do everything the right way, always.

Updated 8 May 2026 · Standards of conduct and ethics expected of the People of Casa Hacker and other related parties.

About this Code

Casa Hacker is a non-profit organisation, founded and led by people from the periphery, working in São Paulo, Campinas and Rio de Janeiro, dedicated to making technology and social innovation accessible to everyone through science and technology education and the training of leaders in social and environmental impact. Casa Hacker believes in education as a tool of transformation for building a fairer and more sustainable future.

This Code of Ethical Conduct (“Code”) sets out the values, guidelines and responsibilities that guide the behaviour of everyone who is part of Casa Hacker — staff, volunteers, partners, board members and everyone else involved. We believe there is only one way to fulfil our mission: to do everything the right way, always!

Who does it apply to?

This Code of Ethical Conduct applies to everyone who is part of our network: staff, leaders, beneficiaries, volunteers, service providers, suppliers, representatives, members of our own units and of third-party units, and members of our board, regardless of role or position in the hierarchy. Everyone who takes part in the Casa Hacker ecosystem must know our rules and carry our values forward, so that we grow together.

Our mission, vision and values

Our mission is to make technology and social innovation a place for everyone.

Today we are building a broad network of innovation and young people from public schools, training them in STEAM (Science, Technology, Engineering, Arts and Mathematics) and inspiring them to become innovation leaders in their own territories.

And we are going to create the largest and most vibrant network of hacker laboratories in Brazil — a network that creates opportunities for STEAM education and social innovation in peripheries across the whole country, emancipating new generations of agents of transformation, scientists, engineers, technologists, artists and mathematicians!

When you are aligned with our mission and values, and act accordingly, you grow stronger and you see change within yourself, in the people around you and in your community. And what are these values we are talking about?

• Innovation – We value a culture of active listening to the territories we are part of, learning quickly in order to create responsive solutions;
• Leadership – We believe in leading through actions that inspire, showing that real change begins with concrete, transformative attitudes;
• Openness – We stand for a free culture, using open knowledge, software and hardware that promote universal access to technology and knowledge;
• Integrity – Our essence lies in never straying from our mission, keeping an unshakeable commitment to the cause that moves us;
• Diversity – We celebrate the plurality of voices, cultures and perspectives, because we know diversity is the engine of social impact and sustainable development;
• Responsibility – We act responsibly and with commitment, honouring the promises we make to the people and territories that are the focus of our impact;
• Transparency – We invite the community to take part in our governance, whether in projects or in leadership, which builds trust and collective ownership.

Theory of Change

Casa Hacker’s Theory of Change (“Theory”) reflects the bold, transformative vision of an organisation that works in the peripheries to build a more inclusive, digital and socially equitable future.

Grounded in the understanding that change is not linear but complex and interconnected, Casa Hacker focuses on shifting the power dynamics that perpetuate inequality, exclusion and injustice.

The Theory of Change guides our day-to-day actions and our future planning. With it, we can:

• Explain why we do what we do;
• Plan our short-, medium- and long-term projects;
• Take decisions aligned with our vision of the future;
• Assess whether we are on the right track to generate the impact we want;
• Guide our team, partners and collaborators on the organisation’s priorities.

This document shows the connection between our everyday activities and the transformations we want to see in the world. It answers essential questions: Where are we? Where are we going? How will we get there? What energy and resources do we need to invest? See the Theory of Change on this page or download the PDF.

Compliance

The Code sets out formally the standards of conduct and ethics that Casa Hacker expects of its members, of third parties and of other related parties, and it also serves to meet and ensure that our work complies with the legislation in force, in particular:

• General Personal Data Protection Law — LGPD (Lei 13.709);
• Regulatory Framework for Civil Society Organisations (Lei 13.019/2014);
• Anti-Corruption Law (Lei 12.846/2013);
• Freedom of Information Act (Lei nº 12.527/2011);
• Federal Constitution of 1988 (Article 5 — Equality before the law);
• Social name and recognition of the gender identity of travesti and transgender people (Decreto 8727/2016);
• Law criminalising prejudice based on race or colour (Lei 7.716/1989);
• Brazilian Inclusion of Persons with Disabilities Act (Lei 13.146/2015);
• Statute of the Child and the Adolescent (Lei nº 8.069, of 13 July 1990);
• Cultural Action Programme – PROAC – ICMS (Lei nº 12.268, of 20 February 2006; rules updated annually);
• Rouanet Law – National Programme for the Support of Culture – PRONAC (Lei nº 8.313 of December 1991; Decreto-Lei nº 1.494, of 17 May 1995; rules updated annually).

Objectives

• To be a reference for guiding compliance in Casa Hacker’s work, by setting out the ethical standard of conduct expected of all its Members and of the Third Parties it deals with;
• To govern Casa Hacker’s internal and external relationships, establishing the applicable ethical standard and values and defining specific rules of conduct to be followed in dealings with Public Officials and private entities;
• To serve as an instrument for implementing Casa Hacker’s compliance policies, in order to prevent, detect and remedy any undesirable, unlawful and/or unethical conduct;
• To establish guidelines for assessing and taking action in the event of breaches of the rules set out here, in addition to any other applicable legal penalties;
• To help meet the requirements set by Brazilian rules and legislation.

1 – Expected Conduct

People are the essence of Casa Hacker. We put people first and we do our best to recognise, value and respect the diversity of all people and territories.

Casa Hacker welcomes contributions from everyone who shares our goals and wants to collaborate in a healthy, constructive way within our community. We therefore adopt this code of conduct and require all participants to agree to and abide by these guidelines in order to take part in the community, so as to help us create a safe and positive experience for the whole community.

How to treat one another:

• Be respectful and value each other’s ideas, styles and points of view;
• Be direct and to the point;
• Be inclusive and help new perspectives find a voice;
• Appreciate and respect our cultural practices, attitudes and beliefs;
• Be open to learning from others;
• Lead by example and match your actions to your words.

Behaviour that is not tolerated:

• Violence and threats of violence;
• Personal attacks;
• Demeaning language;
• Unwanted sexual attention or unauthorised physical contact;
• Aggressive behaviour;
• Encouraging unacceptable behaviour.

1.1 – Human rights and respect for the individual

Our working environment was born diverse, stimulating and honest, and always will be. Under no circumstances do we tolerate violations of human rights, discrimination or disrespect, whether on grounds of gender, social class, colour, ethnicity, disability or any other characteristic a person carries with them. We will never accept forced, slave, servile or child labour, sexual exploitation — above all of children and adolescents — harassment, racism, racial insult, bullying, physical or psychological abuse, or any other action or reaction that may harm the dignity of any individual.

Our project rests on treating everyone with dignity, peacefully and respectfully. So if you see any attitude inconsistent with our values, report it through our whistleblowing channel.

1.2 – Protecting and making good use of our property

Casa Hacker’s equipment and property, like work tools such as computers, mobile phones and vehicles, must always be used with care and with responsibility for their proper and lawful use.

Corporate computers, phones and email are the work tools we use to fulfil our mission and, for that reason, they may be audited or monitored at any time, with or without prior notice.

If you have lost such an asset, if it has been stolen, or if you have seen someone making improper use of the organisation’s assets and resources, these situations must be reported immediately to your direct manager and/or to our whistleblowing channel.

1.3 – Protecting our brand, property and personal data

Everyone who is part of our network represents our brand and our intellectual property. Our conduct must honour that commitment, protecting the reputation of our organisation and not disclosing any sensitive or confidential information.

You should know that sensitive or confidential information is any information which, if disclosed, could cause material or reputational harm to the organisation or to any of its staff or the people it affects. You will come across sensitive or confidential information in your work. So what is it?

• Financial and accounting records;
• Reports of any kind, research and institutional presentations, planning documents, emails and minutes of meetings;
• Business strategies;
• Trade secrets, patents, trademarks and copyright;
• Databases, salary and benefits data;
• Registration, personal and intellectual property data of Casa Hacker’s sponsors, donors and partners, whether individuals and/or legal entities.

Even if at some point you leave Casa Hacker, you must continue to respect and protect our confidential information. This also means you must return to the organisation any documents or materials in your possession that may contain confidential content. When you want to publish content, decisions or strategic information about Casa Hacker, remember that you must first check whether that content has already been published through the organisation’s official networks and channels and is therefore already public. Otherwise you may breach important strategies, harming the institution, and you will face disciplinary measures.

If you come across a leak of confidential information, go to your direct manager, to the Compliance area and/or to our Whistleblowing Channel so that they can take steps to reduce the impact on Casa Hacker.

1.4 – Social media

Everyone has the right to speak, and freedom of expression is respected at Casa Hacker. However, when we use social networks we need to pay attention to how we express our ideas and opinions, since acts carried out online end up reflecting on reality and can often have serious consequences for the author and for Casa Hacker, whether to its image, its reputation or the progress of projects and activities. So take care not to publish:

• Images and/or videos that might reveal confidential information about Casa Hacker;
• Controversial, defamatory or offensive statements that could have a negative impact on the image of Casa Hacker, of third parties, partners and colleagues, or that associate the name and image of Casa Hacker and its symbols with any unlawful acts;
• Personal opinion on behalf of Casa Hacker;
• Posts, pages or statements of any kind on behalf of Casa Hacker, except in exceptional cases authorised beforehand;
• Political statements on private social networks while wearing Casa Hacker clothing.

On your private social networks, act with respect and courtesy and avoid any involvement with discriminatory positions, hate speech and controversy. Do not post comments, images, photos or videos that could compromise your personal and professional ethics; this is your responsibility as a citizen, both within and beyond your role as a Casa Hacker professional.

1.5 – Protection of children and adolescents

It is our duty to guarantee the fundamental rights of the children and adolescents who are part of our network: the right to life, health, freedom, dignity, education, culture, sport, leisure and everything that comprehensive protection of childhood involves.

At Casa Hacker we aim to strengthen, within our organisation, behaviour consistent with the protection and safety of children and adolescents as set out in the Statute of the Child and the Adolescent and in the UN Convention on the Rights of the Child.

• Comprehensive protection: Children and adolescents are seen as subjects of rights and have absolute priority;
• Basic rights: Guaranteeing the right to life, health, food, education, leisure, vocational training, culture, dignity, respect and freedom;
• Protection from violence: It is everyone’s duty to safeguard dignity and to protect against inhuman, violent, terrifying, humiliating or degrading treatment, and against involvement in armed conflict.

Any act or behaviour harmful to this group — such as sexual harassment, bullying, moral harassment, moral and physical abuse, discrimination of any kind (relating to body, body type, race, religion, culture, socio-economic class, gender or otherwise), criminal exploitation, child pornography, modern slavery, negligent treatment or commercial exploitation — is strictly prohibited by Casa Hacker.

Everyone who works directly or indirectly with children and adolescents must comply with the Child and Adolescent Protection Policy available at docs.casahacker.org/governanca.

2 – Conflicts of Interest

Our mission is to make technology and social innovation a place for everyone, and we want to do that the right way, constructively and transparently. Our professionals must work free of any conflict of interest. This kind of problem arises when a professional has a personal interest in the outcome of an action that differs from Casa Hacker’s interest, which may mean their decision is not based on strictly professional and technical criteria.

If you, as a professional in the Casa Hacker network, come across a situation of potential conflict of interest, it is your duty to report it through the channels immediately. Every conflict-of-interest situation must be avoided. On this matter, it is important that everyone observes the guidelines below. When in doubt, consult your manager.

2.1 – Referring colleagues for work

Do you know an amazing professional to work with us? Here at Casa Hacker we encourage our staff to refer new professionals.

You know that colleague from your street, your school, your neighbourhood, the courts, and friends of friends? You can and should refer them. We do, however, take special care to avoid unfair advantages or favouritism.

Referred professionals will go through every stage of Casa Hacker’s selection process, which applies the same assessment criteria to all participants. Everyone must therefore bear the following in mind:

• You may refer people for any area, but you will not take decisions in the selection process your referred colleague takes part in;
• If the colleague you referred is close to you (friends, former co-workers), the recommendation is that you take part in no stage at all.

2.2 – Referring third parties

If you have a supplier or service provider to refer to us, our doors are open too, whether an individual or a company. But in this case as well the negotiation process must be entirely free of favouritism, so:

• The referred third party will take part in the whole assessment process applied to any other candidate;
• You will neither give an opinion nor take decisions in the selection process the third party you referred takes part in;
• If the third party is engaged, the professional who referred them may not have a commercial relationship with them, nor manage the contract.

2.3 – Family members as professionals

Regarding hiring, we reaffirm the policy of Not Hiring Family Members at Casa Hacker.

We do not hire spouses, partners or close relatives (such as parents, children, siblings, uncles and aunts, nieces and nephews, cousins, siblings-in-law, sons- or daughters-in-law) of current staff, regardless of the level in the hierarchy.

This policy is crucial for several reasons tied directly to Compliance:

• Impartiality and strategy: It ensures that all hiring and promotion decisions are based solely on the candidate’s qualifications and experience, without undue favouritism;
• Preventing conflicts of interest: It minimises the possibility of situations in which family ties could unduly influence work decisions, performance reviews, the use of the organisation’s resources or the chain of command itself;
• A healthy working environment: It promotes a fairer, more transparent and more professional environment for everyone, preventing perceptions of favouritism or unequal treatment.

2.4 – Romantic relationships

We know that personal life goes far beyond work and that this must be respected. Romantic and affectionate relationships within Casa Hacker are accepted provided that:

• The people involved maintain a respectful attitude towards their colleagues, avoiding embarrassing situations and excessive closeness on the premises;
• Where there is a direct or indirect leadership/subordination relationship, or a management or executive relationship between those involved — or if you are already in such a situation — report it immediately.

2.5 – Promotional items and gifts

Receiving promotional items and gifts can be nice, but at work we need to be careful. All Casa Hacker professionals may offer and receive promotional items on behalf of the institution provided they are authorised by at least one manager of the area, and, as regards offering them, provided there is an institutional reason that justifies it, such as giving specific items to partners’ commercial and marketing teams to promote the brand.

A promotional item is understood to be a product with no commercial value, usually carrying a logo and brand, distributed for advertising, promotion, events or as a courtesy — for example, pens and diaries.

Gifts, on the other hand, are items with commercial value delivered to a specific person. In this context, Members of Casa Hacker are expected to behave as follows:

• Do not give gifts or promotional items to Public Officials or Third Parties exceeding the symbolic value of R$ 100.00 per person per year, and respect the same ceiling for receiving them;
• Do not make payments for hospitality outside the work context or where the law prohibits such a practice. However, if such a payment is part of a lawful context, it is still necessary to: not cover expenses of people connected to the guest and unrelated to the subject; make clear that the payment creates no expectation of any return; request a tax receipt and keep those receipts, which must be filed together with information about the event; and avoid receiving and making cash payments above R$ 100.00.

Where refusal is impossible, or where our professional believes that refusing could embarrass the other party, the item may be accepted, but it must be forwarded to Casa Hacker so that it can be raffled internally.

2.6 – Entertainment and travel invitations

As Casa Hacker professionals we represent Casa Hacker, we want to spread our mission, vision and values, and to do that we need to behave appropriately. Invitations to take part in events and other entertainment situations organised and sponsored by third parties (suppliers, partners and so on) must be submitted for approval, where we will assess them and reach the best decision together. In addition:

• Where the invitation is not for a specific person, the manager of the area that received it must decide which professional will attend the event;
• Where the invitation is for a specific person, the manager of the area that received it decides whether that professional may attend;
• Whenever possible, Casa Hacker will pay its professional’s expenses;
• For events held in places that require travel in order to attend, the expenses of that travel must be paid by Casa Hacker. We only allow a third party to pay travel expenses to the event if they are treating all participants the same way.

2.7 – Business meals

Business meals involving Casa Hacker people and potential partners and sponsors may only take place if they are within normal standards of venue, time, price, frequency and number of participants. These expenses must never occur in a way that creates undue advantage, whether direct or indirect. Preferably each party should pay what corresponds to their own consumption, and the bill will only be paid in full by Casa Hacker with prior approval.

Business meals with public officials should be avoided but, if they take place, they may never deal with matters that breach Casa Hacker’s ethical values or lead to rules being broken. Remember: Casa Hacker’s reputation also depends on your integrity in dealing with third parties, all the more so with third parties who require special care, such as public servants.

2.8 – Outside activities

We use our strength to pursue our mission every day, and we give our professionals the freedom to carry out other activities independent of their role at Casa Hacker. Outside activities are permitted provided they do not hinder the professional’s performance and do not pose risks to Casa Hacker’s work, and it is important that the Compliance area is aware that they are taking place. Subject to that, you must:

• Inform Casa Hacker, before the services begin, whether there is any conflict of interest preventing you from carrying out the work impartially and neutrally, accepting the work only if and to the extent that you find nothing that undermines the duty of loyalty and impartiality in performing the services, and that you have not been engaged to carry out any work, for public or private bodies, that could result in such incompatibility;
• Not exchange information, technologies or methodologies between outside activities; where partiality and/or the gaining of privileged information between outside activities is identified, it must be reported immediately;
• Not poach other professionals between outside activities, and always report it if you witness this;
• Report the engagement of service providers from Casa Hacker’s roster of service providers, since this creates the need to check for conflicts of interest.

3 – Relationships

3.1 – Relationships with suppliers, service providers and partners

We believe in building an ethical, lawful, fair and transparent professional relationship with our suppliers, service providers and other business partners. Commercial negotiations must be conducted in good faith and follow selection criteria that are always technical and professional, never personal, prioritising Casa Hacker’s interests.

We do not accept any kind of gratuity, payment or commission from suppliers, service providers or partners, and we prohibit offering, requesting or receiving, directly or indirectly, bribes or kickbacks to carry out any kind of transaction, as well as anything of value, to or from any person or organisation, government entities, public officials, private companies and their employees, in any circumstances.

We expect our suppliers, service providers and other partners to follow what we recommend in this Code and also what the law requires in relation to health and safety, labour relations, the environment, ethics, responsibility and transparency in the supply chain.

3.2 – Relationships with public and private officials

Our relationship with public and private officials, whether Brazilian or foreign, and with people related to them (also called PEPs – Politically Exposed Persons), must be one of transparency, honesty and good faith. Only authorised and prepared professionals may carry out activities on behalf of Casa Hacker with Public and Private Officials and, for that reason, it is prohibited to offer or promise promotional items, gifts, travel, entertainment, jobs or donations to public officials or political parties. So, in any setting or situation, you must:

• Maintain ethical, professional, courteous and transparent relations;
• Comply with legal requirements and requests made by public authorities in order to obtain contracts, licences, permits, authorisations and decisions;
• Record meetings with public officials and, whenever possible, hold meetings in the presence of at least two people representing Casa Hacker;
• Keep clear and accurate records of the meetings held.

3.3 – Relationships with investors

Casa Hacker takes care to communicate effectively with investors so that they receive complete and accurate information on every material aspect of its financial position and the results of its operations. Reports and documents filed with or submitted to regulators, and other public communications, must be disclosed appropriately: completely, clearly, accurately, in good time and understandably.

We at Casa Hacker have a duty to maintain a high standard in all matters relating to accounting, internal controls, internal and external reporting and taxation. All financial records and accounts must accurately reflect the transactions and events carried out and must comply with the required accounting and reporting principles, as well as with the system of internal controls. Records may never be distorted or manipulated so as to hide, disguise or alter Casa Hacker’s real financial position.

Announcements and disclosures must always be made as clearly, truthfully and accurately as possible, by everyone. They must avoid exaggeration, guesswork, legal conclusions and offensive, defamatory or disparaging notes or comments, as well as negative descriptions of people or companies. This applies to all types of communication, including emails and informal notes. If you have any doubt on these matters, consult Legal before acting.

3.4 – Relationships with the press, newspapers and external media

At Casa Hacker we know how important it is to work as a network. We keep an open dialogue, based on credibility and respect, with external media outlets. Within our ecosystem, dealing with and responding to the press is the responsibility of the Press Office.

Only those trained and authorised by the Press Office may speak or comment on subjects and events on behalf of Casa Hacker, whether to investors and donors, to exchange information and/or to answer questions. This authorisation is also required in order to speak at conferences, seminars and other external events.

4 – Data Protection

Casa Hacker recognises the protection of personal data as a fundamental right and an essential pillar for building relationships of trust with everyone who is part of our network. Our commitment goes beyond complying with the General Personal Data Protection Law (Lei 13.709/2018 – LGPD) and includes building an organisational culture of respect for privacy, transparency and accountability in the handling of personal information.

4.1 – Data protection principles

All Casa Hacker professionals, volunteers, partners and service providers must observe the following principles when handling personal data:

• Purpose: Collect and process personal data only for legitimate, specific, explicit purposes, made known to the data subject, with no possibility of later processing incompatible with those purposes;
• Suitability: Ensure that the processing is compatible with the purposes made known to the data subject, in line with the context of the processing;
• Necessity: Limit processing to the minimum necessary to achieve its purposes, covering data that is relevant, proportionate and not excessive;
• Transparency: Provide clear, accurate and easily accessible information about the processing and the respective processing agents, subject to commercial and industrial secrecy;
• Security: Use technical and administrative measures capable of protecting personal data from unauthorised access and from accidental or unlawful situations;
• Prevention: Adopt measures to prevent harm arising from the processing of personal data;
• Non-discrimination: Make it impossible to carry out processing for unlawful or abusive discriminatory purposes.

4.2 – Types of data collected and legal bases

Casa Hacker collects personal data from different categories of data subjects, always respecting the legal bases set out in the LGPD:

• Communication data: Name, email and telephone collected through contact channels, WhatsApp and Signal, based on the data subject’s consent;
• Browsing data: Cookies, IP address, date and time of access, geographic location, length of visit, pages visited, browser type and version, device information — based on legal obligation (Marco Civil da Internet, Brazil’s Internet Civil Rights Framework) and legitimate interest;
• Newsletter data: Name and email for sending content, based on consent;
• Event data: Name and email for event registration, based on consent;
• Staff data: Registration, contractual, financial and performance information needed for the employment or volunteering relationship;
• Beneficiary data: Information about children, adolescents and young people taking part in the programmes, including sensitive data where necessary for the proper delivery of the educational services;
• Partner and supplier data: Registration and contractual information needed for the commercial and institutional relationship.

4.3 – Use of cookies and tracking technologies

Casa Hacker uses cookies on its websites and digital platforms to improve the user experience. The types of cookies used include:

• Essential cookies: Necessary for the site to work properly, such as identifying users and adjusting how content is displayed. These cookies cannot be disabled without compromising access to the site;
• Analytics cookies: Used to collect information about interactions with the site, frequency of access and clicks, allowing us to assess and improve our services;
• Preference cookies: Collect information about users’ interests and preferences in order to personalise content.

With the exception of essential cookies, all users can disable or delete cookies through their browser or device settings at any time.

4.4 – Data sharing

Casa Hacker does not sell personal data under any circumstances. Personal data is shared only in the following situations:

• Service delivery: Sharing with partners and suppliers needed to make our services possible, such as data hosting companies, email platforms and analytics tools;
• International transfer: Data may be stored on overseas servers of suppliers such as Microsoft Azure, Amazon Web Services, Digital Ocean, Bússola Social, Webflow, Google Workspace and Mailchimp, always in compliance with the legal requirements for international transfer;
• Legal obligations: Sharing with the competent authorities where necessary to comply with legal obligations or court orders, or to safeguard the organisation’s rights.

In every case, Casa Hacker undertakes to pseudonymise data wherever possible and to require confidentiality and security from the third parties it shares information with.

4.5 – Security measures

Casa Hacker implements technical, administrative and organisational measures to protect personal data against unauthorised access, destruction, loss, alteration or improper processing:

• Use of logins and passwords for access to the servers where personal data is stored;
• Storage of access logs for control and for keeping an up-to-date inventory;
• Periodic backups;
• Use of encryption techniques;
• Adoption of software, tools and technologies kept up to date in line with market practice;
• Continuous training of staff on data protection;
• Implementation of restricted access policies based on need and role.

All Casa Hacker professionals must help maintain data security, ensuring secure environments through the use of antivirus software, firewalls and up-to-date versions of browsers and operating systems, and by not sharing passwords.

4.6 – Rights of data subjects

Casa Hacker respects and guarantees data subjects the exercise of the following rights:

• Confirmation and access: The right to confirm that processing exists and to obtain access to the personal data processed;
• Rectification: The right to request the correction of incomplete, inaccurate or out-of-date data;
• Anonymisation, blocking or deletion: The right to request the anonymisation, blocking or deletion of unnecessary or excessive data, or data processed other than in accordance with the LGPD;
• Portability: The right to request the portability of data to another service or product provider, upon express request;
• Deletion of data: The right to request the deletion of personal data processed on the basis of consent, except where the law requires it to be kept;
• Information about sharing: The right to obtain information about the public and private entities with which Casa Hacker has shared data;
• Information about withholding consent: The right to be informed that consent may be withheld and of the consequences of refusing;
• Withdrawal of consent: The right to withdraw consent at any time.

To exercise any of these rights, data subjects may get in touch at privacidade@casahacker.org, free of charge and without difficulty.

4.7 – Responsibilities of staff

All Casa Hacker staff, volunteers and service providers with access to personal data must:

• Process personal data only for the authorised purposes and in accordance with Casa Hacker’s instructions;
• Not use personal data for their own benefit or that of third parties;
• Immediately report any security incident, leak or misuse of personal data;
• Keep personal data confidential even after the relationship with Casa Hacker ends;
• Take part in mandatory training on data protection and the LGPD;
• Return or delete all personal data at the end of the contractual relationship, as directed by the organisation;
• Not share access credentials or allow unauthorised third parties to access personal data;
• Report to the Data Protection Officer any question about the proper handling of personal information.

4.8 – Processing children’s and adolescents’ data

In line with the Child and Adolescent Protection Policy, Casa Hacker takes special care when processing the personal data of children and adolescents:

• Data is collected with the specific consent of at least one parent or legal guardian;
• Clear, simple and accessible language is used to explain the processing of data;
• Processing is limited to the minimum necessary to deliver the educational services;
• Sharing data with third parties without the express authorisation of the guardians is prohibited;
• Reinforced security measures protect this data;
• Parents or guardians have the right to access, correct and request the deletion of the data at any time;
• Using children’s and adolescents’ data for commercial, advertising or marketing purposes is prohibited.

4.9 – Data Protection Officer (DPO)

Geraldo Barros, DPO — privacidade@casahacker.org

4.10 – Security incidents

In the event of a security incident that could give rise to relevant risk or harm to data subjects, Casa Hacker undertakes to:

• Notify the National Data Protection Authority within a reasonable time;
• Inform the affected data subjects about the incident, its consequences and the measures taken;
• Take immediate measures to reverse or mitigate the effects of the incident;
• Document every incident, including the related facts, effects and corrective measures;
• Implement improvements to processes and systems to prevent further incidents.

Any suspicion or identification of a security incident must be reported immediately to the Data Protection Officer through the official channels.

5 – Anti-Corruption and Transparency

Honesty, professionalism and ethics are not up for negotiation. Not only within our own house, but also on the part of our partners, investors, network professionals, service providers and the general public who trust and bet on the social projects we create.

We leave no room for people to act with bribery and/or corruption among us. Local and international anti-corruption and anti-bribery laws are important rules that set the limits of our everyday activities. So never:

• Promise, offer or hand over, directly or indirectly, anything of value or advantage to a public official or to a third party related to them in order to influence or reward an official act or decision, as a form of compensation for any benefit to Casa Hacker;
• Fund, finance or sponsor the carrying out of unlawful acts;
• Use an intermediary, whether an individual or a company, to conceal or disguise your real interests or the standing of the beneficiaries of the acts carried out;
• Hinder or obstruct investigation or oversight activity by public bodies, entities or officials, including the activities of regulators and of the bodies that supervise the national financial system.

Breaches of anti-corruption laws can compromise the image and reputation of Casa Hacker and of its professionals, as well as affecting its sustainability and longevity. Unlawful acts give rise to civil, administrative and criminal liability and penalties for Casa Hacker and its professionals. If you witness, suspect or learn of unethical acts or acts contrary to our rules and values, report them.

6 – Donations and Sponsorships

Casa Hacker is aware that donations must be made in line with good practice and with the laws of our country, and without the aim of obtaining undue advantage or favour. Remember that donations are free grants of food, products or financial contributions to a third party for charitable purposes and/or for institutional relations and promotion of the Casa Hacker brand.

Sponsorships are financial amounts sent to an initiative organised by a third party with the aim of promoting Casa Hacker. The professionals leading sponsorships must ensure that such activities are transparent, recorded in a written contract and have legitimate purposes in line with the consideration proposed by the third party; they must be approved by Legal to validate the act, along with the areas needed to follow up on the corresponding accounting. If you suspect a breach or misuse involving a donation or sponsorship process, tell Casa Hacker through the whistleblowing channel.

7 – Prevention of Money Laundering

Money laundering may be a common expression in the news, but often we do not understand what it means. It is important that all our members know how to recognise it in order to avoid it. Money laundering is the practice of disguising the ownership or source of money obtained unlawfully through other dealings in order to “clean” the funds so that they appear to have come from lawful activities. Casa Hacker undertakes to make efforts to combat money laundering and the financing of terrorism, exactly as the law requires. It is therefore everyone’s duty to:

• Make sure that Casa Hacker’s revenue, surpluses and gains come from lawful operations;
• Not hide or disguise the origin, movement or destination of amounts resulting from criminal offences;
• Take part in training given by the Compliance area on the subject;
• Clear up questions and uncertainties about the crime of money laundering;
• Report suspicious situations to your direct manager and/or to the whistleblowing channel;
• Comply with all laws and regulations on this matter, and act preventively, paying attention to the possible occurrence of this practice in operations, even indirectly;
• Keep an up-to-date record of professionals, with personal information and transaction amounts relating to their engagement, retention and transfers in Brazilian or foreign currency.

8 – Whistleblowing

If you are facing unacceptable behaviour that is not tolerated, as described in this code, report it through the whistleblowing channel; you may do so entirely anonymously, and with the person responsible for the Casa Hacker activity or space. When your case reaches the whistleblowing channel, it goes to the Compliance Manager. After receiving a concise description of your situation, we will review it and determine the next steps. As well as investigating internally, we may consult lawyers and/or specialists in order to find the best way to resolve what happened. We will involve other people only where necessary to deal properly with each situation. Also let us know if you observe a potentially dangerous situation, someone in danger, or breaches of these guidelines, even if the situation is not happening to you. If you believe you have been unfairly accused of breaching these guidelines, follow the same reporting process.

8.1 – Who to contact

Compliance Manager, channel available:

• Whistleblowing Channel (for internal and external use; allows anonymous reports): abreojogo.casahacker.org

8.2 – Spaces

Every physical or virtual space belonging to Casa Hacker or represented by it must have a person responsible for it.

8.3 – Events

All Casa Hacker events will have a specific safety guideline with emergency and anti-abuse contacts at the event and online. These contacts will be highlighted throughout the event and in printed and online materials. Those leading the organisation of activities must mention this code of conduct before the activity, programme or project begins.

Reports will receive an acknowledgement of receipt through the whistleblowing channel. Once an incident has been investigated and a decision communicated to the relevant parties, they will have the opportunity to appeal the decision through the reporting channel chosen.

Ask questions

We encourage you to ask questions about these guidelines. If you are organising an event or activity, look for tips on building inclusion into your event, activity or space. Your views are welcome and you will always receive a reply within 72 working hours of getting in touch.

Changes to this code

Casa Hacker may change the code over time, or whenever there is a legal or institutional update that justifies revising it, and it may also vary the procedures it establishes where appropriate in a particular case. Your agreement to comply with these guidelines will be taken as agreement to any changes. If Casa Hacker changes the guidelines, the updated version can be found on this page.