Data protection notice - Hevea Flow Produtor
Thank you for choosing us and for trusting us with the Processing of your Personal Data.
We want you to know, clearly and directly, which Personal Data we have access to, what we do with it and how we keep it protected. We recommend that you read this notice carefully and, if you have any questions, feel free to contact us – it is always a pleasure to help! Just send a message to privacidade@heveaflow.com.br.
Who are we?
We are SnapSystems Projeto de Software Ltda. ("SnapSystems"), a private legal entity headquartered at Avenida Paulista, 2202, Conj. 61, 6th floor, Bela Vista, São Paulo (SP), Brazil, ZIP code 01310-932, registered with the Brazilian corporate taxpayer registry (CNPJ) under number 07.343.014/0001-57, developer of the Hevea Flow platform.
We are a company dedicated to supporting natural rubber producers.
Definitions
For the purposes of this Notice, the following words, written in capital letters or with an initial capital, will have the meanings defined below:
NATIONAL DATA PROTECTION AUTHORITY (ANPD): the Brazilian National Data Protection Authority, the public administration body responsible for overseeing, implementing and enforcing compliance with the LGPD throughout Brazil;
DATA PROTECTION NOTICE ("NOTICE"): also known as the Privacy Policy, the Data Protection Notice is this document, prepared to provide transparency about the Processing of Personal Data, as well as to highlight the rights of Data Subjects, how to exercise them and how to contact the Data Protection Officer;
LEGAL BASES: the legal grounds that authorize SnapSystems to Process Personal Data. They may be, for example, the Data Subject's consent, SnapSystems' legitimate interest, the need to perform a contract to which the Data Subject is a party, or compliance with a legal obligation;
PERSONAL DATA CONTROLLER OR CONTROLLER: a natural or legal person, governed by public or private law, responsible for decisions regarding the processing of personal data;
PERSONAL DATA OR DATA: any information related to an identified or identifiable natural person, that is, information that could be used, directly or indirectly, alone or in combination, to identify a natural person, such as name, CPF (Brazilian individual taxpayer number), RG (Brazilian ID card), email, telephone, address, consumption profile, etc.;
SENSITIVE PERSONAL DATA: Personal Data related to intimate aspects of a person's life that may lead to discrimination. Examples: data on racial or ethnic origin, data on religious beliefs or political opinions, genetic or biometric data and health-related data, data relating to a person's sexual orientation;
DATA PROTECTION OFFICER: also known as DPO, the person we appoint to act as a communication channel with Data Subjects and the ANPD;
SECURITY INCIDENT: an adverse event, confirmed or suspected, related to the security of computer systems or computer services;
LGPD: the Brazilian General Data Protection Law – Law No. 13,709 of August 14, 2018 – which governs the processing of Personal Data in digital or physical media by natural persons or legal entities, governed by public or private law, with the aim of protecting Personal Data Subjects while allowing data to be used for various purposes, balancing interests and harmonizing the protection of the individual with technological and economic development;
PERSONAL DATA PROCESSOR OR PROCESSOR: a natural or legal person, governed by public or private law, that processes personal data on behalf of the controller;
DATA SUBJECT: the natural person (individual) to whom the Personal Data being Processed refers. For the purposes of this Notice, everyone who accesses our services, whether Users and/or potential Users of the services offered, is a Data Subject for legal purposes;
PROCESSING: any operation carried out with Personal Data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination or extraction; and
USER: a natural person who uses our services in Hevea Produtores, that is, you, our customer.
HOW WE PROCESS YOUR DATA
In Hevea Produtores, we Process Personal Data on behalf of Producers and Rubber Tappers, for the purposes determined by the Producers. Therefore, in these activities, we usually act as Processors, processing data for the purposes summarized in the table below:
| Processing Activity | Personal Data | Purpose |
|---|---|---|
| Registration of Rubber Tappers by the Producer | Photo, name, email, telephone, CPF, age, gender, indicator (assessment), legal status of the partnership, references | Allow the Producer to manage their partner Rubber Tappers more efficiently |
| User registration | User's first name, last name, email, telephone, CPF | Allow third parties to use the Hevea Produtores app |
| Task registration | First name, last name, photo | Allow the task to be created |
| Rubber Tapper assessment | First name, last name, photo, property, Rubber Tapper assessment | Enable the Producer to assess the Rubber Tapper's work |
| Tapping record | First name, last name and geolocation of the Recorder and first name, last name and photo of the Rubber Tapper | Enable the Producer to monitor tapping frequency |
| Collection and Weighing | Rubber Tapper's first name, last name and photo | Allow the Producer to collect and weigh the latex |
| Tapping frequency | Number of tappings completed, lost and excused by the Rubber Tapper during a given period of the harvest | Allow the rubber tapper's tapping frequency in the period to be calculated |
In some cases, we will be controllers of the Personal Data Processed. In these cases, we will process the data for the purposes described below:
| Processing Activity | Personal Data | Purpose | Legal Basis | When/How will the Data be collected? |
|---|---|---|---|---|
| System improvement | Depends on the improvement made | Enable adjustments and improvements to Hevea Produtores | Performance of the Contract/Regular Exercise of Rights | Extracted during the use of Hevea Produtores |
| Research related to tapping quality and data modeling | Users' geolocation data, assessment data, tapping frequency data (data from the "Tapping Frequency" process) and other data required for the research or modeling | Enable the identification of metrics and data related to tapping quality and the Rubber Tapper's productivity | Legitimate Interest/Regular Exercise of Rights provided for in the contract | Extracted during the use of Hevea Produtores |
| Producer registration | First name, last name, telephone, email, password, CPF | Enable the Producer to register in the app | Preliminary Procedures Related to the Contract | Provided by the Producer |
| Audit log | Date/time of certain system operations | Help our support team interpret any issues in the use of the app | Compliance with a Legal Obligation/Regular Exercise of Rights | Collected during the use of the system |
WHO DO WE SHARE YOUR DATA WITH?
When necessary, we may share your Data with our business partners, such as rubber tappers, service providers, suppliers, authorities and regulatory bodies, for different purposes. We will always share your Data in compliance with applicable law, especially the LGPD, as well as within the limits of our business model.
INTERNATIONAL DATA TRANSFER
We may transfer your Data to other countries, for example when it is stored on cloud computing servers located outside Brazil. We guarantee compliance with the requirements established by the LGPD, as well as good security practices to ensure the integrity and confidentiality of your Data.
HOW WE PROTECT YOUR PERSONAL DATA
We are committed to adopting the best market standards to protect your Personal Data against accidental or unlawful destruction, loss, alteration, communication or any form of improper, unlawful or discriminatory Processing of information.
Access to stored Data is restricted to authorized and qualified professionals, within the limits needed to perform their duties. We guarantee that these professionals are bound by confidentiality obligations and that we assess partners and suppliers before hiring them, to ensure that we only build relationships with those who also care about Personal Data protection.
As part of our Program, we have a structured internal process to act in the event of Security Incidents. As part of it, and among other measures, we undertake to inform you and the Personal Data protection authorities of any security incident that may pose a significant risk or harm, within a reasonable period, justifying any delay in the communication.
It is important to stress that your active participation is essential for effective Data protection. We therefore recommend that you take care of your access passwords, not sharing them with third parties, and that you count on us to understand and ensure your rights.
YOUR RIGHTS AS A DATA SUBJECT
Below we explain which data protection rights you have and how you can exercise them:
| RIGHT | DESCRIPTION |
|---|---|
| Confirmation and Access | You may ask us to confirm whether we Process your Personal Data and, if so, request a copy of it. |
| Correction | You may request the correction of your Data if you find it incomplete, inaccurate or out of date. |
| Anonymization, blocking or deletion | If you find that we process your Personal Data unnecessarily or excessively, you may ask us to: (a) anonymize your Data, so that it can no longer be linked to you; (b) block your Data, temporarily suspending our ability to process it; or (c) delete your Data, in which case we will erase all your Data irreversibly, except in cases provided for by law. |
| Withdrawal of consent | If you have given your consent to the Processing of any Personal Data, you may request the withdrawal of this authorization at any time. Withdrawal may make it impossible to use some features of our services. In addition, withdrawal of consent does not prevent the use of anonymized Data or the use of Data under another legal basis. |
| Objection | In certain cases, the LGPD authorizes the Processing of Personal Data even without your consent. Even in these situations, we will only process your Personal Data if we have legitimate reasons to do so. If you do not agree with any purpose of the Processing, you may object and request that it stop. |
| Review | You may request a review of decisions made solely on the basis of automated Processing of Personal Data. We will be transparent about these automated decisions, subject to our industrial and trade secrets. |
| Portability | You may ask us to provide your Personal Data in a structured and interoperable format for transfer to a third party, subject to our industrial and trade secrets. |
How can you exercise your rights?
You may exercise any of the rights above by sending a request to privacidade@heveaflow.com.br and then waiting for our reply to process your request.
For your security, whenever you ask to exercise a right, we may request additional information and/or documents to verify your identity. We do this to prevent fraud and ensure your security.
In some cases, we will have legitimate reasons not to fulfill a request to exercise rights. These situations include, for example, cases in which disclosing specific information could violate an industrial or trade secret, whether ours or of third parties to whom we have confidentiality obligations. We may also decline a request if there is legislation requiring us to act in a certain way, for example, by storing personal data for a specific period.
Furthermore, some requests may not be answered immediately, but we undertake to respond to all requests as soon as possible and always in accordance with applicable law.
Note: our apps are designed to allow offline use. This means that all the information you enter on the platform is transferred to the devices of the users you have registered. For this reason, when requesting account and data deletion, it is important that you make sure no copies of the information remain on your devices or on the devices of third parties with whom you have shared it.
HOW TO TALK TO US ABOUT YOUR PERSONAL DATA
If, after reading this Notice, you have any questions, comments, requests or suggestions related to the Processing of your Personal Data, you may contact our Data Protection Officer, Fabio Zarvos. Just send an email to privacidade@heveaflow.com.br. It will be a pleasure to help!
CHANGES TO THE DATA PROTECTION NOTICE
We may update this Notice from time to time or whenever we deem necessary. If a Processing purpose that requires your consent changes, you may withdraw your authorization by contacting us.
By continuing to use our services, you acknowledge that this Notice may change. We invite you to check it periodically.
The Hevea Flow Team