ÁGUAS NEGRAS SA PAPER INDUSTRY

PRIVACY AND DATA PROTECTION POLICY

​

INTRODUCTION

With this Policy, ÁGUAS NEGRAS aims to demonstrate the procedures and care it takes to ensure the privacy, protection of personal data and the security of the information of its customers, employees and partners.

As you can see, all data from individuals is properly processed and protected, all as provided below.

CONCEPTS AND ACRONYMS

LGPD: General Data Protection Law (Law 13.7019/2018);

ANPD: National Data Protection Agency;

Client/Holder/Consumer: Natural person to whom the personal data that are the object of processing refer;

ÁGUAS NEGRAS Client: Individual or legal entity that hires ÁGUAS NEGRAS services;

Controller: Natural or legal person, under public or private law, who are responsible for decisions regarding the processing of personal data;

Operator: Natural or legal person, under public or private law, who processes personal data on behalf of the controller;

Person in Charge: Person appointed by the controller to act as a communication channel between the controller, the data subjects and the National Data Protection Authority (ANPD);

Personal data: Information that can be linked to the identified or identifiable natural person (art. 5, item I, of the LGPD). Examples: name, marital status, profession, date of birth, personal documents (CPF, RG, CNH, Work Card, passport, voter registration, etc.), residential or business address, telephone, email, cookies and address IP;

Sensitive personal data: Personal data (information) that fits the definitions of subsection II of Article 5 of the LGPD. Personal data with the greatest potential harm in the event of an incident;

Information: Data, in a broad sense, contained in any and all media, support or format, which can be used for the production and transmission of knowledge;

Data processing: Any operation performed with personal data, such as those relating to the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation or control of information, modification , communication, transfer, broadcast or extraction;

Data Sharing: Transfer of personal data between ÁGUAS NEGRAS, ÁGUAS NEGRAS Clients and partners/third parties;

Legal basis: Legal basis provided for in the LGPD that makes the processing of personal data legitimate;

Consent: Express, unambiguous and specific authorization, given by the holder of personal data so that their personal data can be processed by ÁGUAS NEGRAS;

Privacy and Data Protection: Concept that deals with the act of using personal data and sensitive personal data without causing discrimination or damage of any kind to its holder. It will always be related to the existence, creation and implementation of laws, procedures, internal rules and policies that aim to guarantee the rights of data subjects in the form of the LGPD;

Stakeholders: These are all relevant audiences with interests relevant to ÁGUAS NEGRAS, or even individuals, community or entities that assume some type of risk, direct or indirect, in the face of the company;

Third parties: Natural or legal person that provides services or has a partnership agreement with ÁGUAS NEGRAS, on its premises or remotely, and in the exercise of their activities may have access to information regarding data subjects that are handled by ÁGUAS NEGRAS or by ÁGUAS NEGRAS Clients.

NAME AND CONTACTS OF CONTROLLER, OPERATOR AND IN CHARGE

CONTROLLER

ÁGUAS NEGRAS will be the Controller, for the purposes of the LGPD, when the personal data processed are collected directly by it. In this case, the information from the Parent Company follows:

ÁGUAS NEGRAS SA PAPER INDUSTRY

CNPJ: 82,757,907/0001-64

Address: Avenida Brasil, nº 1005, Municipality of Ituporanga, State of Santa Catarina, CEP. 88,400-000.

Contact email: ***

OPERATOR

ÁGUAS NEGRAS will have some partners as Data Operators, for the purposes of the LGPD, always with the aim of enhancing the quality of its services and data management, which are as follows:

a) DELSOFT SISTEMAS LTDA.

CNPJ: 73.593.857/0001-36

Address: Rua General Osório, nº 220 and 222, Bairro, Jardim América, Rio do Sul - SC, CEP. 89,160-224.

Contact email: daniel.scheidt@delsoftsistemas.com.br

******[1]  

IN CHARGE

The person who acts as Manager, under the terms of the LGPD, within the general scope of this Privacy and Data Protection Policy is:

MULLER KIRCHNER E SOUZA ADVOCACIA EMPRESARIAL

CNPJ: 04.690.321/0001-16

Address: Alameda Aristiliano Ramos, nº 1091, 1st Floor, Bairro Jardim América, Municipality of Rio do Sul - SC, CEP. 89,160-240.

Contact email: eucio@mks.adv.br

Note: The holder who intends to contact ÁGUAS NEGRAS to claim any of the rights provided for in the LGPD, must make contact through the above mentioned communication channels relating to the Person in Charge or through the Communication Channel with the Holder [2] contained in the virtual page of the BLACK WATERS.

HOW AGUAS NEGRAS COLLECTS DATA, HOW IT IS TREATED AND WHICH LEGAL BASIS IS USED

ÁGUAS NEGRAS handles the processing of personal data:

Owners, partners, employees, representatives or agents of legal entities for prospecting purposes, always through the collection of consent. In this case, the legal basis for treatment is item I, of article 7, of the LGPD, so that the holder can exercise his right to revoke the consent at any time;

Data collected/treated: name, profession/position in the company, telephone (landline or mobile - Whatsapp), gender, organization in which they work, email address, address of the company where the person works, and any other data personnel that can be collected for prospecting purposes.

Owners, partners, employees, representatives or agents of legal entities that are partners or provide services for ÁGUAS NEGRAS. In this case, the legal basis for treatment is item V, article 7, of the LGPD;

Data collected/treated: name, marital status, CPF, RG, profession, telephone, address, gender, organization in which you work, position held in the company, email address, telephone (landline or cell phone - WhatsApp), and any other personal data that may be collected for the purpose of performing the contract;

Partners, administrators, employees, representatives or agents for the purpose of executing service contracts agreed with ÁGUAS NEGRAS Clients. In this case, the legal basis for treatment is item V, article 7, of the LGPD;

Data collected/treated: name, marital status, CPF, RG, profession, telephone, address, gender, organization in which you work, position held in the company, email address, telephone (landline or cell phone - Whatsapp), and any other personal data that may be collected for the purpose of performing the contract;

Owners who register on ÁGUAS NEGRAS' virtual pages in order to receive information, news feeds or promotional and informative materials, which is carried out based on the legitimate interest of the Parent Company, considering the understanding that the registration by the part of the holders represents the emergence of an obligation to be fulfilled by ÁGUAS NEGRAS, so the legitimate interest in complying with the obligation assumed before the holder shows a direct relationship with the legal permission in question. In this case, the legal basis for treatment is item IX, of article 7, of the LGPD;

Data collected/treated: user name, telephone, city, state, organization that works, position held, corporate email address or region where the site is being accessed, browser type, system operational, the reference site visited, the pages, the history, the time of access to the site[3] .

Of partners, administrators, collaborators, representatives or agents of ÁGUAS NEGRAS, for the purpose of executing the employment contract. In this case, the legal basis for treatment is item V, of article 7, and item II, sub-paragraph d, of article 11, both of the LGPD;

Data collected/treated: name, marital status, profession (position), data from personal documents (CPF, RG, parents' names, etc.), data from the Work Card, telephone, address, gender, email address, bank details, name and CPF of dependents, courses and specializations, health information, photo, time, IP address of your device, and any other personal data that may be collected for the purpose of performing the employment contract;

Note. Occasionally, for the execution of Internal People Management Policies, other data not strictly necessary for the execution of the employment contract may be collected. In these cases, the collaborator's consent will always be collected, pursuant to article 7, item I, and article 11, item I, of the LGPD, as the case may be, as well as the need and specificity of data collection for purposes of the project.

Holders who send their résumés to ÁGUAS NEGRAS for the purpose of filing for future or immediate hiring, which is carried out based on the legitimate interest arising from the relationship established between the candidate/holder and the Parent Company. In this case, the legal basis for treatment is item IX, of article 7, of the LGPD;

Data collected/processed: name of the holder, telephone, home and e-mail address, organization in which he works or worked, positions he occupied or occupies, telephone contacts of third parties relevant to the purpose, job claim, dates he worked in certain companies, salary requirements, competences, courses taken, graduation, eventual exchanges, specializations, and other information that the incumbent candidate decides are important to demonstrate his/her competences.

All of the above data may eventually be processed to comply with a legal or regulatory obligation or to guarantee rights in judicial, administrative or arbitration proceedings, pursuant to items II and VI, of article 7, of the LGPD.

Note: ÁGUAS NEGRAS has a Data Protection Agreement that is agreed with all ÁGUAS NEGRAS Clients and partners, which aims to establish the data transfer procedures and the responsibilities pertinent to each of the parties.

Note²: In some cases, ÁGUAS NEGRAS Clients or partners can collect data by obtaining the consent of the holders, and in these cases ÁGUAS NEGRAS has a specific procedure for deleting the data if the consent is revoked, thus guaranteeing the rights of the holders.

Note³: In some cases, the collected data may be shared with contracted third parties, where confidentiality terms and Agreements for Data Protection are agreed, in order to guarantee the security of the shares.

HOW ÁGUAS NEGRAS STORES AND PROCESSS PERSONAL DATA

The personal data processed by ÁGUAS NEGRAS are stored: (i) Internal physical server: Stores files with personal data of all customers, third parties and partners; (ii) Internal physical file: Properly cataloged and protected by security processes that involve access limitations; (iii) Emails: all stored on the server ***[4] .

Personal data eventually stored by ÁGUAS NEGRAS remain retained for a period, which may vary according to  the purpose of the processing of personal data and the legal basis used.

After the deadlines contained in the Table[5]  present at the end of this document, they are completely excluded from our database.

Personal data will not be excluded if they can be anonymized based on the rules that deal with the subject, especially when necessary for the fulfillment of legal or regulatory obligations by ÁGUAS NEGRAS.

HOW ÁGUAS NEGRAS SHARES PERSONAL DATA

The personal data of the holders may eventually be shared with third parties through the use of third party cookies. We currently identify the sharing of personal data to the following stakeholders:

PipeDrive - commercial CRM

iClips - project management and financial ERP

RD Station - MKT Automation and where we store all leads

Reported - Report generation system

Google Suite

IPM - NFs

Semrush - Digital MKT Data Analysis Platform

Ubersuggest - Digital MKT Data Analysis Platform

Intexfy - Prospecting list generation

Navegg - Generates data about personas

JivoChat - Online Chat

WhatsApp[6] 

For more information, you can access our Cookies Policy[7] .

Data is also shared with the Operators described in Clause III, item 2, of this Policy.

DURATION OF STORAGE

The personal data collected by ÁGUAS NEGRAS, in general, are stored while the reasons for which they were collected are in force. You can see specific deadlines in the Table at the end of this document.

USER SPECIFIC RIGHTS

The data subject has specific rights provided for in Article 18 of the LGPD. Thus, you can contact us for the following demands related to your personal data:

right to information

You can ask ÁGUAS NEGRAS whether your data is processed or not, as well as information on how your data is treated. Between them:

a) why personal data are processed;

b) in which categories your data are classified;

c) with what and if your personal data is shared, that is, if it is shared with third parties;

d) how long your personal data will be stored;

e) you can also ask for clarification if there is any automated individual decision-making process, and also how the treatment logic works in this case.

right to correction

You have the right to request from ÁGUAS NEGRAS the complementation, correction, or update of your personal data, in case the data processed are mistaken or incomplete.

Right of anonymization, blocking or deletion of data

You may request ÁGUAS NEGRAS to anonymize, block or delete all data that may be treated in an unnecessary, excessive or non-compliant manner with the LGPD.

The obligation to delete personal data, provided for above, will be carried out when:

personal data are no longer necessary for the purposes for which they were collected and processed;

the revocation of consent by the holder occurs;

the data subject opposes the processing and there are no substantiated reasons for ÁGUAS NEGRAS to continue performing the processing;

personal data is collected illegally;

there is a court or supervisory order for exclusion.

Data portability right

The personal data collected by ÁGUAS NEGRAS may be ported to another service or product provider chosen by the holder, always upon express request.

Data will always be transmitted in a structured, commonly used, machine-readable format.

It is important to highlight that this portability will always be subject to ANPD regulations and must respect commercial and industrial secrets eventually linked to the data.

7. Right of opposition

You have the right to object, at any time, to the processing of your personal data. The opposition will be analyzed within a reasonable period and you will receive a reasoned answer with the acceptance or not of the opposition made.

8. Right to revoke consent

You have the right to revoke your declaration of consent to data processing at any time.

You must be aware that the revocation of consent does not affect the legality of the data processing carried out on the basis of the consent provided before the revocation.

9. Right to Complain to an Authority

You have the right to make complaints directly to ANPD or other inspection bodies, and in these cases, ÁGUAS NEGRAS will respond directly to the inspection body in order to resolve your demand.

COOKIES

Cookies are small files eventually used by ÁGUAS NEGRAS that aim to provide a better experience for users of the virtual pages. To find out more, visit our cookie policy.[8] 

INFORMATION SECURITY

ÁGUAS NEGRAS has developed methods to achieve the best practices and market recommendations related to information security. 

The following guidelines are an essential part of the way ÁGUAS NEGRAS performs data protection:

Information Security is part of ÁGUAS NEGRAS' strategy and development of procedures, showing itself as an essential part of the work carried out and of the relationships established with clients, partners and third parties;

Prevention as a method of eliminating or mitigating damages in Information Security incidents;

The establishment of concrete disciplinary measures and rules with customers, partners and employees, in order to bring security to data processing;

The constant updating of knowledge and procedures in the team's data protection area, notably aiming to provide products and services that have a minimum potential for incidents;

The continued development of better tools and more linked to Information Security.

COOPERATION WITH REGULATORY AUTHORITIES

Eventually, ÁGUAS NEGRAS will need to share the personal data of ÁGUAS NEGRAS Clients, employees or partners, due to compliance with the law, by reason of a court decision or by order of a supervisory body.

At this time, the information will be disclosed only under the strict terms and within the limits determined by the plaintiff, it is worth noting that the holders, as possible, will be advised of the disclosure, so that, if they feel it necessary, they can take the measures they deem appropriate.

CHANGES

This Policy may be changed at any time, either by force of law or by the need to adapt it to the best practices for data protection.

The changes will be published by ÁGUAS NEGRAS in its official media.

RESPONSIBILITIES

Administrators, employees and contracted third parties

Observe and ensure compliance with this Policy and, when necessary, call the Privacy and Data Protection Officer (DPO) to consult on situations that conflict with this Policy or upon the occurrence of situations described therein.

Board, risk management team and supervisor

Keep this Policy updated based on relevant regulatory/legal changes, ensuring that the rules established herein are complied with;

Clarify doubts regarding this Policy and its application;

Receive complaints and requests from data subjects, provide clarifications and adopt or determine the necessary measures;

Receive and process communications from the National Data Protection Authority (ANPD), or other supervisory bodies, and adopt measures;

Conduct training and guidance of employees and third parties, when hired, on all internal procedures for the protection of personal data.

PENALTIES

Possible institutional penalties for employees who violate the provisions of this Policy include formal warning, suspension and even dismissal.

The other Stakeholders will be notified extrajudicially to correct the verified non-compliance or to break the existing ties with ÁGUAS NEGRAS, always upon assessment of the seriousness and harmful potential of non-compliance with the rules provided for in this document, without prejudice to the application of contractual penalties in other documents stipulated between the parties, and the determination of losses and damages eventually suffered by ÁGUAS NEGRAS.

VALIDITY

This Policy enters into force on the date of its approval by the ÁGUAS NEGRAS Board of Directors, revoking any other documents to the contrary, and may be modified at any time, through publicity by the official means of communication.

Rio do Sul (SC), September 28, 2021.