Privacy Policy and LGPD

Personal data processing within the Lumiardi platform is carried out by LUMIARDI GESTÃO DE CONTEÚDO LTDA., headquartered at Av. Alm. Julio de Sá Bierrenbach, 65 – Bloco 2 – Sala 315 – Barra Olímpica, Rio de Janeiro/RJ, acting as Controller under art. 5, VI, of Law No. 13,709/2018 (LGPD).

Direct privacy and data subject communication channel: contact@lumiardi.com.

2.1. Depending on the nature of the user's relationship with the platform, the following may be processed:

3.1. The personal data collected is processed in strict compliance with the necessity principle for the following purposes:

4.1. Every data processing activity at Lumiardi is duly grounded on the legal bases authorized by the LGPD:

• Performance of a contract: to provide the contracted services (art. 7, V);
• Compliance with a legal or regulatory obligation: fulfillment of tax obligations and retention of logs under the Marco Civil da Internet (art. 7, II);
• Regular exercise of rights: in administrative, arbitral or judicial proceedings (art. 7, VI);
• Fraud prevention and data subject security: in registration identification and authentication processes (art. 11, II, 'g');
• Legitimate interest: to improve features and security (art. 7, IX);
• Consent: where expressly required for specific purposes (art. 7, I).

5.1. Where biometric data (such as facial liveness checks for accreditation) or other sensitive data is processed, Lumiardi will apply a specific legal basis (fraud prevention and security under art. 11, II, 'g' of the LGPD), reinforced encryption controls and ongoing assessment of necessity and proportionality.

6.1. Lumiardi may use specialized document verification and age-check providers holding international security certifications.

6.2. Whenever technically possible and feasible, priority will be given to obtaining strictly the result required for the age decision (e.g. over 18: pass/fail), minimizing the retention of raw files.

7.1. Data may be shared, on a strict and secure basis, with partners essential to the provision of the services:

8.1. Lumiardi enters into formal agreements with all its data processors and sub-processors, setting strict obligations regarding information security, confidentiality, strict purpose limitation, retention periods, incident notification and restrictions on subcontracting.

9.1. International data transfers (such as to AWS/Cloudflare cloud servers located abroad) will be carried out through legitimate mechanisms provided for in the LGPD and in the regulations issued by the ANPD.

9.2. The ANPD has specific regulations on international transfers and standard contractual clauses, which are strictly observed by Lumiardi.

10.1. Personal data will be retained only for the period strictly necessary to:

• Achieve the purposes for which it was collected;
• Comply with legal or regulatory retention obligations;
• Ensure the regular exercise of rights in potential claims;
• Prevent fraud and maintain system security;
• Legitimately preserve audit evidence.

11.1. Lumiardi adopts robust technical and administrative measures to protect personal data against unauthorized access, leaks or incidents:

12.1. Lumiardi maintains a formal procedure for responding to and remediating information security incidents.

12.2. Where a security incident may pose a relevant risk or harm to data subjects, the procedures and deadlines for notifying the National Data Protection Authority (ANPD) and the affected data subjects will be strictly observed, pursuant to CD/ANPD Resolution No. 15/2024.

13.1. In accordance with art. 18 of the LGPD, the data subject may, by formal request through the privacy channel, request:

14.1. The platform uses strictly necessary and analytics cookies for:

• Authentication and maintaining a secure session;
• Fraud prevention and mitigation of cyberattacks;
• Operational functioning and system stability;
• Analysis of performance metrics and telemetry;
• Preserving the user's language and browsing preferences.

18.1. This Privacy Policy may be updated periodically to reflect legislative, ANPD regulatory, technological or operational developments of the platform. Previous versions may be made available upon request through the data subject channel.