Privacy Policy

1. Who we are and scope

Veridati Ltda. is a Brazilian company responsible for the Veridati operational verification platform.

This Policy applies to website visitors, platform users, customer representatives, prospective customers, suppliers, partners and other people who interact with Veridati.

2. Veridati's roles under data protection law

Veridati may act as controller or processor depending on the purpose of processing.

We act as controller for purposes such as account registration, billing, security, fraud prevention, support, commercial relationships and legal compliance.

When a customer uses the platform to process personal data within its own operational procedures, the customer generally acts as controller and Veridati acts as processor according to the customer's documented instructions and applicable contract.

3. Categories of personal data

Depending on how the services are used, we may process the following categories of data:

• Identification and contact data, such as name, email, phone, role, company and account identifiers.
• Authentication and security data, such as protected credentials, session logs, login attempts, IP address where applicable and technical security records.
• Professional and organizational data, including organization, team, role, associated locations and permissions.
• Operational data, such as task and checklist answers, comments, approvals, rejections and execution records.
• Evidence data, including photographs captured in the application, date, time, geolocation and distance from a registered location.
• Device and browser data, such as operating system, browser version, language and application logs.
• Support and commercial communications.
• Billing and subscription records. Full payment card data is handled by the payment provider and is not intended to be stored directly by Veridati.

4. Sensitive personal data

Veridati is not designed to require routine processing of sensitive personal data. Customers should not submit sensitive data unless there is a legitimate need, an appropriate legal basis and suitable safeguards.

Where a customer requires such processing, the customer remains responsible for defining the legal basis and purpose, without prejudice to Veridati's obligations as processor.

5. Purposes of processing

• Create, authenticate and administer accounts and organizations.
• Provide tasks, checklists, evidence, reporting and organizational features.
• Maintain operational traceability.
• Provide technical and commercial support.
• Process subscriptions and billing.
• Protect accounts, infrastructure and data against unauthorized access, abuse, fraud and security incidents.
• Comply with legal and regulatory obligations and valid orders.
• Establish, exercise or defend legal claims.
• Measure and improve website and platform performance, subject to cookie rules.
• Send transactional and, where permitted, commercial communications.

6. Legal bases

Processing is carried out under the legal bases provided by Brazil's General Data Protection Law (Lei nº 13.709/2018 — LGPD), depending on the context.

Legal bases may include contract performance, preliminary procedures related to a contract, legal or regulatory obligations, exercise of rights, legitimate interests, credit protection where applicable and consent when legally appropriate.

Consent is not used as a generic basis for all processing. Where consent is the appropriate basis, it will be specific, informed and revocable.

7. Geolocation and photographic evidence

The platform may capture geolocation and photographs as operational evidence when customers use those features.

Evidence photographs are captured directly in the application and may be associated with date, time and geographic coordinates. The platform may compare the captured coordinates with the registered operational location and show the distance in reports.

Customers, as controllers of their operations, are responsible for ensuring that these features are appropriate, necessary and transparent to affected individuals.

8. Service providers and sharing

Veridati may use specialized providers for cloud infrastructure, hosting, databases, storage, email delivery, observability, security, support, payments and other auxiliary services.

Providers receive only data necessary for their respective purposes and are subject to contractual confidentiality, security and data protection obligations.

Veridati does not sell personal data.

9. Data storage and location

Operational platform data, including databases and evidence files, is stored on infrastructure located in Europe, on servers of an infrastructure provider that applies security controls consistent with Veridati’s technical requirements.

Because Veridati is a Brazilian company and data is stored outside Brazil, this storage constitutes an international data transfer, carried out with the safeguards and mechanisms provided for by the LGPD and by ANPD regulations.

Ancillary services that may be engaged, such as payment processing, email delivery, abuse protection, monitoring or support, may also involve processing by third parties and international data transfers. In such cases, Veridati will adopt the mechanisms and safeguards required by the LGPD and by ANPD regulations, and this Policy will be updated when necessary.

10. Retention and deletion

Data is retained for as long as necessary for the purposes described in this Policy, legal and contractual obligations and the exercise of rights.

After an organization cancels, Veridati currently plans an operational retention period of 30 days to allow reactivation and recovery, unless a different period is required by law, valid order or another legitimate basis.

After applicable periods expire, data may be deleted or anonymized, subject to lawful retention requirements.

Audit and security records may follow their own retention periods, consistent with traceability, security and compliance purposes.

• Permanently deleted after the retention period: locations, team members, checklists, tasks, executions, and photo evidence.
• Kept for tax purposes, even after deletion: billing and invoicing records (amount, date, and status).

11. Information security

Veridati adopts technical and administrative safeguards proportionate to the data and risks involved, including access controls, logical organization segregation, encryption in transit and at rest, credential management, optional 2FA, backups and monitoring.

No environment is completely risk-free. Security controls are reviewed and may evolve over time.

12. Security incidents

If a personal data security incident occurs, Veridati will take appropriate containment, investigation and remediation measures.

Where applicable law or ANPD regulation requires notification, Veridati will follow the applicable criteria and deadlines and cooperate with customer controllers when acting as processor.

13. Data subject rights

Under the LGPD, the data subject may, where applicable, request:

• confirmation that processing exists;
• access;
• correction;
• anonymization, blocking or deletion in legally applicable cases;
• data portability where applicable;
• deletion of data processed on consent, subject to lawful retention;
• information about sharing;
• information about consequences of refusing consent;
• withdrawal of consent;
• objection where applicable;
• review of decisions based solely on automated processing where applicable.

14. Exercising rights

Privacy requests may be sent to privacy@veridati.online or dpo@veridati.online.

Veridati may request reasonable information to verify the requester and prevent unauthorized disclosure.

Requests will be handled under applicable legal requirements.

15. Children and adolescents

The platform is intended for organizations and professional users and is not designed for autonomous use by children.

If a customer uses the platform in a context involving minors, the customer must ensure compliance with specific legal requirements, including the best interests of children and applicable legal bases.

16. Cookies and similar technologies

The website may use cookies and similar technologies for operation, security, preferences and, if implemented, analytics or marketing.

Non-essential cookies will be managed according to user choices and ANPD guidance. See the Cookie Policy for details.

17. Changes to this Policy

This Policy may be updated to reflect changes in law, services, providers or processing practices.

Material changes will be communicated by reasonable means and the effective date will be updated.

18. DPO and contact

Data Protection Officer (DPO): Irineu R.

Email: dpo@veridati.online

Privacy channel: privacy@veridati.online

Institutional address: Av. Alvares de Azevedo, 403, Jundiaí, São Paulo, 13215-150, Brazil.