Brazil (LGPD) Supplement

The Lei Geral de Proteção de Dados Pessoais (Law 13.709/2018, “LGPD”) applies to our processing of personal data of individuals (titulares) located in the Federative Republic of Brazil. We act as a controlador (controller) for account, billing, and product-usage data, and as an operador (processor) for data you submit to the Service in connection with your customers.

We process personal data on the following legal bases under LGPD Art. 7:

• Execution of contract (Art. 7, V) — providing the Service you have subscribed to.
• Compliance with legal or regulatory obligation (Art. 7, II) — tax, accounting, and law-enforcement requirements.
• Legitimate interest of the controller (Art. 7, IX) — security, fraud prevention, product analytics in aggregate form, subject to the balancing test in Art. 10.
• Consent (Art. 7, I) — for any processing not covered by the above (currently none). Consent is given freely, informed, unambiguous, and may be revoked at any time without prejudice to prior processing.

We do not process “sensitive personal data” (Art. 5, II / Art. 11) and do not engage in automated decision-making with legal effects (Art. 20).

In accordance with LGPD Art. 41 and ANPD Resolution CD/ANPD 2/2022 (which permits small-scale processing agents to designate an internal or shared encarregado), we have designated an Encarregado pelo Tratamento de Dados Pessoais who is the point of contact for the ANPD and for data subjects:

Encarregado: dpo@poigeo.app

If our processing scales to the point that ANPD guidance requires a Brazil-based or full-time encarregado, we will appoint one and publish the change here.

Personal data about Brazilian titulares is transferred to and processed in the European Union and the United States by our sub-processors. We rely on the legitimate-interest and contract-execution bases in Art. 33, IX–X read together with the standard contractual clauses approved by the ANPD (Resolution CD/ANPD 4/2024), and we apply the supplementary technical and organisational measures described in the global Privacy Policy.

• Confirmation of whether we process your data (Art. 18, I).
• Access to your data (Art. 18, II).
• Correction of incomplete, inaccurate, or outdated data (Art. 18, III).
• Anonymisation, blocking, or elimination of unnecessary, excessive, or unlawfully processed data (Art. 18, IV).
• Portability to another service provider (Art. 18, V).
• Elimination of data processed on consent, with the exceptions in Art. 16 (Art. 18, VI).
• Information about public and private entities with whom we have shared your data (Art. 18, VII).
• Information about the option not to consent and the consequences of refusal (Art. 18, VIII).
• Revocation of consent at any time (Art. 18, IX).
• Right to oppose processing carried out in breach of the LGPD (Art. 18, § 2).

We respond to verified requests within fifteen (15) days, free of charge.

The Service is not directed at children. We do not knowingly collect personal data of children under 13 or, where consent of a parent or legal guardian is required for older minors, without that consent. If you become aware of any such processing, contact the encarregado.

We will notify the ANPD and affected titulares of any security incident that may create a relevant risk or damage to the data subjects, within the period considered reasonable under ANPD guidance (currently understood to be within two business days of becoming aware of the incident, per CD/ANPD 15/2024).

You have the right to lodge a complaint with the Autoridade Nacional de Proteção de Dados — gov.br/anpd — at any time. We ask that you contact our encarregado first so that we can try to resolve the matter directly.

Encarregado: dpo@poigeo.app. General privacy queries: privacy@poigeo.app.