PRIVACY POLICY AND PERSONAL DATA PROTECTION
FOR REGISTRATIONS ON THE “EU DIGO X” WEBSITE
This Privacy Policy aims to regulate the collection, use, storage, that is, the treatment of personal or sensitive data (“Personal Data”), as it is defined by Law No. 13,709, of August 14, 2018 – General Data Protection Regulation (“GDPR”), provided by you (“You”), as a registered user on the website owned by the INSTITUTO BUKO KAESEMODEL, a non-profit civil association with non-economic purposes, without political or religious purposes, duly registered on CNPJ / MF under the number 08.925.824 / 0001-84, headquartered in the city of Curitiba, State of Paraná, at 711 Comendador Araújo Street, Batel, Zip code 80.420-000 (“INSTITUTE”).
The website is currently maintained and published by BE ONLINE SERVIÇOS DE INTERNET LTDA., headquartered at 4698 Sete de Setembro Avenue, Room 703, Batel, Zip code 80.420-000, in the City of Curitiba, State of Paraná, registered under the CNPJ No. 11.653.286 / 0001-20, referred to as the operator (“Operator”), while the INSTITUTE is the controller and also the operator.
1. General Information
The purpose of this Privacy Policy is to present to You the commitment that the INSTITUTE has concerning the protection of the Personal Data that it receives, strictly for the purposes described here, as well as to clarify how such data is used.
This Privacy Policy was prepared following the current national legislation, in particular, the Federal Law No. 12,965, of April 23, 2014, (Marco Civil da Internet), the GDPR, and the rules and guidelines of the Autoridade Nacional de Proteção de Dados Pessoais (National Personal Data Protection Authority) (“ANPD”) and is directly linked to the Terms of Use (“Term”) of the website. Both documents are available on the website and can also be requested by e-mail at contato@institutobk.org.br.
Acceptance of the Privacy Policy occurs when, after reading its content in full and the Term, You choose to register on the website. Upon accepting, you agree to the use of your Personal Data for each of the purposes indicated here, without any reservations.
The registration will enable you to participate in the activities developed by the INSTITUTE, according to the purposes described in item “3” of this Privacy Policy.
We emphasize that any registered or unregistered visitors will have access to the downloadable materials, newsletters, booklets, and other content related to Fragile X that are available on the INSTITUTE’s website.
If you are 16 (sixteen) to 18 (eighteen) years old or if for some reason you are permanently or temporarily unable to exercise your civic responsibilities, you can register provided that you are assisted/represented by your parents or by your legal representatives, both when registering and accessing the website.
If during the registration process the Personal Data of children (up to 12 years old) is informed, one of the parents or the legal guardian gives his or her consent when accepting the terms so that the INSTITUTE can process the data only for the purposes indicated in this Privacy Policy.
If you do not agree with the entirety of this Privacy Policy or the Term, You must stop the registration process.
This Privacy Policy may be updated as a result of any regulatory changes and other types of Personal Data not specifically mentioned in this document may be collected, as long as they are provided with your prior consent, or if their collection is allowed or imposed by law.
Whenever there are updates to the Privacy Policy and the Terms of Use, the INSTITUTE will take the necessary steps for communication, as described in item 11 (“Changes”) of this document. In any case, we recommend checking the Term and Privacy Policy periodically, to ensure you are aware of any changes that may happen.
2. Personal Data Collected
Personal Data is collected when You or your legal representative voluntarily enter or submit it when filling out the registration on the website.
The information collected is described in this [LINK] and may be updated at any time. If the data required in this link changes, You or your legal representative will be immediately contacted via the email or phone number provided in your registration and asked to provide additional necessary data, if it is in your interest to keep the registration.
When you access your registration on the website, we obtain information about your network and device, such as your IP address, proxy server, operating system, browser and add-ons, features and device identifier, cookie identifiers, and/or Internet provider or cellphone service provider. Find out more in our Cookie Policy, which can be accessed here [LINK].
Upon completing your registration, your geolocation is collected to better meet your needs, adjusting the health surveys and your intended purposes. We emphasize that this location is only obtained when you complete your registration, there is no monitoring of your location in real-time.
The collection of your Personal Data will take place under the terms in this Privacy Policy and will depend on your consent, which is dispensable only in the cases of exemption foreseen in the GDPR.
3. Purpose of Use of Personal Data
The Personal Data collected has the exclusive purpose of developing studies by the INSTITUTE with partner and supporting institutions, regarding the Fragile X Syndrome (“Fragile X”), generating statistical data, promoting informative activities, developing social inclusion and legal support, in addition to enabling related actions and projects, all linked to the social purpose proposed by the INSTITUTE.
We store your Personal Data while You are registering and accessing the website or, as necessary, to improve your experience on the website and achieve the purposes previously mentioned. This includes data that You or others provide to us and data generated or inferred from your use of the website. The Personal Data obtained will also be used by the Operator to continually improve your experience with the features available on the website.
The INSTITUTE clarifies that any Personal Data shared, detailed in item “7” of this Privacy Policy, in particular the sensitive Personal Data provided by You, whether for research, reporting and statistics, has a strictly social purpose, without any intention of reaping profit. In addition, under no circumstances will Personal Data be released as a result, study or research carried out by the INSTITUTE.
The processing of Personal Data for purposes not foreseen in this Privacy Policy will only occur upon prior communication and with your express consent, and, in any case, the rights and obligations provided herein will remain applicable.
4. Registration and Storage of Personal Data
The Operator will store the Personal Data provided by You, at the request of the INSTITUTE, for as long as necessary to achieve the purposes for which this data was collected, as well as to fulfill any legal, contractual, or required obligations by the authority, among other instances foreseen by law. These data will be immediately deleted or anonymized, in compliance with the applicable legal provisions, when required by the INSTITUTE, except in the cases storage for a longer period is legally allowed.
In order to guarantee the privacy and protection of your Personal Data, the Operator uses encryption both in its database and in the data communications it carries out.
In compliance with article 15, first sentence and paragraphs, of Federal Law 12.965, of April 23, 2014 (Marco Civil da Internet), the records of accesses to the website and the registration will be collected and stored for at least 6 (six) months.
In the case of requests for the elimination of Personal Data before the end of the period set above, the data will be eliminated within 5 (five) business days after the expiration of the period of 6 (six) months legally stated, as mentioned above, except for the hypotheses foreseen that allow the maintenance of the data for a longer period.
Your Personal Data will be kept for as long as you use your account or until You request the deletion or revoke your consent, and can be kept after the end of its management in the following cases:
- For the fulfillment of a legal or regulatory obligation by the Operator, as controller, who is responsible for the decisions regarding the processing of data, under the terms of the GDPR;
- For study by a research agency, with the guarantee, whenever possible, that the personal data will remain anonymous;
- For the transfer to a third party, as long as the data processing requirements provided for in the legislation are respected;
- For the exclusive use of the INSTITUTE, as long as the data is anonymized. Access by a third party is prohibited, except in cases where access is essential for the execution of the services provided by the website.
You have the right to withdraw your consent at any time for the use of your Personal Data, without compromising the lawfulness of the treatment given to them before the withdrawal. The withdrawal of consent may be made through the INSTITUTE’s communication channels and within up to 72 (seventy-two) hours from the time of the contact the elimination of Personal Data will occur, excluding the necessary measures for anonymization, as foreseen in the legislation, as well as the legal instances when storage for a longer period is allowed.
The withdrawal of consent, total exclusion/anonymization of Personal Data will imply the end of the user account.
We store the Personal Data that was informed at the time of the registration after the closing of your account if it is reasonably necessary for the fulfillment of our legal obligations (including requests from the authorities), to satisfy regulatory requirements, resolve disputes, maintain security, prevent fraud and abuses, in addition to other exceptions mentioned in the GPPR.
5. Treatment of Personal Data
Personal Data collected under this Privacy Policy will be accessed and processed only by the INSTITUTE and the Operator, at the request of the INSTITUTE, all within the national territory. Personal Data, however, will be stored on a server hired by the INSTITUTE, located in a foreign territory. You, when providing your Personal Data for registration, expressly agree to the processing and transfer of such data from Brazil to a foreign territory, exclusively for the purposes presented in this Privacy Policy.
It is important to note that these transfers involve only companies that operate in compliance with data protection laws and that provide a degree of protection of Personal Data adequate to that provided for in the GDPR.
Concerning the processing of Personal Data, the rules of protection of the country where they are processed must be followed, with no detriment to the GDPR. Regardless of the place where they will be processed, there will be no transfer of Personal Data to third parties, under any circumstances, without Your prior and express consent.
6. Sharing of Personal Data
The partner companies and/or institutions with which the INSTITUTE maintains a relationship to achieve the purposes described in this document or even the companies it hires to provide services are only authorized to use Personal Data for the specific purposes for which the partnership has been formed or to execute the hired service, and provided that they commit to the same protection offered by the INSTITUTE.
The INSTITUTE is therefore authorized to use the Personal Data provided upon registration and may provide it to partner and supporting companies and/or public or private institutions, always meeting the proposed social purpose, without any intention of earning financial profit.
7. User Rights
The INSTITUTE commits to comply with the rules stated in the current legislation, including, but not limited to, the observance of the rights guaranteed to You, as described below:
- Confirming the processing of personal and sensitive data;
- Accessing collected data;
- Correcting incomplete, inaccurate, or outdated data;
- Anonymizing, blocking, or eliminating unnecessary, excessive, or treated data in non-compliance with the Law;
- Porting data to another service or product provider, upon express request, following the regulations of the national authority, observing commercial and industrial secrets;
- Eliminating personal data processed with the consent of the owner;
- Accessing information from public and private entities with which the controller has shared the use of data;
- Accessing information about the possibility of not consenting and about the consequences of this refusal;
- Revoking consent for data collection and sharing.
To request access, rectification, deletion of your Personal Data, or exercise other rights, You must contact us via email at contato@institutobk.org.br, addressing it to the INSTITUTE.
8. Security in the Processing of Personal Data
It is the responsibility of the server hired by the INSTITUTE and the Operator to apply reasonable technical and organizational measures to preserve Personal Data from unauthorized access and situations of destruction, loss, alteration, communication, or dissemination of such data.
To ensure security, solutions will be adopted that take into account: the appropriate techniques; application costs; the nature, scope, context, and purposes of the treatment; and the risks to your rights and freedoms.
The INSTITUTE disclaims liability for the sole fault of a third party, such as in the event of an attack by hackers or crackers, or at your fault, if You transfer your data to a third party. The INSTITUTE further commits to notify ANPD and You in due time if there is any breach of the security of your Personal Data that could cause a risk to your rights and freedoms.
The breach of Personal Data is a breach of security that causes, accidentally or unlawfully, the destruction, loss, alteration, disclosure, or unauthorized access to personal data transmitted, stored, or subjected to any other type of treatment.
9. Disclaimer of Liability
The INSTITUTE does not offer any guarantee related to the availability, continuity of operation, or infallibility of the website and the tools offered. Also, considering the characteristics of the internet, the INSTITUTE does not guarantee that the use of the website will be uninterrupted, free from problems, errors, and attacks, and, in particular, does not guarantee that unauthorized third parties cannot access and, eventually, intercept, eliminate, alter, modify or manipulate in any way the data present and/or transmitted to its servers.
10. Suspension and Blocking
To optimize the availability of website content, the INSTITUTE may authorize the Operator, for operational and security reasons, to restrict, limit and suspend or totally or partially block, availability and access to the website content.
The INSTITUTE and the Operator, when authorized by the INSTITUTE, may discontinue the availability or distribution of any content, resource, or functionality of the website and its other functionalities, at any time and without the need for prior notice.
11. Changes
The INSTITUTE reserves the right to modify, at any time, the present rules of the Privacy Policy, especially to adapt them to changes of the website, either by making new features available, by deleting or modifying those that already exist, or even in case of a change in the applicable legislation.
In the event of significant changes in this document and in the Terms of Use, with regard to the treatment of Personal Data, including any change in the purpose of use, and which, therefore, require the collection of consent, You will be duly communicated on the website itself, in the social networks of the INSTITUTE, and through your e-mail or registered telephone number, so that you can express new consent regarding the change promoted. In other cases where there are changes in the documents that do not promote changes in the treatment of Personal Data and its purposes, the communication will be carried out through the website and social networks of the INSTITUTE.
We remind you that the Terms and Privacy Policy must be consulted periodically, in order to ensure awareness of any changes that may be promoted.
You will only be able to use the features of your account after expressing your agreement concerning the changes implemented. If you do not agree with any changes, you must not use your account.
12. Applicable Legislation and Forum
To resolve disputes arising from this document, Brazilian law will be fully applied.
Any litigation should be submitted to the Central Forum of the District of the Metropolitan Region of Curitiba, State of Paraná, waiving any other, however privileged it may be.
13. Contact
To answer any questions about the use of your Personal Data or regarding the terms of this Privacy Policy, please contact us by e-mail at contato@institutobk.org.br.