PRIVACY AND DATA PROTECTION POLICY

Presentation

PCA Engenharia de Software Ltda. is committed to protecting privacy, information security, and the personal data processed in the course of its activities.

As a company operating in the software development and information technology services sector, PCA processes the personal data of employees, customers, suppliers, business partners, service providers, and other stakeholders, in strict compliance with the principles and requirements established by the Brazilian General Data Protection Law (Law No. 13,709/2018 – LGPD).

This Privacy Policy aims to transparently explain how personal data may be collected, used, stored, protected, and shared by the organization, as well as to clarify the rights of data subjects and the channels available for handling their requests.

 

Commitment to Data Protection

PCA adopts technical and organizational measures aimed at ensuring the confidentiality, integrity, and availability of the information under its responsibility.

Personal data is processed in an ethical, transparent manner and in accordance with the legitimate purposes for which the data was collected, respecting the rights of data subjects and the applicable legal and regulatory requirements.

 

Fundamental Concepts

To facilitate the understanding of this policy, some important concepts established by the LGPD are highlighted below:

• Personal Data

  Information relating to an identified or identifiable natural person, such as name, taxpayer identification number (CPF), address, telephone number, email address, identification documents, and other data capable of identifying them directly or indirectly.

• Sensitive Personal Data

  Information relating to racial or ethnic origin, religious beliefs, political opinions, trade union membership, data concerning health, sex life, genetic data, or biometric data, when linked to a natural person.

• Data Subject

  Natural person to whom the personal data relates.

• Data Processing

  Any operation performed on personal data, including collection, receipt, classification, use, access, storage, sharing, transfer, deletion, and other forms of processing.

• Controller

  Natural or legal person responsible for making decisions regarding the processing of personal data.

• Operator

  Natural or legal person that processes personal data on behalf of the controller and in accordance with its instructions.

• Data Protection Officer (DPO)

  Professional designated to act as a communication channel between the organization, data subjects, and the National Data Protection Authority (ANPD).

 

Collection and Use of Personal Data

PCA may collect and process personal data strictly necessary for the development of its activities and for compliance with legal, contractual, and regulatory obligations.

 

Customers

Data necessary for the provision of contracted services, business relationships, technical support, billing, and communication with representatives, users, and contacts designated by customers may be collected.

 

Fornecedores e Parceiros

Registration, contractual, financial, and contact data necessary for managing the business relationship and carrying out the contracted activities may be processed.

 

Employees and Interns

The data necessary to comply with labor, social security, union, tax, administrative, and operational obligations related to human resources management are processed.

 

Service Providers and Third Parties

The data necessary for contract formalization, service execution, access control, and compliance with applicable legal requirements may be processed.

 

Principles Applied to Data Processing

PCA processes personal data in accordance with the principles established by the LGPD:

• Purpose;
• Suitability;
• Necessity;
• Free Access;
• Data Quality;
• Transparency;
• Security;
• Prevention;
• Non-discrimination;
• Accountability and Compliance.

These principles guide all activities related to data protection within the organization.

 

Information Security

PCA maintains physical, logical, and administrative security controls to protect personal data against unauthorized access, loss, destruction, alteration, or improper disclosure.

Among the measures adopted, the following stand out:

• Access control based on roles and need-to-know principles;
• Monitoring of Access to Systems and Information;
• Use of Encryption Mechanisms Where Applicable;
• Secure Information Storage;
• Regular Updating and Patching of Systems and Platforms;
• Continuous Assessment of Risks and Vulnerabilities;
• Aplicação de políticas de segurança da informação e gestão de senhas.

 

Data Subject Rights

Under the LGPD, data subjects may exercise the rights provided by law, including:

• Confirmation of the Existence of Processing;
• Access to Personal Data;
• Correction of Incomplete, Inaccurate, or Outdated Data;
• Request for Anonymization, Blocking, or Deletion of Data Where Applicable;
• Data Portability, Subject to Applicable Legal Provisions;
• Withdrawal of Consent, When Consent Is the Legal Basis for Processing;
• Obtaining Information About Data Sharing;
• Request for Clarification Regarding the Processing Carried Out.

Requests will be reviewed and responded to within the deadlines and conditions established by the applicable legislation.

 

Data Sharing

Personal data may be shared with partners, suppliers, service providers, or competent authorities when necessary to:

• Contract Performance;
• Compliance with Legal or Regulatory Obligations;
• Regular Exercise of Rights;
• Compliance with Requests from Competent Authorities;
• Operation of Services Provided by PCA.

All data sharing will comply with legal, contractual, and security requirements appropriate for the protection of information.

 

Training and Awareness

PCA promotes periodic training and awareness initiatives on privacy, data protection, and information security.

Training is provided to employees, interns, and other professionals acting on behalf of the organization, contributing to the development of a continuous culture of personal data protection.

 

Data Protection Officer (DPO)

As part of its privacy governance structure, PCA designates the following professional as its Data Protection Officer (DPO):

Data Protection Officer (DPO)
Nityananda Portellada
DPO Consultant at Next4Sec Security Intelligence
E-mail: lgpd-dpo@pca.com.br

The DPO acts as a communication channel between PCA, personal data subjects, and the Brazilian National Data Protection Authority (ANPD).

 

Contact

Questions related to privacy, personal data protection, or the exercise of rights provided under the LGPD may be submitted through the LGPD Contact Channel , disponível neste portal.

 

Review of this Policy

This Privacy Policy may be reviewed periodically to reflect legal, regulatory, technological, or organizational changes.

PCA recommends periodically reviewing this page to stay informed of any updates.