Access Control Data Processing

How the access control module collects, stores and protects data of parties and visitors.

Version 1.0Updated on May 9, 2026

The Access Control module integrates hardware installed in the condominium (turnstiles, readers, cameras) with the Condoa platform to log entries and exits of parties, visitors and contractors.

What data we process

Parties and staff

Name, photo, government ID (optional), unit, role and access credentials (PIN, biometric template, card).

Visitors

Name, document, photo, visited unit, date and time of entry and exit.

Events

Access records (date, time, device, direction, identification).

Where data lives

The access control system combines a local agent installed at the condominium with the Condoa cloud.

Local agent

Runs on-premises at the condominium. Keeps an encrypted copy of the credentials needed to authorize access even when offline.

Cloud

Personal data (government ID, photo, document) is encrypted at the application level before being persisted. Access events are synchronized to the cloud for audit and reporting.

Roles and legal basis

The condominium is the controller of the data of its parties, staff and visitors processed by the module. It defines the purpose and the legal basis of each processing activity (ANPD Guide on Processing Agents, items 36 and 37). Condoa is the processor: it processes the data on the controller's instructions (LGPD art. 39) and records the basis the controller declared in the simplified processing register it provides to each condominium.

Biometric data (face, fingerprint, palm) is sensitive data and may only be processed under one of the hypotheses of LGPD art. 11, among them the data subject's specific consent, recorded and revocable on the platform. Whoever does not consent, or whenever the ANPD's biometrics regulation requires it, uses a non-biometric credential: card, tag, PIN or QR code.

Retention

Data	Default retention
Access events	12 months (configurable by the manager)
Visitor data	6 months
Encrypted backups	Up to 30 days after the source data expires

Data subject rights

Parties, staff and visitors may exercise their rights under the LGPD (access, correction, deletion, portability) at [email protected] or through the condominium manager, who represents the condominium, the data controller.