Privacy Policy | Casa dos Ventos

Privacy Policy | Casa dos Ventos

Glossary

Processing agents – the controller and the operator.

Internet applications – the set of functionalities that can be accessed via a terminal connected to the internet.

National authority – public administration body responsible for overseeing, implementing, and enforcing compliance with this Law throughout the national territory.

Database – a structured set of personal data, established in one or several locations, in electronic or physical support.

Internet connection – the enablement of a terminal for sending and receiving data packets over the internet, through the assignment or authentication of an IP address.

Controller – natural or legal person, public or private, who is responsible for decisions regarding the processing of personal data.

Personal data – information related to an identified or identifiable natural person. It may include name, surname, nickname, age, residential or electronic address, location data, car license plates, shopping profile, Internet Protocol (IP) number, academic data, purchase history, among others.

Sensitive personal data – personal data concerning racial or ethnic origin, religious conviction, political opinion, trade union membership or membership of a religious, philosophical or political organization, data relating to health or sexual life, genetic or biometric data, when linked to a natural person.

Deletion – exclusion of data or a set of data stored in a database, regardless of the procedure employed.

Data Protection Officer (DPO) – person appointed by the controller and operator to act as a communication channel between the controller, data subjects, and the National Data Protection Authority (ANPD).

Internet – the system consisting of a set of logical protocols, structured on a global scale for public and unrestricted use, with the purpose of enabling data communication between terminals through different networks.

Processor – natural or legal person, public or private, who processes personal data on behalf of the controller.

Data subject – natural person to whom the personal data being processed refers.

Data processing – any operation performed with personal data, such as those related to collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination or extraction.

Shared use of data – communication, dissemination, international transfer, interconnection of personal data or shared processing of personal data databases by public bodies and entities in the exercise of their legal competencies, or between these and private entities, reciprocally, with specific authorization, for one or more types of processing permitted by these public entities, or between private entities.

Guidelines

This Policy is governed by the following principles and obligations:

– Every natural person is assured of the ownership of their personal data and the guarantee of their fundamental rights to freedom;
– The General Data Protection Law applies regardless of the means and/or forms of processing collected or received data;
– The data subject has the right to access information about the processing of their data, in order to determine which data has been processed, which is being shared, and the purpose of the processing.
– Casa dos Ventos will maintain records demonstrating the adoption of processing measures in accordance with the principles established in the LGPD;
– The General Data Protection Law mandates that data subjects' data may only be processed if based on the following principles:

Purpose – the processing of personal data must be carried out for legitimate, specific, explicit, and informed purposes to the data subject, observing the original purposes;

Adequacy – the processing of personal data must be compatible with the purposes informed to the data subject, according to the context of the processing;

Necessity – the processing of personal data must be limited to the minimum necessary for the achievement of its purposes, covering pertinent, proportionate, and non-excessive data in relation to the purposes of data processing;

Free access – data subjects are guaranteed easy and free consultation regarding the form and duration of processing, as well as the integrity of their personal data;

Data quality – data subjects are guaranteed that their data is accurate, clear, relevant, and updated, according to the need and for the fulfillment of the purpose of its processing;

Transparency – data subjects are guaranteed the right to clear, precise, and easily accessible information about the processing and the respective processing agents, observing commercial and industrial secrets;

Security – technical and administrative measures capable of protecting personal data from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication, or dissemination must be used;

Prevention – measures must be adopted to prevent the occurrence of damages due to personal data processing;

Non-discrimination – impossibility of carrying out processing for illicit or abusive discriminatory purposes; and

Accountability and demonstrating compliance – demonstration, by the agent, of the adoption of effective measures capable of proving compliance with personal data protection rules and, including, the effectiveness of these measures;