1. Who we are, and who answers
Associação Casa Hacker, CNPJ (Brazilian company registry) 36.038.079/0001-97, a non-profit civil association headquartered in São Paulo and operating in Campinas, São Paulo State. We are the controller of the personal data described here, under Brazil’s LGPD (Law 13.709/2018).
Data Protection Officer (DPO): Geraldo Barros — privacidade@casahacker.org. That is the channel for any question or request about your data, and we reply within 15 days.
2. What this document covers
It covers personal data across all of Casa Hacker’s work, not only this website: educational and sociocultural programmes, event registrations, our relationship with staff and contractors, accounting and tax obligations, reporting to funders, and the whistleblowing channel.
The full list of processing operations is kept internally as a Record of Processing Activities (RoPA), with purpose, legal basis, retention period and the processors involved, reviewed periodically. What is summarised below is derived from it.
3. Data we handle, by purpose
We group by what it is for, because that is what determines what we ask for and how long we keep it.
- Educational and sociocultural programmes — identification, contact details, address, date of birth, legal guardian’s details, activity records, attendance, progress and submissions; where the programme measures impact, also answers to assessment instruments. Includes participants’ social case records.
- Open event registration — name, contact details, address, date of birth, gender, accessibility needs, attendance and certificate issuance.
- Staff, contractors and suppliers — registration, financial, tax and contract data; integrity screening (due diligence) required by Brazilian anti-corruption law; benefits, travel and corporate telephony.
- Accounting, tax and corporate obligations — bookkeeping, invoices, corporate documents and digital certificates of legal representatives.
- Reporting to funders — participant data required by grant agreements and public cultural funding systems.
- Communications and website — name, e-mail and the message you send; browsing data, when you accept analytics and ad measurement (see cookies).
- Whistleblowing channel — whatever the person reports, and their identification only if they choose to identify themselves (see whistleblowing channel).
4. Children and adolescents
Much of our programme work serves children and adolescents — that is Casa Hacker’s purpose, and it is why this section stands on its own.
- Processing follows article 14 of the LGPD: the best interest of the child and the adolescent guides every decision about the data.
- Participation requires specific, prominent consent from at least one parent or legal guardian (article 14, §1), collected in the Participation Agreement.
- We do not condition taking part in any of our activities on providing data beyond what is necessary (article 14, §4).
- Use of image and testimonial has its own authorisation, separate from registration, and it can be withdrawn.
- A request for access, correction or deletion may be made by the legal guardian, through the form at the end of this page.
5. Sensitive data
Some activities require data the LGPD classifies as sensitive (article 5, II). We handle only what is necessary, always on its own legal basis — never out of convenience.
- Health and disability — when you tell us about accessibility needs in order to take part in an event or activity. Used only to organise that participation.
- Data of children and adolescents in social case records — records of development and participation in the programmes, with the guardian’s consent.
- Race/colour and gender — used in aggregate, to measure the reach and equity of the programmes and to report to funders.
- Biometrics — only when issuing ICP-Brasil digital certificates for legal representatives, as required by the certification authority.
We do not use sensitive data for advertising, commercial profiling or any automated decision-making.
6. Legal bases
Every processing operation has a declared legal basis. The ones we rely on:
- Consent (article 7, I; article 11, I) — event registration, optional communications, analytics cookies, use of image and testimonial, and participants’ social case records;
- Consent of the legal guardian (article 14, §1) — participation of children and adolescents;
- Performance of a contract (article 7, V) — relationship with staff, contractors, suppliers and partners, and delivery of the programmes;
- Legal or regulatory obligation (article 7, II; article 11, II, a) — accounting, tax, corporate matters, reporting to public bodies and funders, and investigating a report;
- Legitimate interest (article 7, IX) — information security, fraud prevention, technical support for the association’s equipment, and improving the programmes.
7. Cookies and local storage
Essential (always on): we store in your browser (localStorage) your accessibility bar preferences (theme, font, contrast and so on) and your choice in this notice. None of it identifies you or leaves your device.
Analytics and ad measurement (optional, only if you accept): if you accept in the notice, we enable Google Analytics 4 with anonymised IP to understand how the site is used. The same acceptance lets us measure which Google Ad Grants ads brought you here: the _gcl_aw cookie keeps the ad-click identifier for 90 days, and the count of conversions (a downloaded file, an e-mail started) is sent to Google Ads — with nothing that identifies you. You can decline without losing any feature. To withdraw later, clear this site’s data in your browser — the notice reappears on your next visit.
No personalised advertising, no remarketing. Ad personalisation is denied in Consent Mode itself, Google Signals is switched off, and your data is not used to build profiles or to follow you on other sites. We do not sell browsing data.
8. Who we share with
We do not sell or trade personal data. Sharing happens in three situations, and only in those:
- Processors — companies that handle data on our behalf and under our instructions to make the operation possible. We require a data protection clause in the contract. By category: infrastructure and cloud, electronic signature, financial and accounting management systems, learning platform, event registration platform, mobility and travel, benefits, telephony, digital certification and the whistleblowing platform.
- Independent controllers — institutions that receive the data and then handle it on their own decision and responsibility: funders and foundations we report to, public cultural funding bodies and registry services.
- Authorities — where legally required, and only to the extent required.
The named list of processors and each one’s contractual status is held in our internal record and can be requested through the form at the end of this page, choosing “Who have you shared it with?”.
9. International transfer
Part of our infrastructure sits outside Brazil, and that needs saying plainly: there is international transfer of data (article 33 of the LGPD).
- Cloud and collaboration — infrastructure, e-mail, storage and video conferencing services hosted in the United States. The organisation’s data as a whole passes through them.
- Cloud backup — encrypted copies in regions outside Brazil.
- Website analytics and ad measurement — Google Analytics 4 and Google Ads process browsing data in the United States, and are only enabled if you accept.
- Corporate mobility — the ride service used in the organisation’s activities is operated by a company in the United States.
The transfer relies on contractual data protection clauses with the processors and on compliance with article 33. We keep a redundant backup in a Brazilian datacentre (Valinhos, São Paulo State), and the Cockpit — our own system, where participants’ case records live — runs on a server in Brazil (São Paulo).
10. How long we keep it
The period follows the purpose, and what the law requires. After it, data is deleted or anonymised.
- Accounting, tax and supplier due diligence — 10 years, as Brazilian tax law requires;
- Contracts and relationship with staff and contractors — term + 5 years;
- Programmes and social case records — term + 5 years, the period for reporting to funders;
- Impact assessment — individual answers until the cycle report is published; anonymised after that. Aggregate results: cycle + 5 years;
- Event registration — 2 years after the event;
- Contact form — 24 months;
- Report to the whistleblowing channel — investigation + 5 years;
- Corporate documents and legal validity of signatures — permanent, by the nature of the record;
- Website analytics — 26 months;
- Ad measurement — 90 days (
_gcl_awcookie); - Preferences in your browser — until you clear them.
11. Security
Data in transit over TLS 1.2 or above. Data at rest encrypted, and backups encrypted.
Access is by role and scope — each person reaches only the data their job needs — and actions on personal data are recorded in an audit trail chained by hash, which does not allow retroactive alteration.
We keep a record of security incidents. If an incident poses relevant risk to your rights, we notify you and the ANPD (Brazil’s data protection authority), as article 48 requires.
12. Your rights, and how to exercise them
At any time you may:
- Confirm that processing exists and access your data;
- Correct incomplete, inaccurate or out-of-date data;
- Ask for anonymisation, blocking or deletion of unnecessary or excessive data;
- Ask for portability;
- Find out who we shared it with;
- Withdraw consent, and learn what happens if you do not consent;
- Object to processing carried out without consent.
The way to do it is the form at the end of this page. It opens a formal request with a protocol number and a counted deadline, going straight into the DPO’s queue — you do not need to know the legal name of what you want, just pick the sentence closest to your question. We reply within 15 days.
The form does not ask for identity documents, and you should not send a CPF, ID or photo of a document through it. If the request does require confirming it is you, the DPO arranges that in the reply, proportionately.
If you would rather write, privacidade@casahacker.org counts the same and carries the same deadline. And you may complain to the ANPD at any time.
13. Whistleblowing channel
Irregularities, harassment or ethical breaches have their own channel, confidential and independent of this policy: compliance.casahacker.org.
Identifying yourself is optional. When someone does identify themselves, their identity is protected and access is restricted to those investigating. Purging a case is a human act by the DPO, with no automation.
14. Changes to this policy
When this policy changes materially, we update the date at the top and, if the change affects a legal basis or widens a purpose, we tell you through the channels you already use with us.
Section anchors (#dados, #direitos, #solicitar…) are stable: a link you shared keeps working.