1. General Information

This Privacy Policy contains information on how the personal data of users who access EBP Brazil's website are treated, totally or partially, in an automated way or not, and its purpose is to clarify those interested about the types of data that are collected, the reasons for the collection and the way the user may update, manage or delete this information.

This Privacy Policy is in accordance with Federal Law No. 12,965 of 23 April 2014 (Internet Civil Framework), Federal Law No. 13,709 of 14 August 2018 (Personal Data Protection Law) and EU Regulation No. 2016/679 of 27 April 2016 (General European Regulation on Personal Data Protection - RGDP) and may be updated as a result of any regulatory update, which is why it is recommended that the user periodically consult this section.

2. User Rights

 The treatment of personal data by EBP Brazil will follow, among others, the rules set forth in the RGPD, respecting the following principles:

- The user's personal data will be processed in a lawful, loyal and transparent way (lawfulness, loyalty and transparency);

- The user's personal data will be collected only for determined, explicit and legitimate purposes, and may not be further processed in a manner incompatible with these purposes (purpose limitation);

- The user's personal data will be collected in an adequate, pertinent and limited way to the needs of the purpose for which they are processed (data minimization);

- The user's personal data will be accurate and updated whenever necessary, so that inaccurate data will be deleted or rectified when possible (accuracy);

- The user's personal data will be kept in a way that allows the identification of the data subjects only for the period necessary for the purposes for which they are processed (conservation limitation);

- The user's personal data will be treated in a safe way, protected from unauthorized or illicit treatment and against their loss, destruction or accidental damage, adopting the appropriate technical or organizational measures (integrity and confidentiality).

These are rights of the User, conferred by the Personal Data Protection Law and the RGPD:

- Right of confirmation and access: is the right of the user to obtain confirmation of whether or not personal data concerning him/her are being processed and, if so, the right to access his/her personal data;

- Right of rectification: it is the right of the user to obtain, without undue delay, the rectification of inaccurate personal data concerning him/her;

- Right to delete data (right to forget): is the right of the user to have his data deleted;

- Right to limitation of data processing: it is the right of the user to limit the processing of his personal data and to obtain it when he disputes the accuracy of the data, when the processing is unlawful, when the storage of his data is no longer necessary for the purposes proposed and when he has opposed the processing of the data and in case of unnecessary processing;

- Right of opposition: it is the right of the user to object at any time, for particular reasons, to the processing of personal data concerning him/her, being also able to object to the use of his/her personal data to define a marketing profile (profiling);

- Right of data portability: it is the right of the user to receive his/her personal data concerning him/her in a structured format, of current use and automatic reading, and the right to transmit such data to another recipient, as indicated;

- The right not to be subjected to automated decisions: this is the right of the user not to be subject to any decision taken solely based on automated processing, including profiling, which produces legal effects or affects him in any other way.

The user may exercise his rights by means of written communication sent to the site with the subject "RGDP-https://www.ebpbrasil.com.br", specifying:

- Full name or corporate name, CPF (Individual Taxpayer Registry) or CNPJ (National Registry of Legal Entities) number and e-mail address of the user and, if applicable, of his/her representative;

- Right you wish to exercise;

- Date of order and user signature;

- Any document that can demonstrate or justify the exercise of his right.

The request should be sent to the e-mail: dpo@ebpbrasil.com.br, or by mail to the following address:

EBP Brasil Consultoria e Engenharia Ambiental Ltda

Avenida das Nações Unidas, 14.261, block A1, 16th floor. Vila Gertrudes - São Paulo, SP 04533-085

The user will be informed about the fulfilment of your request.

3. Duty Not to Provide Third Party Data

While using the website, in order to safeguard and protect the rights of third parties, the user of the website shall only provide his/her personal data, and the provision of third parties' personal data is prohibited.

4. Information Collected

The collection of data from users will be in accordance with the provisions of this Privacy Policy and will depend on the consent of the user, which is dispensable only in the cases provided for in art. 11, item II, of the Personal Data Protection Law.

4.1 Types of data collected

4.1.1 User identification data for registration

The use, by the user, of certain functionalities of the site will be conditioned to prior registration, in which case the following user data will be collected and stored:

- full name;

- e-mail address;

- postal address;

- telephone number;

- Company name;

- Subject and message.

4.1.2 Data entered on the contact form

The data eventually informed by the user who uses the contact form available on the site, including the content of the message sent, will be collected and stored, observing the terms contained in this Policy.

4.1.3 Newsletter

The e-mail address registered by the user who chooses to subscribe to our Newsletter will be collected and stored until the user requests his/her unsubscription.

4.1.4 Sensitive data

No sensitive data will be collected from users, understood as those defined in articles 9 and 10 of the RGPD and in articles 11 and following of the Personal Data Protection Law. Thus, among others, the following data will not be collected:

- data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or the user's union membership;

- genetic data;

- biometric data to uniquely identify a person;

- data concerning the health of the user;

- data relating to the user's sexual life or sexual orientation;

- data related to criminal convictions or violations or related security measures.

4.1.5 Collection of data not expressly foreseen

Eventually, other types of data not expressly provided for in this Privacy Policy may be collected, provided that they are provided with the consent of the user, or that the collection is permitted or imposed by law.

4.2 Legal basis for the treatment of personal data

By using the services of the site, the user is consenting to this Privacy Policy.

The user has the right to revoke his/her consent at any time, not compromising the lawfulness of the treatment of his/her personal data before the withdrawal. The withdrawal of consent may be made by e-mail: dpo@ebpbrasil.com.br, or by mail sent to the following address:

Avenida das Nações Unidas, 14.261, block A1, 16th floor. Vila Gertrudes - São Paulo, SP 04533-085

The consent of the relatively or absolutely incapable, especially of children under the age of 16 (sixteen), can only be made, respectively, if properly assisted or represented.

The processing of personal data without the user's consent will only be carried out based on legitimate interest or for the hypotheses provided for by law, i.e., among others, the following:

- for the controller's compliance with a legal or regulatory obligation;

- for the carrying out of studies by a research agency, guaranteeing, whenever possible, the anonymization of personal data;

- when necessary for the execution of a contract or preliminary procedures related to a contract to which the user is a party, at the request of the data owner;

- for the regular exercise of rights in judicial, administrative or arbitral proceedings, the latter under the terms of Law No. 9307 of September 23, 1996 (Arbitration Law);

- for the protection of the life or the physical safety of the data subject or third parties;

- for the protection of health, in procedures performed by health professionals or health entities;

- when necessary to meet the legitimate interests of the controller or third parties, except in the case of prevailing fundamental rights and freedoms of the data owner that require the protection of personal data;

- for the protection of credit, including the provisions of the pertinent legislation.

4.3 Purposes of processing personal data

The personal data of the user collected by the site are intended to facilitate, expedite and fulfil the commitments established with the user and to enforce the requests made through the completion of forms.

The personal data may also be used for commercial purposes, to personalize the content offered to the user, as well as to subsidize the site to improve the quality and functioning of its services.

The registration data will be used to allow the user access to certain contents of the site, exclusive for registered users.

The treatment of personal data for purposes not foreseen in this Privacy Policy will only occur upon prior communication to the user, and in any case, the rights and obligations provided herein will remain applicable.

4.4 Period of conservation of personal data

The user's personal data will be kept for a period no longer than is required to fulfil the purposes for which they are processed.

The data retention period is defined according to the following criteria:

There are no criteria for deleting the data. The data may be deleted at the express request of the user.

The personal data of the users may only be conserved after the end of their processing in the following cases:

- for the controller's compliance with a legal or regulatory obligation;

- for study by a research organization, anonymization of personal data is guaranteed whenever possible;

- for the transfer to a third party, provided that the data processing requirements established by law are respected;

- for the exclusive use of the controller, prohibited its access by third parties, and provided that the data are anonymized.

4.5 Recipients and transfer of personal data

The user's personal data may be shared with the following persons or companies:

GOOGLE BRASIL INTERNET LTDA, with address to Av. Brigadeiro Faria Lima, n. 3477, Itaim Bibi, São Paulo/ SP CEP 04538-133.

The transfer can only be made to another country if the country or territory in question or the international organization in question ensures an adequate level of protection of the user's data.

If there is not an adequate level of protection, EBP Brazil undertakes to guarantee the protection of your data in accordance with the strictest rules, by means of specific contractual clauses for a given transfer, standard contractual clauses, global corporate rules or seals, certificates and codes of conduct regularly issued.

5. Processing of Personal Data

5.1 The data controller

The controller, responsible for the processing of the user's personal data, is the natural or legal person, public authority, agency or other body that, individually or jointly with others, determines the purposes and means of processing personal data.

In this site, the responsible for the treatment of personal data collected is EBP Brasil Consultoria e Engenharia Ambiental Ltda, represented by Sérgio Marcos Martins Strutzel, who may be contacted by e-mail: sergio.martins@ebpbrasil.com.br or at the address:

Avenida das Nações Unidas, 14.261, block A1, 16th floor, São Paulo/SP

The data controller will be directly in charge of the processing of the user's personal data.

5.2 The data protection officer

The data protection officer is the professional in charge of informing, advising and controlling the data controller, as well as the employees who process the data, regarding the obligations of the site in accordance with the RGDP, the Personal Data Protection Act and other data protection provisions present in national and international legislation, in cooperation with the competent supervisory authority.

The data protection officer for this website is João Castro, who can be contacted by e-mail: joao.castro@ebpbrasil.com.br.

6. Security in Processing the User's Personal Data

EBP Brazil is committed to applying technical and organizational measures to protect personal data from unauthorized access and from situations of destruction, loss, alteration, communication or dissemination of such data.

To ensure security, solutions will be adopted that consider: the appropriate techniques; the costs of implementation; the nature, scope, context and purposes of treatment; and the risks to the rights and freedoms of the user.

EBP Brazil's website uses SSL (Secure Socket Layer) certificate that guarantees that personal data are transmitted in a safe and confidential manner, so that the transmission of data between the server and the user, and in feedback, occurs in a fully encrypted or encrypted manner.

However, EBP Brazil disclaims liability for exclusive fault of third parties, such as in case of attack by hackers or crackers, or exclusive fault of the user. EBP Brazil also undertakes to notify the user in an appropriate time in case of any type of violation of the security of his personal data that may cause him a high risk for his personal rights and freedoms.

Violation of personal data is a breach of security that causes, in an accidental or illicit manner, the destruction, loss, alteration, disclosure or unauthorized access to personal data transmitted, stored or subject to any other type of treatment.

EBP Brazil undertakes to treat the user's personal data with confidentiality, in accordance with this Policy and the applicable legislation.

7. Navigation Data (cookies)

Cookies are small text files sent by the site to the user's computer and stored there, with information related to the navigation of the site.

By means of cookies, small amounts of information are stored by the user's browser so that our server can read them later. For example, data on the device used by the user, as well as its location and time of access to the website may be stored.

Cookies do not allow any file or information to be extracted from the user's hard disk, and it is not possible, through them, to have access to personal information that has not left the user or the way the site's resources are used.

It is important to point out that not every cookie contains information that allows the identification of the user, and certain types of cookies can be used simply for the site to be loaded correctly or for its functionalities to work as expected.

The information eventually stored in cookies that allow the identification of a user is considered personal data. Therefore, all the rules provided in this Privacy Policy are also applicable to them.

7.1 Third party cookies

Some of our partners may set cookies on the devices of users who access the EBP Brazil site.

These cookies, in general, aim to enable our partners to offer their content and services to the user who accesses our website in a personalized way, by obtaining navigation data extracted from their interaction with EBP Brazil website.

The user may obtain more information about third party cookies and the way the data obtained from them are treated, besides having access to the description of cookies used and their characteristics, by accessing the following link:

Google Analytics

https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage?hl=pt-br

The entities in charge of collecting cookies may assign the information obtained to third parties.

7.2 Social network cookies

EBP Brazil's website uses social networking plugins, which allow access from the website. Thus, by doing so, the cookies used by them may be stored in the user's browser.

Each social network has its own privacy and personal data protection policy, being the individuals or legal entities that keep them responsible for the data collected and the privacy practices adopted.

The user may search, together with the social networks, information about how their personal data are treated. For information purposes, we provide the following links, from which the privacy and cookie policies adopted by some of the main social networks may be consulted:

Facebook: https://www.facebook.com/policies/cookies/

Twitter: https://twitter.com/pt/privacy

Instagram: https://help.instagram.com/1896641480634370?ref=ig

Youtube: https://policies.google.com/privacy?hl=pt-BR&gl=pt

Google+: https://policies.google.com/technologies/cookies?hl=pt

Pinterest: https://policy.pinterest.com/pt-br/privacy-policy

LinkedIn: https://www.linkedin.com/legal/cookie-policy?trk=hp-cookies

7.3 Managing cookies and browser settings

The user may oppose the registration of cookies by the site, simply by disabling this option in your own browser or device.

The deactivation of cookies, however, may affect the availability of some tools and functionalities of the website, compromising its correct and expected functioning. Another possible consequence is the removal of the user's preferences that may have been saved, impairing his or her experience.

The following are some links to the help and support pages of the most used browsers, which can be accessed by the user interested in obtaining more information about the management of cookies in his browser:

Internet Explorer:      

https://support.microsoft.com/pt-br/help/17442/windows-internet-explorer-delete-manage-cookies

Safari:

https://support.apple.com/pt-br/guide/safari/sfri11471/mac

Google Chrome:       

https://support.google.com/chrome/answer/95647?hl=pt-BR&hlrm=pt

Mozilla Firefox:         

https://support.mozilla.org/pt-BR/kb/ative-e-desative-os-cookies-que-os-sites-usam

It operates:    

https://www.opera.com/help/tutorials/security/privacy/

8. Complaint to a Control Authority

Without prejudice to any other administrative or judicial remedy, all data subjects have the right to lodge a complaint with a control authority. The complaint may be made to the authority of the site's headquarters, the user's country of habitual residence, his/her place of work or the place where the alleged infringement was committed.

9. Changes

This Privacy Policy was last updated on: 08/25/2020.

The editor reserves the right to modify, at any time, the present rules, especially to adapt them to the evolutions of EBP Brazil's website, either by making new functionalities available, or by suppressing or modifying those that already exist.

The user will be notified in case of modification of this policy.

By using the service after eventual modifications, the user demonstrates his agreement with the new standards. If you disagree with any of the modifications, you must immediately request the cancellation of your account and submit your reservation to the service, if you so wish.

10. Applicable Law and Jurisdiction

Any controversies arising from this Policy shall be settled through the application of Brazilian Law.