1What is this Privacy Policy for?
The Brazilian General Data Protection Law (Law No. 13,709 of August 14, 2018, “LGPD”) established requirements and obligations for personal data processing activities, aiming to process data appropriately, protect it from undue access, and prevent leaks or failures that could harm data subjects.
This is the Privacy Policy (“Policy”) of EMFLORA SERVIÇOS E EMPREENDIMENTOS FLORESTAIS LTDA (“EMFLORA”) and it applies to interactions between customers, suppliers and other interested parties and EMFLORA through its official website https://www.emflora.com.br/ (“Platform”). Here we explain how we process the personal data (“Data”) that the website user (“User”) provides to us.
2Definitions
- Personal data: information relating to an identified or identifiable natural person (e.g., name, e-mail, phone, IP address).
- Sensitive personal data: data on racial or ethnic origin, religious belief, political opinion, health, sex life, genetic or biometric data. EMFLORA does not collect sensitive data through the website.
- Data subject: the natural person to whom the Data refers.
- Controller: EMFLORA, responsible for decisions regarding the processing.
- Processor: a third party that processes data on behalf of the controller.
- Data Protection Officer (DPO): the person appointed as the communication channel between EMFLORA, data subjects and the ANPD.
- ANPD: Brazil's National Data Protection Authority.
3When do we collect your Data?
Data is collected when voluntarily entered or submitted by the User when filling in contact forms — for example: (i) Ombudsman; (ii) Work With Us; (iii) other contacts made through the website.
In addition, whenever the User accesses the website, we collect technical browsing information through small files called “cookies” (see section 5).
4What data may be collected?
4.1. Contact and relationship data
Provided by the User when contacting the Ombudsman, Work With Us or other channels. Generally: full name, e-mail address and phone number.
The User may also send data related to applications in recruitment processes, including a résumé. In such cases, the information is used exclusively for recruitment and selection and is deleted within 6 (six) months, unless the candidate authorizes a longer period to participate in new openings.
4.2. Browsing data
Data related to access and activity on the Platform, such as: IP address, device operating system and browser, website sections accessed, interactions performed and other technical data, such as URL information and cookie data.
5Cookies and monitoring technologies
A cookie is a data file stored on the device when using the Platform. We use cookies for different purposes, classified as follows:
- Necessary cookies: essential for the website to function. They do not require consent.
- Analytics cookies: measure how the website is used (pages visited, frequency) in order to improve it. They depend on your consent.
- Advertising cookies: used to display and measure marketing content. They depend on your consent.
6How do we use your Data?
6.1. Contact and relationship data
- Handle requests, questions, complaints and other demands sent to EMFLORA;
- Properly identify the User;
- Conduct recruitment and selection processes (in the case of résumés);
- Send communications of interest to the User, when authorized.
6.2. Browsing data
- Improve the use and experience of our services, contacts and website;
- Produce statistics and studies in anonymized form;
- Safeguard EMFLORA's rights and obligations, including in judicial and administrative measures;
- Comply with court orders or requests from competent authorities.
7Which legal bases do we rely on?
All Data processing by EMFLORA is grounded on one of the legal bases of art. 7 (or art. 11, for sensitive data) of the LGPD:
| Purpose | Legal basis (LGPD) |
|---|---|
| Handling requests and contacts | Preliminary procedures to a contract / legitimate interest (art. 7, V and IX) |
| Recruitment and selection | Preliminary procedures to a contract (art. 7, V) |
| Analytics and advertising cookies | Consent (art. 7, I) |
| Legal obligations and court orders | Legal/regulatory obligation (art. 7, II) |
| Defense in legal proceedings | Regular exercise of rights (art. 7, VI) |
8With whom do we share the Data?
Our database is our responsibility and sharing occurs only within the limits and purposes of our business. In general, we may share Data:
- Among EMFLORA group companies;
- With processors and suppliers that assist us in handling your demands (always bound by contract and duty of confidentiality);
- To comply with court orders or requests from competent authorities.
EMFLORA does not sell Users' Data.
9Where do we store Data and how do we handle transfers?
Data may be stored on our own servers or those of contracted third parties, including in the cloud, located in Brazil or abroad.
10How long is your Data stored?
We store Data only for as long as necessary for the purposes for which it was collected or for as long as we are legally required to keep it.
- Résumés and selection data: up to 6 (six) months;
- Application access logs: minimum of 6 (six) months (art. 15 of the Brazilian Internet Civil Framework);
- Contact and relationship data: for the duration of the service and applicable legal periods.
Once the purpose and legal periods have ended, the Data is deleted or anonymized.
11How do we keep your Data secure?
EMFLORA adopts technical and administrative measures to protect Data against destruction, loss, alteration, disclosure or unauthorized access, including restricted access control and activity logs. Among others, we mitigate risks of:
- Loss or theft of information;
- Unauthorized access, use or disclosure;
- Improper copying, modification or tampering;
- Inadequate retention or destruction;
- Loss of integrity.
12What are your rights?
The LGPD guarantees the data subject, at any time and upon request, the following rights (art. 18):
| Right | What it means |
|---|---|
| Confirmation and access | Know whether we process your Data and obtain a copy of it. |
| Correction | Correct incomplete, inaccurate or outdated Data. |
| Anonymization or deletion | Of unnecessary or excessive Data, or Data processed in violation of the Law. |
| Portability | Request portability of the Data to another provider. |
| Deletion | Of Data processed based on consent, subject to legal retention periods. |
| Information on sharing | Know with which public and private entities we share your Data. |
| Information on denying consent | Know the consequences of denying consent. |
| Withdrawal of consent | Withdraw, at any time, consent previously given. |
| Review of automated decisions | Request review of decisions made solely by automated means (art. 20). |
To exercise any right, contact us at lgpd@emflora.com.br. The data subject may also petition the ANPD directly (art. 18, §1).
13Changes to this Privacy Policy
EMFLORA may change this Policy to reflect legal changes or changes in our practices. In the event of a material change, we will give prior notice through the website, and the updated version takes effect on its publication date. We recommend regularly checking the most recent version, always identified by the update date at the top of this document.
14Data Protection Officer and contact
If you have questions, requests or complaints regarding this Policy or your Data, contact our Data Protection Officer (DPO):
E-mail: lgpd@emflora.com.br
Controller: EMFLORA Serviços e Empreendimentos Florestais Ltda.