1. Introduction

This Privacy Policy (“Policy”) governs the processing of personal data carried out by Instituto Biosistêmico – IBS (“IBS”, “we”, “us”) in connection with the operation of www.biosistemico.org.br and other digital and physical channels (“Channels”). Our goal is to provide transparency about the collection, use, sharing, retention, and deletion of personal data in compliance with Law No. 13,709/2018 (the Brazilian General Data Protection Law, “LGPD”) and related rules.

By using the Channels or providing data through forms, cookies, newsletters, or other means, the data subject (“you”, “Data Subject”) acknowledges this Policy.

2. Scope

This Policy applies to processing carried out by IBS as the data controller, including through contracted processors and suppliers. It does not apply to third-party websites or services that are not operated or controlled by IBS.

3. Data collected and legal bases

3.1 Types of data

Identification and contact data: name, CPF/CNPJ, email, telephone number, and address;
Browsing data: IP address, cookies, device, operating system, pages accessed, and time spent;
Location data, when relevant and with consent;
Third-party login data if you use social network credentials;
Sensitive data (e.g., health or biometric data) only under a specific legal basis and for a defined purpose.

3.2 Legal bases (Article 7 of the LGPD)

The Data Subject’s consent, when required;
Compliance with a legal or regulatory obligation;
Performance of contracts and preliminary procedures;
The regular exercise of rights in judicial, administrative, or arbitral proceedings;
Protection of the life or physical safety of the Data Subject or third parties;
IBS’s legitimate interest, subject to an impact assessment and the Data Subject’s rights.

4. Purposes of processing

Providing services, institutional relationships, newsletters, and communications;
Registration, enrollment, billing, and management of agreements and partnerships;
Managing and carrying out projects, including social and environmental impact reports;
Statistical analysis and production of indicators using aggregated or anonymized data;
Information security, fraud prevention, and keeping the Channels operating;
Compliance with legal, regulatory, and contractual obligations.

5. Sharing and transfers

5.1 Sharing

We may share personal data with partners, suppliers, and service providers that support our operations under contracts requiring confidentiality and adequate protection. We do not sell personal data.

5.2 International transfers

When necessary, data may be transferred abroad in accordance with Articles 33 to 36 of the LGPD, based on appropriate safeguards (such as standard contractual clauses) or other circumstances provided for by law and ANPD guidelines.

6. Cookies and similar technologies

We use cookies to operate the Site, obtain statistics, and, when applicable, for marketing purposes. You can manage your preferences in your browser or device, understanding that disabling strictly necessary cookies may affect functionality.

7. Retention and deletion

Data is kept for as long as necessary to fulfill the stated purposes and legal obligations. After that period, it will be deleted or anonymized, except where the law requires or permits retention.

8. Data Subject rights

Confirmation of the existence of processing and access to data;
Correction of incomplete, inaccurate, or outdated data;
Anonymization, blocking, or deletion of unnecessary data or data processed in violation of the law;
Portability, when applicable;
Deletion of data processed on the basis of consent;
Information about use and sharing;
Withdrawal of consent;
Objection to processing based on legitimate interest, under the terms of the law;
Filing a petition with the ANPD in case of a violation of rights.

To exercise your rights, contact our Data Protection Officer (item 9) and clearly describe your request. Manifestly unfounded or excessive requests may be refused or charged for, as permitted by the LGPD.

9. Data Protection Officer (DPO) and contact

Email: privacidade@biosistemico.com.br

Address: Av. Antonia Pazzinatto Sturion, 337 – Piracicaba – SP, Brazil

10. Information security

We adopt appropriate technical and organizational measures to protect personal data. If you identify a vulnerability or incident, notify us immediately through the DPO channel. Where required by the LGPD, we may notify the ANPD and affected Data Subjects.

11. Updates to this Policy

This Policy may be updated periodically. Material changes will be communicated through a notice on the Site or by email, when appropriate.

12. Final provisions

This Policy is governed by Brazilian law. The courts of the Judicial District of Piracicaba, São Paulo, Brazil, are elected as the forum, except where the law provides otherwise.