organization in which you work, position held in the company, email address, telephone (landline or cell phone - Whatsapp), and any other personal data that may be collected for the purpose of performing the contract;
Owners who register on ÁGUAS NEGRAS' virtual pages in order to receive information, news feeds or promotional and informative materials, which is carried out based on the legitimate interest of the Parent Company, considering the understanding that the registration by the part of the holders represents the emergence of an obligation to be fulfilled by ÁGUAS NEGRAS, so the legitimate interest in complying with the obligation assumed before the holder shows a direct relationship with the legal permission in question. In this case, the legal basis for treatment is item IX, of article 7, of the LGPD;
Data collected/treated: user name, telephone, city, state, organization that works, position held, corporate email address or region where the site is being accessed, browser type, system operational, the reference site visited, the pages, the history, the time of access to the site[3] .
Of partners, administrators, collaborators, representatives or agents of ÁGUAS NEGRAS, for the purpose of executing the employment contract. In this case, the legal basis for treatment is item V, of article 7, and item II, sub-paragraph d, of article 11, both of the LGPD;
Data collected/treated: name, marital status, profession (position), data from personal documents (CPF, RG, parents' names, etc.), data from the Work Card, telephone, address, gender, email address, bank details, name and CPF of dependents, courses and specializations, health information, photo, time, IP address of your device, and any other personal data that may be collected for the purpose of performing the employment contract;
Note. Occasionally, for the execution of Internal People Management Policies, other data not strictly necessary for the execution of the employment contract may be collected. In these cases, the collaborator's consent will always be collected, pursuant to article 7, item I, and article 11, item I, of the LGPD, as the case may be, as well as the need and specificity of data collection for purposes of the project.
Holders who send their résumés to ÁGUAS NEGRAS for the purpose of filing for future or immediate hiring, which is carried out based on the legitimate interest arising from the relationship established between the candidate/holder and the Parent Company. In this case, the legal basis for treatment is item IX, of article 7, of the LGPD;
Data collected/processed: name of the holder, telephone, home and e-mail address, organization in which he works or worked, positions he occupied or occupies, telephone contacts of third parties relevant to the purpose, job claim, dates he worked in certain companies, salary requirements, competences, courses taken, graduation, eventual exchanges, specializations, and other information that the incumbent candidate decides are important to demonstrate his/her competences.
All of the above data may eventually be processed to comply with a legal or regulatory obligation or to guarantee rights in judicial, administrative or arbitration proceedings, pursuant to items II and VI, of article 7, of the LGPD.
Note: ÁGUAS NEGRAS has a Data Protection Agreement that is agreed with all ÁGUAS NEGRAS Clients and partners, which aims to establish the data transfer procedures and the responsibilities pertinent to each of the parties.
Note²: In some cases, ÁGUAS NEGRAS Clients or partners can collect data by obtaining the consent of the holders, and in these cases ÁGUAS NEGRAS has a specific procedure for deleting the data if the consent is revoked, thus guaranteeing the rights of the holders.
Note³: In some cases, the collected data may be shared with contracted third parties, where confidentiality terms and Agreements for Data Protection are agreed, in order to guarantee the security of the shares.
HOW ÁGUAS NEGRAS STORES AND PROCESSS PERSONAL DATA
The personal data processed by ÁGUAS NEGRAS are stored: (i) Internal physical server: Stores files with personal data of all customers, third parties and partners; (ii) Internal physical file: Properly cataloged and protected by security processes that involve access limitations; (iii) Emails: all stored on the server ***[4] .
Personal data eventually stored by ÁGUAS NEGRAS remain retained for a period, which may vary according to the purpose of the processing of personal data and the legal basis used.
After the deadlines contained in the Table[5] present at the end of this document, they are completely excluded from our database.
Personal data will not be excluded if they can be anonymized based on the rules that deal with the subject, especially when necessary for the fulfillment of legal or regulatory obligations by ÁGUAS NEGRAS.
HOW ÁGUAS NEGRAS SHARES PERSONAL DATA
The personal data of the holders may eventually be shared with third parties through the use of third party cookies. We currently identify the sharing of personal data to the following stakeholders:
PipeDrive - commercial CRM
iClips - project management and financial ERP
RD Station - MKT Automation and where we store all leads
Reported - Report generation system
Google Suite
IPM - NFs
Semrush - Digital MKT Data Analysis Platform
Ubersuggest - Digital MKT Data Analysis Platform
Intexfy - Prospecting list generation
Navegg - Generates data about personas
JivoChat - Online Chat
WhatsApp[6]
For more information, you can access our Cookies Policy[7] .
Data is also shared with the Operators described in Clause III, item 2, of this Policy.
DURATION OF STORAGE
The personal data collected by ÁGUAS NEGRAS, in general, are stored while the reasons for which they were collected are in force. You can see specific deadlines in the Table at the end of this document.
USER SPECIFIC RIGHTS
The data subject has specific rights provided for in Article 18 of the LGPD. Thus, you can contact us for the following demands related to your personal data:
right to information
You can ask ÁGUAS NEGRAS whether your data is processed or not, as well as information on how your data is treated. Between them:
a) why personal data are processed;
b) in which categories your data are classified;
c) with what and if your personal data is shared, that is, if it is shared with third parties;
d) how long your personal data will be stored;
e) you can also ask for clarification if there is any automated individual decision-making process, and also how the treatment logic works in this case.
right to correction
You have the right to request from ÁGUAS NEGRAS the complementation, correction, or update of your personal data, in case the data processed are mistaken or incomplete.
Right of anonymization, blocking or deletion of data
You may request ÁGUAS NEGRAS to anonymize, block or delete all data that may be treated in an unnecessary, excessive or non-compliant manner with the LGPD.
The obligation to delete personal data, provided for above, will be carried out when:
personal data are no longer necessary for the purposes for which they were collected and processed;
the revocation of consent by the holder occurs;
the data subject opposes the processing and there are no substantiated reasons for ÁGUAS NEGRAS to continue performing the processing;
personal data is collected illegally;
there is a court or supervisory order for exclusion.
Data portability right
The personal data collected by ÁGUAS NEGRAS may be ported to another service or product provider chosen by the holder, always upon express request.
Data will always be transmitted in a structured, commonly used, machine-readable format.
It is important to highlight that this portability will always be subject to ANPD regulations and must respect commercial and industrial secrets eventually linked to the data.
7. Right of opposition
You have the right to object, at any time, to the processing of your personal data. The opposition will be analyzed within a reasonable period and you will receive a reasoned answer with the acceptance or not of the opposition made.
8. Right to revoke consent
You have the right to revoke your declaration of consent to data processing at any time.
You must be aware that the revocation of consent does not affect the legality of the data processing carried out on the basis of the consent provided before the revocation.
9. Right to Complain to an Authority
You have the right to make complaints directly to ANPD or other inspection bodies, and in these cases, ÁGUAS NEGRAS will respond directly to the inspection body in order to resolve your demand.
COOKIES
Cookies are small files eventually used by ÁGUAS NEGRAS that aim to provide a better experience for users of the virtual pages. To find out more, visit our cookie policy.[8]
INFORMATION SECURITY
ÁGUAS NEGRAS has developed methods to achieve the best practices and market recommendations related to information security.
The following guidelines are an essential part of the way ÁGUAS NEGRAS performs data protection:
Information Security is part of ÁGUAS NEGRAS' strategy and development of procedures, showing itself as an essential part of the work carried out and of the relationships established with clients, partners and third parties;
Prevention as a method of eliminating or mitigating damages in Information Security incidents;
The establishment of concrete disciplinary measures and rules with customers, partners and employees, in order to bring security to data processing;
The constant updating of knowledge and procedures in the team's data protection area, notably aiming to provide products and services that have a minimum potential for incidents;
The continued development of better tools and more linked to Information Security.
COOPERATION WITH REGULATORY AUTHORITIES
Eventually, ÁGUAS NEGRAS will need to share the personal data of ÁGUAS NEGRAS Clients, employees or partners, due to compliance with the law, by reason of a court decision or by order of a supervisory body.
At this time, the information will be disclosed only under the strict terms and within the limits determined by the plaintiff, it is worth noting that the holders, as possible, will be advised of the disclosure, so that, if they feel it necessary, they can take the measures they deem appropriate.
CHANGES
This Policy may be changed at any time, either by force of law or by the need to adapt it to the best practices for data protection.
The changes will be published by ÁGUAS NEGRAS in its official media.
RESPONSIBILITIES
Administrators, employees and contracted third parties
Observe and ensure compliance with this Policy and, when necessary, call the Privacy and Data Protection Officer (DPO) to consult on situations that conflict with this Policy or upon the occurrence of situations described therein.
Board, risk management team and supervisor
Keep this Policy updated based on relevant regulatory/legal changes, ensuring that the rules established herein are complied with;
Clarify doubts regarding this Policy and its application;
Receive complaints and requests from data subjects, provide clarifications and adopt or determine the necessary measures;
Receive and process communications from the National Data Protection Authority (ANPD), or other supervisory bodies, and adopt measures;
Conduct training and guidance of employees and third parties, when hired, on all internal procedures for the protection of personal data.
PENALTIES
Possible institutional penalties for employees who violate the provisions of this Policy include formal warning, suspension and even dismissal.
The other Stakeholders will be notified extrajudicially to correct the verified non-compliance or to break the existing ties with ÁGUAS NEGRAS, always upon assessment of the seriousness and harmful potential of non-compliance with the rules provided for in this document, without prejudice to the application of contractual penalties in other documents stipulated between the parties, and the determination of losses and damages eventually suffered by ÁGUAS NEGRAS.
VALIDITY
This Policy enters into force on the date of its approval by the ÁGUAS NEGRAS Board of Directors, revoking any other documents to the contrary, and may be modified at any time, through publicity by the official means of communication.
Rio do Sul (SC), September 28, 2021.
Para maiores informações, você pode acessar a nossa Política de Cookies
Também são compartilhados dados com os Operadores descritos na Cláusula III, item 2, desta Política.
VII DURAÇÃO DO ARMAZENAMENTO
Os dados pessoais coletados pela ÁGUAS NEGRAS, de maneira geral, são armazenados enquanto estiverem vigentes os motivos pelos quais foram coletados. Você pode consultar os prazos específicos na Tabela contida ao final deste documento.
VIII DIREITOS ESPECÍFICOS DOS USUÁRIOS
O titular de dados conta com direitos específicos previstos no artigo 18 da LGPD. Assim, você pode nos acionar para as seguintes demandas relacionadas aos seus dados pessoais:
1. Direito à informação
Você pode solicitar à ÁGUAS NEGRAS se os seus dados são tratados ou não, bem como informações sobre como os seus dados são tratados. Entre elas:
-
Porque os dados pessoais são tratados;
-
Em quais categorias estão classificados os seus dados;
-
Com que e se os seus dados pessoais são compartilhados, ou seja, se são compartilhados com terceiros;
-
Por quanto tempo seus dados pessoais serão armazenados;
-
Você pode pedir ainda o para que seja esclarecido se existe algum processo de tomada de decisão individual automatizado, e também como funciona a lógica de tratamento neste caso.
2. Direito à retificação
Você tem o direito de requerer junto à ÁGUAS NEGRAS a complementação, a correção, ou a atualização de seus dados pessoais, caso os dados tratados sejam equivocados ou incompletos.
3. Direito de Anonimização, bloqueio ou eliminação de dados
Você poderá solicitar à ÁGUAS NEGRAS a anonimização, o bloqueio ou a eliminação de todos os dados que eventualmente estejam sendo tratados de forma desnecessária, excessiva ou em desconformidade com a LGPD.
A obrigação de eliminação de dados pessoais, acima prevista, será realizada quando:
-
Os dados pessoais não forem mais necessários aos fins para os quais foram coletados e tratados;
-
Ocorrer a revogação do consentimento por parte do titular;
-
O titular dos dados se opor ao tratamento e não existirem motivos fundamentados para que a ÁGUAS NEGRAS continue realizando o tratamento;
-
Os dados pessoais forem coletados de forma ilegal;
-
Existir ordem judicial ou dos órgãos fiscalizadores para exclusão.
4. Direito de portabilidade dos dados
Os dados pessoais coletados pela ÁGUAS NEGRAS poderão ser portados para outro fornecedor de serviços ou produtos à escolha do titular, sempre mediante requisição expressa.
Os dados serão sempre transmitidos em um formato estruturado, comumente usado e legível por máquina.
É importante destacar que esta portabilidade estará sempre condicionada à regulamentação ANPD e deverá respeitar segredos comerciais e industriais eventualmente vinculados aos dados.
5. Direito de oposição
Você tem o direito de se opor, a qualquer momento, ao tratamento de seus dados pessoais. A oposição será analisada em prazo razoável e você receberá resposta fundamentada com o acolhimento ou não da oposição realizada.
6. Direito de revogação de consentimento
Você tem o direito de revogar a sua declaração de consentimento para tratamento de dados a qualquer momento.
Você deve se atentar que a revogação do consentimento não afeta a legalidade do tratamento de dados efetivado com base no consentimento fornecido antes da revogação.
7. Direito de reclamar a uma autoridade
Você possui o direito de efetuar reclamações diretamente à ANPD ou a outros órgãos fiscalizadores, e nestes casos a ÁGUAS NEGRAS responderá diretamente ao órgão fiscalizador com o fim de solucionar a sua demanda.
IX COOKIES
Os Cookies são pequenos arquivos eventualmente utilizados pela ÁGUAS NEGRAS que visam proporcionar uma melhor experiência aos usuários das páginas virtuais. Para saber mais acesse a nossa política de cookies.
X SEGURANÇA DA INFORMAÇÃO
A ÁGUAS NEGRAS desenvolveu métodos para alcançar as melhores práticas e recomendações do mercado relacionadas à segurança da informação.
As diretrizes que seguem são parte essencial da forma como a ÁGUAS NEGRAS realiza proteção de dados:
-
A Segurança da Informação faz parte da estratégia e do desenvolvimento dos procedimentos da ÁGUAS NEGRAS, se mostrando como parte essencial dos trabalhos realizados e das relações estabelecidas com clientes, parceiros e terceiros;
-
A prevenção como método de eliminação ou minoração de danos em incidentes de Segurança da Informação;
-
O estabelecimento de concretas medidas disciplinares e regras com clientes, parceiros e colaboradores, com o fim de trazer segurança ao tratamento de dados;
-
A constante atualização dos conhecimentos e procedimentos na área de proteção de dados da equipe, notadamente objetivando o fornecimento de produtos e serviços que tenham mínimo potencial de incidentes;
-
O desenvolvimento continuado de ferramentas melhores e mais vinculadas à Segurança da Informação.
XI COOPERAÇÃO COM AUTORIDADES REGULADORAS
Eventualmente a ÁGUAS NEGRAS precisará compartilhar os dados pessoais de Clientes ÁGUAS NEGRAS, colaboradores ou parceiros, em razão de cumprimento de lei, por motivo de decisão judicial ou por ordem de órgão fiscalizador.
Neste momento, as informações serão reveladas unicamente nos estritos termos e nos limites determinados pela demandante, valendo destacar que os titulares, conforme possível, serão avisados sobre a divulgação, para que, caso sintam necessário, possam providenciar as medidas que entenderem apropriadas.
XII ALTERAÇÕES
Esta Política poderá ser alterada a qualquer tempo, seja por força de lei ou por necessidade de adequação da mesma às melhores práticas para proteção de dados.
As alterações serão publicadas pela ÁGUAS NEGRAS em seus meios de comunicação oficiais.
XIII RESPONSABILIDADES
Administradores, colaboradores e terceiros contratados
-
Observar e zelar pelo cumprimento da presente Política e, quando assim se fizer necessário, acionar o Encarregado em Privacidade e Proteção de Dados (DPO) para consulta sobre situações que envolvam conflito com esta Política ou mediante a ocorrência de situações nela descritas.
Diretoria, equipe de gestão de risco e encarregado
-
Manter atualizada esta Política com base nas alterações regulatórias/legais pertinentes, garantindo que as regras ora estabelecidas sejam cumpridas;
-
Esclarecer dúvidas relativas a esta Política e à sua aplicação;
-
Receber reclamações e solicitações dos titulares dos dados, prestar esclarecimentos e adotar ou determinar as providências necessárias;
-
Receber e processar comunicações da Autoridade Nacional de Proteção de Dados (ANPD), ou de outros órgãos fiscalizadores, e adotar providências;
-
Realizar treinamento e orientação dos colaboradores e dos terceiros, quando assim contratado, acerca de todos os procedimentos internos para proteção de dados pessoais.
XIV PENALIDADES
As penalidades institucionais possíveis para os funcionários que violarem o disposto nesta Política incluem advertência formal, suspensão e até demissão.
Os demais Stakeholders serão notificados extrajudicialmente para corrigir a desconformidade verificada ou para o rompimento dos vínculos existentes com a ÁGUAS NEGRAS, sempre mediante avaliação da gravidade e potencial danoso do descumprimento das normas previstas neste documento, sem prejuízo da aplicação das penalidade contratuais existentes em outros documentos estipulados entre as partes, e à apuração de perdas e danos eventualmente sofridas pela ÁGUAS NEGRAS.
XV VIGÊNCIA
Esta Política entra em vigor na data da sua aprovação pela Diretoria da ÁGUAS NEGRAS, revogando quaisquer outros documentos em contrário, podendo ser modificada a qualquer tempo, mediante publicidade pelos meios de comunicação oficiais.
Rio do Sul (SC), 28 de setembro de 2021.