Privacy Policy and Data Protection

Who we are

Condoa is operated by Hyrran Gustavo Rezende dos Santos Desenvolvimento de Software Ltda. (CNPJ 64.743.447/0001-33), based in São Paulo, Brazil. We act as data controller for our own users (managers, parties, employees) and as data processor when handling data on behalf of a contracting condominium. Data processed on a condominium's behalf is never used for Condoa's own purposes nor to train AI models; only aggregated, anonymized data is used to improve the service.

What data we collect

Identification and contact data (name, email, phone), unit and condominium membership, payment data when applicable, access control data (PIN, biometric template, photo, document) when the access control module is in use, and content you submit (messages, documents, attachments).

Legal basis

For the data we control (your platform account, website analytics and the Marco Civil access records) we rely on contract performance, legal obligation, legitimate interest (platform security, fraud prevention and aggregated usage data, with the right to object) and consent (marketing communications), as established by Brazilian Law 13.709/2018 (LGPD). For the data we process on a condominium's behalf, including biometric templates, the condominium defines the legal basis as controller and we record it in the simplified processing register we provide to it. Biometric data is processed only under one of the hypotheses of LGPD art. 11, such as the data subject's specific consent.

How long we keep it

For as long as you remain a user, plus the legal retention periods applicable to financial, fiscal and condominium-governance records. Encrypted backups are retained for up to 30 days after the source data expires.

Access records (IP address, date and time of use), including those of visitors who never sign in, are kept for 6 months under confidentiality, as Brazil's Marco Civil da Internet (Law 12,965/2014, art. 15) requires, even after an account is deleted. They are linked to an account once its visitor signs in or signs up, and are only disclosed under a court order.

Your rights

Under the LGPD, you may access, correct, anonymize, port, delete or oppose the processing of your data, and request information about how it is shared. Send any request to [email protected].

International transfers

Some of our sub-processors are located outside Brazil. International transfers are based on standard contractual clauses and the cases foreseen in art. 33 of the LGPD. The current list of sub-processors is published at Sub-processors.

Data Protection Officer (DPO)

Hyrran Gustavo Rezende dos Santos. Contact: [email protected].