Personal Data Processing Policy – DPA
Rules for processing personal data and responsibilities among HABORA, Customers and users, including sub-processors.
- Version
- 1.0
- Published on
- July 1, 2026
- Last updated
- July 1, 2026
- Next scheduled review
- July 1, 2027
1. Purpose
This Policy establishes rules for the processing of personal data by HABORA in the context of service provision, clarifying responsibilities among HABORA, Customers and users.
2. Roles
HABORA may act as controller for registration, billing, support, security and relationship data, and as processor for personal data entered by the Customer into documents, contracts, properties, reports and operational modules.
3. Customer instructions
When acting as processor, HABORA shall process data according to the Customer's instructions, the contracted features, the Terms of Use, this Policy and applicable law.
4. Customer obligations
The Customer must hold a legal basis for the data submitted, inform data subjects when necessary, grant access only to authorized persons, review permissions, respond to data subject requests when it is the controller, and not enter prohibited or unnecessary data.
5. HABORA obligations
HABORA shall process data according to legitimate purposes, protect data, limit internal access, keep logs, use appropriate sub-processors, cooperate with reasonable requests and adopt proportionate security measures.
6. Sub-processors
HABORA may use providers of cloud, authentication, payment, storage, email, WhatsApp, AI, monitoring, analytics, support and infrastructure. Sub-processors must be chosen considering security, reliability and operational necessity.
7. International transfer
Data may be processed outside Brazil by global suppliers. HABORA shall seek mechanisms compatible with applicable law and appropriate protection measures.
8. Data subject rights
HABORA shall assist the Customer, to the applicable and reasonable extent, in handling data subject requests related to access, correction, deletion, portability, information and review.
9. Incidents
In the event of an incident involving data processed as processor, HABORA shall notify the Customer when necessary, cooperating with investigation, mitigation and legal compliance.
10. Retention and disposal
Data shall be retained or disposed of in accordance with the Data Retention, Backup and Deletion Policy, legal obligations, the contract and the need to defend rights.
Contact
Questions, legal requests, privacy requests, formal communications and requests related to this policy should be sent to juridico@haborahub.com.br.
Updates
This policy may be revised to reflect legal, regulatory, technical, commercial or operational changes. The current version will remain available in the HABORA Compliance area. Material changes may require new acceptance by users, where applicable.