We at Instituto Alana, headquartered at R. Fradique Coutinho, nº 50, 11º andar, Pinheiros, São Paulo – SP, CEP 05416-000, registered with the CNPJ under nº 05.263.071/0001-09 (“Instituto Alana”), we are committed to, in addition to protecting the rights of children and adolescents, to protect their personal data and we want to explain to you about how we use it.
You can contact us to, for example, seek information about how we operate, register for our news mailing list, participate in our direct actions or in partnership with third parties, or to clarify any doubts regarding our initiatives. In order to provide you with this information, we may need some of your personal data. In addition, when you visit our websites, your browser automatically sends us an IP address in order to comply with legal obligations. These are some examples that show how our activities need to use your personal data.
If, after reading this Policy, You still have questions, please feel free to contact us directly with our Data Protection Officer, whose contact channels are at the end of this document.
CHAPTER 1 – DEFINITIONS
Data Privacy
Data privacy focuses on the rights of individuals, the purpose of data collection and processing, privacy preferences and the way organizations control data subjects’ personal data.
Data Security
Data security concerns the means of protection that an organization is adopting to prevent unauthorized third parties from accessing its personal information. It focuses on protecting data from malicious attacks and preventing data exploitation (data breach or cyber attack). It includes access controls, encryption, physical and logical network security, among others.
Holder or You
Natural person to whom the personal data being processed refers.
Personal data
Information relating to the identified or identifiable natural person. Examples of personal data that allow your identification are: name, CPF, RG, address, cell phone, e-mail, etc.
Sensitive Personal Data
Personal information about racial or ethnic origin, religious conviction, political opinion, membership of a union or organization of a religious, philosophical or political nature, data relating to health or sex life, genetic or biometric data, when linked to a natural person. The Alana Institute also considers the importance of classifying the data of children and adolescents as sensitive data, always highlighting the importance of additional control measures involving the entire life cycle of the information, as well as applying the best efforts to promote the use of security mechanisms in place to ensure that such information is stored securely and processed only by authorized persons.
Purpose
Carrying out the processing for legitimate, specific, explicit and informed purposes to the holder, without the possibility of further processing in a way that is incompatible with these purposes.
Need
Limitation of treatment to the minimum necessary for the achievement of its purposes, with coverage of relevant, proportionate and not excessive data in relation to the purposes of data processing.
Treatment
It is the use we make of your personal data, including, but not limited to, the following activities: collection, storage, consultation, sharing, transmission, classification, reproduction, deletion, inactivation, enrichment and evaluation.
Anonymized Data
Data relating to the data subject that cannot be identified, considering the use of reasonable technical means available at the time of its treatment.
Legal Basis
These are the legal hypotheses that authorize us to process personal data for a certain purpose: it may be your consent, the need to fulfill a contract we have with you or compliance with a legal obligation, for example.
Consent
It is the free, informed and unequivocal expression by which the holder agrees to the processing of his personal data for a specific purpose.
Supervisor
It is our Data Protection Officer, who acts as a communication channel between Instituto Alana, data subjects and the National Data Protection Authority (ANPD) when it comes to protecting your personal data.
Policy
It is this Data Privacy Policy.
CHAPTER 2 – COLLECTION AND USE OF PERSONAL DATA
All information requested from users, visitors and employees must be provided consciously and voluntarily through registration forms linked to our portals or through other sites managed by Instituto Alana. We will always be guided by transparency and accessibility when informing about the purpose of the collection and use of personal data through the descriptions of the forms available for obtaining specific consent. When holders register or fill out forms offered by Instituto Alana, including on the portals managed by us, we will record that such information will be securely stored and used only for the stated purpose.
CHAPTER 3 – HOW ALANA INSTITUTE SHARES YOUR PERSONAL DATA
Sometimes, we need to share your personal data with third parties who provide services on our behalf, mainly in the use of auxiliary services to the operation of our websites. Below we describe some situations in which we may share your personal data and, whenever possible, we will do so in the form of anonymized data.
Suppliers
We rely on the help of providers who can process personal data that we collect. The information is disclosed only for the purposes of the services provided. We always seek to carefully evaluate our suppliers and enter into contractual obligations for the protection of personal data and information security with them, with the objective of minimizing risks for the holders. If you have any questions regarding our suppliers, please contact us through the contact channels at the end of this document.
Partners
In addition to suppliers, we may occasionally share personal data with partners, in order to enable a certain action or initiative. In the same way as we do with our suppliers, we make our best efforts to carefully evaluate our partners and enter into contractual obligations for information security and protection of personal data, with the aim of minimizing risks for the holders.
Public Authorities
We will comply with the law. So, if a judge or authority with legal competence requires Instituto Alana to share certain personal data in order, for example, to contribute to an investigation, we will share it. We are against any abuse of authority and, if Instituto Alana understands that an order is abusive, it will always defend the privacy of the holders.
Rights protection
We reserve the right to share any personal data that we believe is necessary to comply with a legal obligation, enforce our terms of use, or protect the rights of Instituto Alana and our employees.
Alana Institute will not sell any data it collects, nor will it use it for the purpose of making a profit.
CHAPTER 4 – PERSONAL DATA OF CHILDREN AND ADOLESCENTS
Instituto Alana will process the personal data of children and adolescents with the prior, specific and highlighted consent of at least their mother, father or legal guardian. There are cases in which Instituto Alana may collect this data without provided consent from the holder, such as cases involving compliance with a legal or regulatory obligation by the controller or the performance of studies by a research body, guaranteeing, whenever possible, the pseudo-anonymization of the sensitive personal data. Instituto Alana undertakes to make all the best efforts to verify that the consent involving the personal data of children and adolescents was given by the person responsible for the child, considering the available technologies. In addition, Instituto Alana will never process this personal data if not for the best interest of the child or adolescent, also emphasizing that under no circumstances will Instituto Alana sell or rent your personal information.
Whenever carrying out the collection and processing of personal data from children and adolescents, the Alana Institute will be guided by the accessibility of information, ensuring that it is understandable not only for mothers, fathers and guardians, but also for the children and adolescents themselves.
CHAPTER 5 – WHAT ARE YOUR RIGHTS AS A PERSONAL DATA HOLDER?
Personal data is yours and Brazilian law guarantees that you have a series of rights related to them. We are committed to fulfilling them and, in this section, we will explain how you can exercise them with Instituto Alana. Brazilian law grants you the following rights:
Confirmation and Access:
Allows You to verify whether Instituto Alana processes your personal data and, if so, request a copy of it.
Correction:
Allows You to request the correction of incomplete, inaccurate or outdated personal data.
Anonymization, blocking or deletion:
Allows You to ask Us to: (a) anonymize Your data so that it can no longer be related to You and therefore ceases to be personal data; (b) block your data, temporarily suspending the possibility of us processing it; and (c) delete your data, in which case we will delete all your data without the possibility of reversal, except as provided by law.
Portability:
You have the right to ask, upon express request, that Instituto Alana provides you, or a third party you choose, with your personal data in a structured and interoperable format, for transfer to another provider, provided that it does not violate the intellectual property or confidentiality of the company’s business.
Sharing information:
You have the right to know the public and private entities with which Instituto Alana makes shared use of data. In any case, if you have questions or want more details, you have the right to ask us for any information.
Information about the possibility of not consenting:
Allows you to have clear and complete information about the possibility and consequences of not providing consent. Your consent, when necessary, must be free and informed. Therefore, whenever we ask for your consent, you are free to deny it – in which case we may have to limit our deliveries to You.
Withdrawal of consent:
You have the right to withdraw your consent in relation to processing activities that are based on consent. However, this will not affect the legality of any processing carried out previously. If you withdraw your consent, we may not be able to provide certain deliveries to you, but we will notify you when this occurs.
Opposition:
The law authorizes the processing of personal data even without your consent. If you do not agree with this treatment, in some cases you may object to it, requesting interruption.
Whenever You exercise your rights, Instituto Alana may request some additional information for the purpose of proving your identity, seeking to prevent fraud. We do this to ensure your security and privacy. Also, some requests may not be responded to immediately, but Instituto Alana is committed to responding to all requests within a reasonable time and always in compliance with applicable legislation.
CHAPTER 6 – SECURITY OF PERSONAL INFORMATION
All personal data collected will be stored on Instituto Alana’s database platforms or in a database stored in external providers through contracts with suppliers. These service providers hired by Instituto Alana will be periodically evaluated and must comply with current data protection legislation.
Instituto Alana and its suppliers are committed to using various security mechanisms, whether physical or logical, with the aim of mitigating the risks involving unauthorized access, unavailability of access and information leakage, thus guaranteeing the integrity and confidentiality of the information transmitted and contributing to the prevention of eventual damages due to the processing of this data.
Instituto Alana has structured internal processes that use security measures and resource monitoring in order to verify vulnerabilities and mitigate risks involving attacks on our platforms. It is worth mentioning that the purpose of these processes is to protect your personal data against unauthorized disclosure, improper changes or even loss of information. Users understand and agree that there is no guarantee that the information cannot be accessed, disclosed, altered or destroyed for breach of any of the physical, technical or administrative safeguards.
CHAPTER 7 – DATA STORAGE
Instituto Alana keeps all collected data, including personal data, stored only while the user’s registration is active or for as long as is necessary to fulfill the purposes for which they were collected, unless there is any other reason for their maintenance, as compliance with any legal, regulatory, contractual, among others, obligations, as long as they are on a legal basis.
Personal data may be deleted from our platforms upon request for deletion sent by the holder. Instituto Alana reserves the right to use validation mechanisms when there are requests for access to personal data, deletion or other changes that may compromise the stored information. This validation has the main purpose of guaranteeing the identity of the holder when contacting us.
After removing the data, if the user wants to resume receiving emails, accessing events or other campaigns developed by Instituto Alana, a new registration must be made.
CHAPTER 8 – DOES ALANA INSTITUTE TRANSFER PERSONAL DATA TO OTHER COUNTRIES?
Some of our suppliers have their servers located outside Brazil, so in order to store your data, for example, we need to transfer it to other countries. These transfers only involve companies that demonstrate compliance with, or are in the process of complying with, applicable data protection laws and maintain a similar or stricter level of compliance than provided for in applicable Brazilian legislation.
CHAPTER 9 – HOW DO I TALK ABOUT PERSONAL DATA WITH THE ALANA INSTITUTE?
If you believe that your personal data has been treated in a way that is incompatible with this Policy or with your choices as the holder of your personal data, or if you have any questions, suggestions or comments related to this Policy and the way in which we treat your personal data, contact us. We have a data protection officer who is on hand. To do this, click on the “Privacy Contacts” button located in the lower left corner or look for us at the address below:
CORRESPONDENCE ADDRESS:
R. Fradique Coutinho, nº 50, 11º andar, Pinheiros, São Paulo – SP, CEP 05416-000DPO: Marcos Moreira
E-MAIL: contato.dpo@alana.org.br