Privacy Policy
Last updated[TO BE DEFINED: date]
1.Who we are and to whom this policy applies
This Privacy Policy describes how Aventra Participações Ltda., a limited liability business company enrolled with the Brazilian corporate taxpayers' register (CNPJ) under No. 67.982.601/0001-18, with its administrative office in Rio de Janeiro, Brazil ("Aventra", "we"), processes the personal data collected through the website aventraenergy.com and its subdomains.
Aventra acts as controller of the personal data processed hereunder, under article 5, item VI, of Lei nº 13.709/2018 (the Brazilian General Data Protection Law, or LGPD).
This policy applies to every visitor to the website, whether an investor, a commercial partner, a supplier, a job applicant, a representative of a public body or a member of the press.
2.What data we collect
2.1. Data you provide to us directly. When you complete the contact form, you provide us with: name, company or institution, email address, telephone number, relationship profile (mill or producer, investor, carbon credit buyer, technology supplier, press or other) and the content of the message you write.
Mandatory fields are marked on the form. The remaining fields are optional and leaving them blank does not prevent your message from being sent.
We ask that you do not include sensitive personal data in your message (article 5, item II, of the LGPD), nor third party data without their knowledge, nor confidential business information before a confidentiality agreement has been entered into.
2.2. Data collected automatically. When you access the website, our servers and those of our service providers automatically record: IP address, date and time of access, browser type and version, operating system, device type, screen resolution, configured language, pages visited and the referring address, where applicable.
Keeping records of access to internet applications is a legal obligation set out in article 15 of Lei nº 12.965/2014 (the Brazilian Civil Rights Framework for the Internet) and such records are retained for a minimum period of six months.
2.3. Data we do not collect. We do not collect data relating to children and adolescents, we do not carry out behavioural profiling for advertising purposes, we do not make automated decisions producing legal effects on you and we do not purchase third party databases.
3.What we use your data for and on what legal basis
| Purpose | Data used | Legal basis under the LGPD |
|---|---|---|
| Responding to your message and conducting the resulting commercial or institutional contact | Form data | Article 7, V (preliminary procedures related to a contract) and article 7, IX (legitimate interest) |
| Keeping a record of the contact for relationship history and accountability purposes | Form data | Article 7, IX (legitimate interest) |
| Ensuring the security of the website, preventing fraud and abuse and investigating incidents | Access data | Article 7, IX (legitimate interest) and article 7, II (compliance with a legal obligation) |
| Complying with the legal obligation to retain access records | Access data | Article 7, II (compliance with a legal obligation), together with article 15 of Lei nº 12.965/2014 |
| Measuring website performance and use on an aggregate basis | Aggregated, non-identified access data | Article 7, IX (legitimate interest). Where measurement depends on a non-essential cookie, the basis is article 7, I (consent) |
| Exercising or defending rights in judicial, administrative or arbitration proceedings | Data relevant to the case | Article 7, VI |
Whenever we rely on legitimate interest as the legal basis, we first carry out the necessity, adequacy and balancing assessment required by article 10 of the LGPD, and you may request information about that assessment through the channel indicated in item 10.
4.With whom we share your data
We do not sell, rent or assign your personal data.
We share data only in the following cases, and always to the extent strictly necessary:
- Technology service providers that operate the website hosting, the content delivery network, transactional email delivery and, if adopted, the audience measurement tool. These providers act as processors, under article 5, item VII, of the LGPD, and are contractually bound to process data solely in accordance with our instructions.
- Group companies and special purpose companies in which Aventra holds an interest, where the contact you initiated relates to a project conducted by those companies.
- External advisers (legal, accounting, financial and technical), where necessary to conduct our relationship with you.
- Public and judicial authorities, upon legal request or court order, or where sharing is necessary for the regular exercise of rights.
International transfer. Some technology service providers may process data on servers located outside Brazil. In such cases, the transfer complies with articles 33 to 36 of the LGPD, by means of appropriate contractual protection clauses.
5.How long we keep it
- Contact form data: for as long as necessary to handle your request and, once the contact is closed, for up to 5 (five) years, a period matching the general limitation period for contractual claims and which allows us to evidence the history of the relationship.
- Access records: 6 (six) months, in accordance with article 15 of Lei nº 12.965/2014, and may be retained for a longer period upon request of a competent authority.
- Data required to exercise or defend rights: until the final and unappealable decision or the definitive closure of the proceedings.
Once these periods have elapsed, the data is deleted or anonymised, save where the law provides for its retention (article 16 of the LGPD).
6.How we protect it
We adopt technical and administrative measures consistent with the state of the art and with the nature of the data processed, including: HTTPS encrypted traffic across the entire website, need-based access control, two-step authentication on administrative accounts, activity logging, backups and periodic review of hosting configurations.
No system is entirely immune to incidents. Should a security incident occur that may give rise to relevant risk or damage, we will notify you and the Brazilian National Data Protection Authority in accordance with article 48 of the LGPD.
7.Your rights
Under article 18 of the LGPD, you may, at any time and free of charge, request:
- confirmation that processing is taking place;
- access to the data;
- correction of incomplete, inaccurate or outdated data;
- anonymisation, blocking or deletion of unnecessary or excessive data, or of data processed in breach of the law;
- portability to another service or product provider, subject to commercial and industrial secrecy;
- deletion of data processed on the basis of your consent, save in the cases set out in article 16;
- information about the public and private entities with which we share data;
- information about the possibility of withholding consent and about the consequences of doing so;
- withdrawal of consent;
- objection to processing based on one of the cases where consent is not required, in the event of breach of the law;
- review of automated decisions, where applicable.
To exercise any of these rights, please write to [DEFINIR e-mail]. We will respond within a reasonable period and, where the law sets a specific deadline, within that deadline. We may request additional information to confirm your identity, a measure that exists for your own protection.
You may also file a complaint directly with the Brazilian National Data Protection Authority, through the official channels available at gov.br/anpd.
8.Links to third party websites
The website contains links to third party pages, including LinkedIn profiles and the Endura Carbon website. By following these links, you become subject to the privacy policies of those third parties, over which Aventra has no control and for which it is not responsible.
9.Changes to this policy
This policy may be updated to reflect legal, regulatory, technological or business changes. The date of the last update appears at the top of the document. Material changes will be prominently signalled on the website for a reasonable period.
10.Contact channel
For any matter relating to personal data, including the exercise of data subject rights and contact with Aventra's Data Protection Officer:
Email: [DEFINIR e-mail]
Address: Aventra Participações Ltda., administrative office in Rio de Janeiro, Brazil.
This is a courtesy translation. In case of any discrepancy between the Portuguese and the English versions, the Portuguese version shall prevail.