1. Purpose
This policy outlines the Organization’s commitment to confidentiality and personal data privacy, and establishes the technical and organizational guidelines for the processing of personal data in accordance with the fundamental rights of freedom, privacy, data protection, and the free development of the natural person’s personality.
If you have any questions or concerns regarding your privacy, the use or processing of your personal data, please contact the Organization’s Data Protection Officer via email at:
encarregado.dados@to-brasil.com
2. How We Collect Personal Data
For all personal data voluntarily provided by you and other data subjects, the Organization follows these principles:
- Only the data strictly necessary to carry out our activities will be collected, in accordance with the informed purpose and based on the legal grounds provided by applicable legislation.
- If your consent is required for the processing of your personal data, it will be requested in advance, with a clear and objective explanation of the purpose.
- Personal data will be processed only for the time necessary to fulfill the purposes for which it was collected.
Below is a summary of the types of data collected by the Organization, according to purpose and legal basis.
2.1. Purposes
Purpose: Applying for a job opportunity at the Organization.
Type of personal data:
-
- Identification and contact data, such as full name, email, address, phone number, or other relevant information.
- Professional and educational data, such as work experience, academic background, additional courses, languages, and other information used to assess your qualifications and alignment with the job requirements.
Legal basis: Data subject’s consent, through voluntary expression. LGPD Art. 7, item I and Art. 8.
Purpose: Internal processes for hiring, transfer, termination, and leave.
Type of personal data:
- Data required to carry out these activities, such as full name, email, address, phone number, or other relevant information.
Legal basis: Contract execution or preparation. LGPD Art. 7, item V.
Purpose: Internal performance and development processes – recording performance evaluations and training provided to employees.
All online evaluations and training sessions may capture image and voice of participants. Trainings are recorded and shared on the intranet.
Type of personal data:
- Data required to carry out these activities, such as full name, email, image, and voice (during video conference interviews).Type of sensitive personal data:
- Data required to conduct remote training via videoconference, including photo, video, and voice.
Legal basis: Data subject’s consent. LGPD Art. 7 and Art. 8.
Purpose: Compliance with labor obligations – performing activities required to fulfill employment contracts, legal obligations, and requests from applicable public authorities.
Type of personal data:
- Data required to carry out these activities, such as full name, parentage, date of birth, CPF, RG, PIS, voter registration, address, email, phone number, bank details.Type of sensitive personal data:
- Data such as race, required for compliance with specific obligations.
Legal basis: Contract execution and legal or regulatory obligation. LGPD Art. 7, item II; Art. 11, item II, letter “a”.
Purpose: Ensuring proper website functionality during access.
Type of personal data:
- Cookies – we may collect information such as browser type, IP address, search terms, accessed content, or other browsing-related data.
Legal basis: Legitimate interest.
Note: To learn more about how the Organization uses cookies and how to opt out, please refer to our Cookie Policy. LGPD Art. 10, §2.
Purpose: Communication regarding events | marketing campaigns | commercial relationship.
Type of personal data:
- Identification and contact data for sending promotional materials, such as full name, email, address, phone number, or other relevant information.
Legal basis: Legitimate interest, with opt-out/unsubscribe rights guaranteed. LGPD Art. 10, §2 and Art. 18, §2.
Purpose: Interaction on our social media platforms to strengthen commercial relationships and promote our services.
Type of personal data:
- Identification and contact data, such as full name and email.
Legal basis: Legitimate interest. LGPD Art. 10, §2.
Purpose: Contact initiated by your request when submitting the “Contact Us” form available on the website.
Type of personal data:
- Identification and contact data, such as full name, mobile number, and email.
Legal basis: Data subject’s consent, through voluntary expression. LGPD Art. 7, item I and Art. 8.
3. Data Sharing
The Organization may, under certain circumstances, share your personal data to fulfill a specific purpose, always observing good faith, the principles defined by law, and ensuring appropriate information security protection.
Data sharing may occur:
- With partner companies that support us in executing operational processes, such as payroll, provided that data processing follows the security standards and processing instructions established by the Organization.
- With government entities or third parties, including the use of sensitive data, to comply with legal or regulatory obligations.
- With government entities or third parties to protect the Organization’s interests in any type of conflict, including legal actions and administrative proceedings.
- In other situations that may arise, always in full compliance with the guidelines of this policy.
4. International Data Transfers
The Organization does not currently perform any international transfers of personal data. If such a need arises in the future, this policy will be updated accordingly.
5. Personal Data Security
This privacy policy is supported by information security policies, procedures, and technical measures.
The Organization adheres to generally accepted information security standards and best practices, based on a program that includes risk identification and assessment, as well as administrative, technical, and physical measures to protect personal data against loss, unauthorized access, and/or misuse.
We consider the human factor to be a fundamental aspect of our program. Therefore, the Organization implements regular awareness routines and training, employs a dedicated team of professionals, systems, tools, and processes focused on monitoring and continuous improvement in line with technological advancements and updated organizational resources.
6. Privacy Incidents and Data Breaches
We have established procedures and implemented technical information security measures to protect your personal data and prevent data breaches, loss, misuse, or alteration.
However, considering that systems and technologies are subject to failures or vulnerabilities that may be exploited by malicious individuals, if you have any concerns or wish to report a suspected case or privacy incident, please contact the Organization’s Data Protection Officer via email at:
encarregado.dados@to-brasil.com
7. Data Retention and Storage
The Organization stores personal data for as long as necessary to fulfill the intended purposes. Data will be deleted only when no longer needed or upon request by the data subject exercising their rights, except in cases provided by law, such as compliance with legal or regulatory obligations.
Where possible, the Organization uses technical means to prevent direct or indirect association with stored personal data, including anonymization. Data stored in backups will be kept securely, including through encryption, and isolated from any other processing activity until it can be safely discarded.
8. Your Data Rights
The Organization is committed to upholding the rights of data subjects as defined by the LGPD under Article 18, through administrative processes and measures.
Accordingly, all data subjects are entitled to request, at any time, information regarding:
- Confirmation of the existence of data processing
- Revocation of consent at any time
- Access to stored data
- Blocking or objection to data processing
- Data rectification in case of updates or corrections
- Data deletion, subject to legal or regulatory obligations
To exercise your rights regarding your personal data, please contact the Organization’s Data Protection Officer via email at:
encarregado.dados@to-brasil.com
9. Contact Information
If you have any questions regarding this Privacy Policy or the processing of personal data, please contact the Organization’s Data Protection Officer — Marcelo Pereira da Ponte — via email at:
encarregado.dados@to-brasil.com
10. Final Provisions
This Policy may be updated at any time and/or at least every 24 months.
Its implementation is monitored by the Data Protection Officer and other professionals responsible for the governance of this Organization.