This is a translation. In case of any discrepancy, the Portuguese (Brazil) version prevails.
This policy describes how R F A R CARAPETO INFORMATICA (trade name UPTREND DIGITAL SOLUTIONS), CNPJ 33.766.592/0001-06, headquartered in São Paulo/SP, Brazil (“Uptrend”, “we”), processes personal data in connection with this website and the apps it develops for e-commerce platforms such as Nuvemshop, in accordance with Brazilian Law No. 13,709/2018 (General Data Protection Law, LGPD).
1. Roles
With respect to store data and the data of the store’s end customers accessed by our apps, the merchant is the controller and Uptrend acts as processor, processing the data according to the merchant’s instructions. With respect to the merchant’s own account and contact data, Uptrend is the controller.
2. Data collected
- Store data: store identifier, name, URL, email and contact details of the person in charge, provided by the platform at installation.
- Data accessed through the platform’s API: only the scopes authorized at installation, such as products, orders and end-customer data required for the app to work (for example, name, email, phone number and the date/time chosen in a booking).
- Technical data: access logs (IP address, date and time), kept for 6 months as required by Brazil’s Internet Civil Rights Framework (Marco Civil da Internet).
- Communications: messages sent to our support.
3. Purposes and legal bases
- Providing the features of the contracted app (performance of a contract).
- Billing and compliance with legal and tax obligations (legal obligation).
- Support, security and fraud prevention (legitimate interest).
We do not sell personal data or use it for third-party advertising.
4. Sharing
Data may be processed by infrastructure providers (cloud hosting) and by the e-commerce platform itself, only to the extent necessary. These providers may be located outside Brazil, subject to the safeguards of Article 33 of the LGPD. We may also share data under a court order or where required by law.
5. Retention and deletion
- Data is kept while the app is installed in the store.
- When the app is uninstalled, the access token is revoked and the data of the store and its customers is deleted within 30 days, except data we are required to keep by law.
- We act on data deletion requests sent by the platform (for example, Nuvemshop’s LGPD webhooks) and by the merchant.
6. Security
We adopt reasonable technical and organizational measures, such as encrypted communication (HTTPS), access control and least-privilege access to data.
7. Data subject rights
Data subjects may request confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing and withdrawal of consent (Article 18 of the LGPD). End customers of a store should preferably contact the merchant (controller); we will assist in handling the request. It is also possible to lodge a complaint with the ANPD (Brazil’s National Data Protection Authority).
8. Data protection officer and contact
Privacy requests: [email protected].
9. Changes
This policy may be updated; the date at the top indicates the current version.