Privacy Policy

1. Introduction

This Privacy Policy of the InvisibiliDOWN Institute ("the Institute") has been developed to reaffirm our commitment to privacy and the protection of the personal data of our users, visitors, and collaborators, in full compliance with the Brazilian General Data Protection Law (Law No. 13,709/2018 – "LGPD") and other applicable legislations. This document describes how we collect, use, store, share, and protect your personal information when interacting with our website and services.

2. Definitions

For the purposes of this Privacy Policy, the following terms shall have the following meanings:

• Personal Data: Information related to an identified or identifiable natural person.
• Sensitive Personal Data: Personal data regarding racial or ethnic origin, religious belief, political opinion, trade union membership or membership in a religious, philosophical, or political organization, data concerning health or sex life, genetic or biometric data, when linked to a natural person.
• Processing: Every operation performed with personal data, such as those referring to collection, production, reception, classification, utilization, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation, or control of information, modification, communication, transfer, dissemination, or extraction.
• Data Subject: The natural person to whom the personal data being processed refers.
• Controller: The natural or legal person, whether of public or private law, responsible for decisions regarding the processing of personal data.
• Processor (Operator): The natural or legal person, whether of public or private law, who performs the processing of personal data on behalf of the controller.
• Data Protection Officer (DPO): The person appointed by the controller and operator to act as a communication channel between the controller, the data subjects, and the National Data Protection Authority (ANPD).
• LGPD: The Brazilian General Data Protection Law (Law No. 13,709/2018).

3. Who We Are: The Controller of Your Data

The InvisibiliDOWN Institute, a private legal entity registered under CNPJ No. 64.122.775/0001-12, headquartered in São Paulo, SP, Brazil, is the "Controller" of the personal data processed within the scope of this website and its activities, responsible for decisions regarding the processing of your data.

4. Our Data Protection Officer (DPO)

For any questions related to this Privacy Policy or the processing of your personal data, you may contact our Data Protection Officer (DPO):

5. What Data We Collect and How We Use It

We collect personal data for various purposes, always based on a valid legal ground and limiting the collection to the minimum necessary for the specific purpose. The types of data collected and methods of collection include:

Identification and Contact Data

Data: Full name, email, phone number, address.

How we collect: Through contact forms, newsletter sign-ups, event registrations, donation forms, or volunteer applications.

Purpose: For communication, sending information, processing donations, and managing volunteers and event participants.

Financial Data

Data: Payment information (e.g., credit card details, banking information).

How we collect: Exclusively for processing donations, through secure payment platforms and financial partners. The Institute does not directly store complete credit card data.

Purpose: To process donations and financial contributions.

Navigation and Usage Data

Data: IP address, browser type, pages visited, duration of stay, clicks, approximate location data.

How we collect: Automatically, through cookies and other tracking technologies on the website.

Purpose: To improve user experience, analyze site traffic, personalize content, and ensure security.

Data of Children and Adolescents

The InvisibiliDOWN Institute may, in some of its activities (e.g., educational programs, specific events), collect data on children and adolescents. In these cases, processing will be carried out in strict compliance with Art. 14 of the LGPD, requiring specific and highlighted consent from at least one parent or legal guardian, and always aiming for the best interest of the child or adolescent.

We do not collect sensitive personal data unless strictly necessary for the specific purpose and based on an appropriate legal ground, such as explicit consent or compliance with a legal obligation.

6. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

• Communication: To answer your questions, send newsletters, updates, and information about our activities.
• Service Provision: To manage your participation in events, programs, or Institute initiatives.
• Donation Processing: To process your financial contributions and issue receipts.
• Website Analysis and Improvement: To understand how our site is used to enhance its functionality, content, and user experience.
• Legal and Regulatory Compliance: To meet legal, regulatory obligations, or court orders.
• Security: To protect the site and data against fraud and unauthorized access.
• Promotion of the Institute's Mission: To disseminate our causes, campaigns, and results, always respecting privacy.

7. Legal Bases for Data Processing

The processing of your personal data by the InvisibiliDOWN Institute is carried out based on the following legal grounds of the LGPD:

• Consent: When you give us explicit permission to process your data for a specific purpose (e.g., newsletter subscription).
• Compliance with Legal or Regulatory Obligation: To meet legal or regulatory requirements (e.g., issuing invoices, reports to government agencies).
• Execution of Contract or Preliminary Procedures: To fulfill a contract with you or perform procedures related to a contract (e.g., volunteer management).
• Regular Exercise of Rights: In judicial, administrative, or arbitration proceedings.
• Legitimate Interest: To support and promote the Institute's activities, whenever the processing is necessary and proportional to our objectives and does not infringe upon your fundamental rights and freedoms.
• Protection of Life or Physical Safety: In emergency situations requiring data processing to protect the life or physical safety of the data subject or third parties.
• Health Protection: In health-related procedures performed by healthcare professionals or health authorities.
• Research: For studies conducted by research bodies, ensuring data anonymization whenever possible.

8. Sharing of Personal Data

The InvisibiliDOWN Institute may share your personal data with third parties only when strictly necessary and based on a valid legal basis, for the following purposes:

• Service Providers: With companies that assist us in operating the website, processing payments, sending emails, data analysis, etc. These providers act as Processors and are contractually obligated to protect your data.
• Government and Judicial Authorities: To comply with legal, regulatory obligations, or court orders.
• Partners and Collaborators: In specific projects, through agreements that ensure data protection.

In the event of international data transfer, the Institute will ensure that the transfer occurs only to countries with an adequate level of data protection or through the adoption of appropriate contractual guarantees, in compliance with the LGPD.

9. Security of Your Personal Data

The InvisibiliDOWN Institute adopts technical and administrative security measures to protect your personal data against unauthorized access, destruction, loss, alteration, communication, or improper dissemination. Our measures include, but are not limited to, encryption, access control, firewalls, and continuous monitoring.

While we strive to protect your information, no data transmission over the internet is 100% secure. We recommend that you also adopt security measures, such as keeping your passwords secure and not sharing them.

If you identify any breach, failure, or vulnerability in our system, please contact our DPO immediately.

10. Retention of Your Personal Data

Your personal data will be retained by the InvisibiliDOWN Institute only for the time necessary to fulfill the purposes for which they were collected, including the need to comply with legal, regulatory, tax, or accounting obligations, or for the regular exercise of rights in judicial, administrative, or arbitration proceedings. After this period, the data will be deleted or anonymized.

11. Your Rights as a Data Subject

In accordance with the LGPD, you, as a data subject, have the following rights regarding your personal data. You may exercise them at any time by contacting our Data Protection Officer (DPO) via email.

Our goal is to respond to your requests within 15 days, but the maximum deadline is 30 days, as per the LGPD. We may request additional information to verify your identity before processing the request.

Data Subject Right	Brief Description
Confirmation of processing	The right to confirm whether the Institute processes your personal data.
Access to your data	The right to obtain access to your personal data held by the Institute and information on how it is used.
Correction of incomplete, inaccurate, or outdated data	The right to request the rectification of incorrect or incomplete personal data.
Anonymization, blocking, or deletion	The right to request that unnecessary, excessive, or data processed in non-compliance with the LGPD be anonymized, blocked, or deleted.
Data portability	The right to receive your personal data in a structured format and to transmit it to another provider, upon express request.
Deletion of data processed with consent	The right to request the permanent deletion of data processed based on your consent, subject to legal exceptions.
Information about not providing consent	The right to be informed about the possibility of not providing consent and the consequences of refusal.
Withdrawal of consent	The right to withdraw consent at any time, without affecting the legality of processing prior to withdrawal.
Information about sharing	The right to be informed about the public and private entities with which your data is shared.

12. Cookies and Tracking Technologies

Our website uses cookies and other tracking technologies to improve your browsing experience, analyze site usage, and personalize content. Cookies are small text files stored on your device when you visit a site.

Types of Cookies We Use:

• Strictly Necessary Cookies: Essential for the basic operation of the site, allowing navigation and use of core features.
• Preference Cookies: Allow the site to remember information that changes how the site behaves or looks, such as your preferred language or the region you are in.
• Statistical/Analytical Cookies: Collect information about how visitors use the site, such as the most visited pages and error messages. This information is aggregated and anonymous, used to improve site performance.
• Marketing/Advertising Cookies: Used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user.

The installation of non-essential cookies (preference, statistical, marketing) depends on your prior consent. When visiting our site for the first time, a cookie banner will be displayed, allowing you to accept all cookies, refuse non-essential ones, or customize your preferences.

You can manage your cookie preferences at any time through your browser settings or our on-site cookie consent tool.

13. Changes to This Privacy Policy

The InvisibiliDOWN Institute reserves the right to modify this Privacy Policy at any time to reflect changes in our data processing practices, legal or regulatory requirements, or to incorporate new technologies and services. Any significant changes will be communicated to users through a prominent notice on our website, direct email (if applicable), or other appropriate channels.

The date of the last update will always be indicated at the beginning of this document. We recommend that you periodically review this page to stay informed about how we protect your information.