Privacy and Data Protection Policy
Courtesy translation. In case of any discrepancy, the Portuguese version prevails.
Version 1.0. This Policy explains how EISENBERG ASSESSORIA EMPRESARIAL LTDA, CNPJ 39.390.236/0001-17, operator of the Assessoria ME brand, processes personal data on the listings Platform, in accordance with Brazilian Law 13,709/2018 (LGPD) and, for data subjects in the European Union, Regulation (EU) 2016/679 (GDPR).
1. Controller and data protection officer
1.1. The data controller is EISENBERG ASSESSORIA EMPRESARIAL LTDA, Rua da Tilápia, 16, Precabura, Eusébio, State of Ceará, Brazil, ZIP code 61.773-710.
1.2. The data protection officer can be reached at privacidade@assessoriame.com.br.
2. Data processed and purposes
| Data | Purpose | Legal basis (LGPD, art. 7) |
|---|---|---|
| Name, e-mail, tax ID (CPF or CNPJ), company name | Registration, identification and delivery of credentials | Performance of contract (V) |
| CIS, KYC and attached documents | Compliance review, identity verification and verification of authority to represent | Performance of contract (V) and legitimate interest (IX) |
| Photo or logo, description and role | Displaying the profile to Members | Performance of contract (V) |
| Listing content and expressions of interest | Introduction of the parties by Assessoria ME | Performance of contract (V) |
| IP address, date and time of logins, acceptances and views | Security, compliance with the Brazilian Internet Civil Framework and evidence of Introduction | Legal obligation (II) and regular exercise of rights (VI) |
2.1. Identity document data contained in the CIS or KYC are seen only by the Assessoria ME compliance team and are not displayed to other Members.
3. Sharing
3.1. Assessoria ME does not sell personal data. Data may be shared only:
- with the counterparty to a transaction, to the extent necessary for the introduction and under the conduct of Assessoria ME;
- with hosting, e-mail and electronic signature service providers, bound by confidentiality;
- with authorities, when required by law or court order;
- with lawyers and arbitral institutions, for the defense of rights.
4. International transfer
4.1. Since the Platform serves members in Brazil and abroad, data may be transferred to other countries when necessary for the introduction requested by the data subject (LGPD, art. 33, V, and GDPR, art. 49).
5. Retention
5.1. Data are kept while the registration is active and, after removal, for the longest of: the non-circumvention and confidentiality obligations, the applicable limitation periods or the legal retention periods.
5.2. Access logs are kept for at least 6 months (Law 12,965/2014, art. 15).
6. Security
6.1. Uploaded documents are stored outside the public area of the server, under random file names, with access restricted to authorized staff.
6.2. Passwords are stored using irreversible encryption. The Platform temporarily blocks access after repeated failed login attempts.
6.3. In the event of a relevant security incident, Assessoria ME will notify the affected data subjects and the Brazilian National Data Protection Authority, under article 48 of the LGPD.
7. Data subject rights
7.1. Data subjects may request, through the data protection officer's e-mail: confirmation of and access to their data, correction, anonymization or deletion of unnecessary data, portability, information on sharing and review of decisions (LGPD, art. 18; GDPR, arts. 15 to 22).
7.2. Deletion may be refused for data that must be kept due to a legal obligation or for the exercise of rights, including evidence of Introduction.
7.3. Data subjects may file a complaint with the Brazilian National Data Protection Authority (ANPD) or with the authority of their country of residence.
8. Cookies
8.1. The Platform uses only cookies necessary to keep the login session and secure access.
9. Amendments
9.1. This Policy may be updated. Relevant changes will be notified by e-mail or on the Platform. In case of discrepancy between versions, the Portuguese version prevails.