Privacy and Personal Data Protection Policy – LGPD
How HABORA collects, uses, shares, protects, retains and deletes personal data, and the rights of data subjects under the LGPD.
- Version
- 1.0
- Published on
- July 1, 2026
- Last updated
- July 1, 2026
- Next scheduled review
- July 1, 2027
1. Purpose
This Policy describes how HABORA collects, uses, stores, shares, protects, retains and deletes personal data processed during browsing on public pages, registration, contracting, use of the platform, support, billing, security, AI and integrations.
2. Scope
It applies to visitors, customers, administrator users, invited users, authorized partners, external users, data subjects present in documents uploaded to the platform and other individuals whose data is processed by HABORA.
3. HABORA's roles
HABORA may act as controller with respect to registration data, billing, relationship, security, logs and use of the platform. It may act as processor with respect to personal data entered by the Customer into contracts, documents, records, reports, properties and operational modules, when processed according to the Customer's instructions.
4. Data processed
HABORA may process name, email, phone, WhatsApp, company, tax ID (CNPJ), job title, login data, IP, browser, device, logs, billing data, property data, documents, contracts, reports, financial data, ESG indicators, alerts and information contained in documents uploaded by the Customer.
5. Third-party data in documents
Contracts, certificates, title records, receipts, powers of attorney and documents uploaded by the Customer may contain data of owners, landlords, tenants, guarantors, representatives, attorneys-in-fact, partners, officers, employees and other third parties. The Customer is responsible for holding a legal basis or legitimacy for the upload and processing.
6. Purposes
Data may be used for registration, authentication, account creation, user and permission management, service provision, document organization, AI reading, report generation, alert issuance, support, invoicing, security, auditing, fraud prevention, platform improvement and legal compliance.
7. Legal bases
Processing may rely on performance of a contract, compliance with a legal or regulatory obligation, legitimate interest, regular exercise of rights, credit protection, consent where necessary, fraud prevention, security and other grounds provided for in the LGPD.
8. Sharing
Data may be shared with providers of cloud, authentication, payment, email, WhatsApp, storage, AI, monitoring and support, authorized APIs, auditors, consultants, authorities, public bodies or third parties necessary for service provision and legal compliance.
9. Artificial intelligence
AI may process uploaded documents and data for extraction, classification, organization, summarization, report generation, inconsistencies and alerts. The use of AI shall observe the Artificial Intelligence Policy and the Customer's permissions.
10. Cookies
Cookies and similar technologies shall be handled in accordance with the Cookies Policy. Essential cookies may be necessary for authentication, session, security and operation of the platform.
11. Security
HABORA shall adopt proportionate technical and administrative measures, including access control, per-company segregation, logs, backup, encryption where applicable, authentication, permission review and operational monitoring.
12. Retention
Data shall be kept for the period necessary for service provision, legal compliance, auditing, security, defense of rights, fraud prevention, contractual retention, backup and legitimate purposes. After this period, it may be deleted or anonymized.
13. Data subject rights
Data subjects may request confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about sharing, withdrawal of consent and review of automated decisions, where applicable and within legal limits.
14. International transfer
Providers of cloud, AI, authentication, email or other services may process data outside Brazil. When this occurs, HABORA shall seek to adopt appropriate protection mechanisms compatible with applicable law.
15. Minors
HABORA is intended for business use and is not directed at minors. If inappropriate processing of minors' data is identified, HABORA shall take proportionate measures.
16. Incidents
Should a security incident occur that may pose relevant risk or harm to data subjects, HABORA shall adopt containment, investigation, mitigation and communication measures toward those affected and authorities where required.
17. Contact
Questions, legal requests, privacy requests, formal communications and requests related to this policy should be sent to juridico@haborahub.com.br.
Updates
This policy may be revised to reflect legal, regulatory, technical, commercial or operational changes. The current version will remain available in the HABORA Compliance area. Material changes may require new acceptance by users, where applicable.