CMOC Brasil is the controller and determines the means and objectives of the processing of personal data. If CMOC collects your personal data or if you at some time inform your data, CMOC, according to the Brazilian General Data Protection Law (LGPD), will be your data controller. It will determine how your data will be processed, clarify the purpose and how it will be protected.

CMOC Brasil uses your personal data for the original purposes for which they are intended, with clearly informed purpose and expectation unless it is considered that there is a need to use them for another legal reason, i.e. to meet a legal obligation.

If necessary, we will ask for your consent and inform you of what the consequences will be if your consent is denied. Please be aware that your consent is not a condition or requirement to maintain a relationship with us.

Know that we may share your personal data with third parties but we will require the same security, integrity and privacy. Whenever this sharing occurs you will also be informed.

In some cases, you are free to refuse to provide your data or that CMOC has access to your personal data. However, if you refuse access to specific information, it may make your relationship with us unfeasible if we deem such data essential to promote effective, efficient and secure administration and management of our relationship.

For example, in the case of people representing suppliers or customers, if we do not have the ID and contact information of these people, we will not be able to communicate with them and proceed with our business transactions.

Remembering that we often collect data for legal, contractual obligations and for legitimate interests between us.

CMOC Brasil is committed to maintaining the security, integrity and privacy of the personal data you share with us. In order to honor this commitment, we have implemented technical, physical and organizational measures to ensure a level of security appropriate to the risks involved in the processing of your data and incident prevention.

Aiming at the constant evolution of personal data protection, CMOC Brasil strictly and constantly monitors the information security standards, as well as all the risks to the holders involved and forms of incident prevention. The company develops adequate processes and internal data protection and contracting policies for third parties that meet all legal requirements for adequacy and security determined by the General Data Protection Law.

CMOC Brasil has also instituted and stimulates a culture of principle of respect for privacy and security with all its employees who assume an important role in the protection of all data processed by the company.

In most cases, we receive personal data directly from you. You may provide them at the beginning of our relationship or at any other time, throughout your interactions with us, either personally or through our digital communication channels and platforms. This includes the personal data that you insert in physical forms, in any automatic attendance routine, in the media owned by CMOC Brasil or in presentation of documents to any member of our team.

Another way of generating personal data is related to the collection made from monitoring devices or by other means, for example: image monitoring systems, location, biometrics, sound recordings, Internet access and applications, use of company emails or other devices owned by the company. In such cases, the data may be collected by us or by third parties who provide services and help us in our operations.

Internal sharing:

At CMOC Brasil, your personal data can be accessed or disclosed internally by various areas as required. Personal data can also be shared with some interconnected systems, such as the billing system, human resources system, communication, etc.

External sharing:

Your personal data may also be shared or accessed by third parties, including suppliers, advisors, contractors or performance evaluators, supplier approvals agencies, credit assessment, partners in social responsibility projects, national authorities and governmental bodies.

The personal data contained in our servers can be accessed by the system suppliers themselves, their respective companies and subcontractors. But this is normal when there is support or maintenance of the structure of our computer systems that we acquire.

These third parties process all data made available to them in accordance with the contractual relationship that we maintain with them and the applicable legislation, including with regard to confidentiality and data security.

In addition, we can share the personal data with local authorities in order to fulfill a legal obligation to which we are subject.

There are cases in which we may have the need to disclose your personal data to third parties, to support in the management of our business and provision of our services.

We emphasize that CMOC Brasil maintains a strict level of demand of its third parties regarding the privacy, integrity and security of its data.

We share your personal data within the CMOC group of companies which also maintains its strict data security and privacy policies.

We will always take steps to ensure that any transfer of data and information outside of our country is carefully managed in order to protect your rights to privacy.

If you have any questions regarding transfers abroad, contact us for further details.

We will keep your personal data for as long as necessary for the purposes for which it was obtained.

In some cases, we may keep your personal data for longer periods in accordance with our data storage policy. For example: in cases where we are obliged to do so due to Brazilian legal, regulatory, fiscal or accounting requirements, to keep an accurate record of your agreements with us in cases of eventual claims or demands, or if we believe there are sufficient grounds that lead to a litigation related to your relationship with us.

We maintain policies that regulate the collection, use, access, retention and disposal of data in our care. These policies define our data management requirements, including guidance on maintaining personal data in the most up-to-date way possible, safely and in time.

In addition to your personal data, you may also provide us with the personal data of third parties, for example, your relatives or dependents, or your colleagues.

Before providing information about other people, you must inform them of your intention to provide this data to us, as well as what we will do with them. All of this data, whether yours or those related to you, is under the same technical data protection rules and measures and other instructions described in this statement.

The following rights may apply to you, depending on the nature of our relationship and activity that requires the processing of personal data, and the jurisdiction where the processing will take place: 

• Right of access, confirmation and correction of your personal data
• Data portability
• Right to correction or exclusion of the personal data
• Right to restriction of processing
• Right to cancel your consent
• Right to object to processing
• Right to review the automatic decision-making process
• Right to object to the way we use your personal datafor direct marketing or other routine purposes
• Right to obtain security guarantees of personal datathat we use for transfers and sharing  
• Right to complain to our data protection professional or a  regulatory authority