Cirion processes personal data in accordance with the guidelines of the Brazilian General Data Protection Law – Law 13,709/2018 (“LGPD”) and other relevant legislation.

In that sense, it is possible to point out that in its processes there are treatments that involve:

• Personal data (Art. 5, I, LGPD): Information relating to an identified or identifiable natural person. Cirion collects information from its customers at the time of prospecting, contracting, or using services, through service channels or an electronic form available on the website of the company.
• Sensitive Personal Data (Art. 5, II, LGPD): Data related to racial or ethnic origin, religious belief, political opinion, affiliation to a union or an organization of religious, philosophic or political nature, data related to health or sexual habits, genetic or biometric data, when connected to a natural person. The sensitive personal data collected by Cirion is from our employees, to comply with a legal or regulatory obligation.
• Children and teenager personal data (Art. 14, LGPD) – The data is collected by Cirion to comply with a legal or regulatory obligation due to benefits extended to the dependents of Cirion employees, as well as the young apprentice program. Cirion does not collect data from minors for other purposes.
• Personal data publicly available (Art. 7, § 3, LGPD) – data manifestly made public by the Data Subject.
• Data Subject: a natural person to whom the personal data that are the object of processing refer to.
• Controller: natural person or legal entity of either public or private law in charge of making the decisions regarding the processing of personal data.

Cirion declares its commitment to the principle of data quality, ensuring that the personal data collected and processed is accurate, relevant, and specific.  

a. Legal hypotheses applicable to the processing of personal data carried out by Cirion

Cirion supports its data processing operations with the following legal hypotheses: 

• Compliance with a legal or regulatory obligation: data processing is justified by the obligation to comply with applicable laws.
• Contract execution or preparation: the processed data is used specifically for the preparation of the contract and throughout the performance of the contract.
• Regular exercise of rights: the data may be used in judicial, administrative or arbitration proceedings.
• Consent:the consent provided by the Data Subject is the free, informed, and unequivocal manifestation by which the Data Subject has agreed to the processing of his/her personal data for a specific purpose.
• Legitimate interest: the legitimate interest of the Controller may base the processing for legitimate purposes, judged on the basis of concrete situations, which include, but are not limited to: (i) Support and promotion of the Controller’s activities; (ii) Protection, in relation to the Data Subject, of the regular exercise of his/her rights or provision of services that benefit him/her, respecting his/her legitimate expectations and fundamental rights and liberties. 

b. Rights of Data Subjects

Upon request to Cirion, as provided for in article 18 of LGPD, Data Subject may exercise the following rights:

• Confirmation of processing existence – the Data Subject will obtain information on the existence or not of personal data in the Cirion database;
• Data access – the Data Subject may obtain a report of all the data contained in the Cirion database, with information on the origin, forms of processing and sharing with third parties;
• Data correction – the Data Subject may request the correction of incomplete, inaccurate, or outdated personal data;
• Data portability – the standard for portability will still be defined by the National Data Protection Authority (ANPD);
• Deletion of personal data – the Data Subject may request the deletion of the personal data processed by Cirion, the request for which will be subject to a feasibility assessment, in accordance with the law;
• Information on sharing – The Data Subject may request specific information about the sharing of data with public and private entities;
• Anonymizing or blocking – The Data Subject will have the request registered for execution, within the legal deadline. Important: anonymized data is that relating to a Data Subject who cannot be identified, considering the use of reasonable technical means available at the time of its processing;
• Automated Decision – The Data Subject will receive explanations about automated decisions, such as the use of robots to collect data for the creation of online marketing campaigns, and may request their review;
• Objection to data processing – The Data Subject may object to certain types of processing and purposes;
• Revocation of consent – The Data Subject may receive explanations about the consent (confirmation given for the collection and processing of their data) and request its revocation;
  • 1º If the Data Subject withdraws consent for purposes that are fundamental to the regular functioning of this website, some environments and services may be unavailable for the use by the Data Subject.
  • 2º Even if the Data Subject requests the deletion of his/her Personal Data, there are hypotheses in which such data may be kept stored, due to the provisions of article 16 of the LGPD: (i) compliance with a legal or regulatory obligation by the Controller; (ii) study by a research body, ensuring, whenever possible, the anonymization of personal data; and (iii) transfer to a third party, provided that the data processing requirements set forth in the LGPD are respected; or (iv) exclusive use by the Controller, with no access by third parties, and provided that the data is anonymized.

Cirion´s Data Protection Officer will receive the request from the Data Subject via the portal available at www.ciriontechnologies.com or by e-mail to the following address: data.privacy@ciriontechnologies.com, and will take the necessary steps to return within the period provided for by law, up to 15 days after receiving the request.