Who the controller is
The controller of your personal data is the Centro de Integração Cultural e Empresarial de São Paulo (CICESP), registered under CNPJ No. 03.835.573/0001-23, headquartered at Rua Itápolis, 1146, Pacaembu, São Paulo – SP, CEP 01245-000, the maintaining entity of the Brazilian Academy of Merit Honors. In this policy, “ABRAHM” refers to the Academy and its maintaining entity.
Requests and questions about personal data are handled by the ABRAHM Secretariat-General, our communication channel with data subjects (art. 41 of the LGPD), at [email protected]. Use this channel to exercise your rights.
What data we process
We only process the data you send us and the technical minimum needed for the website to run securely:
- Contact form: name, e-mail, institution (optional), subject and the content of the message.
- Recognition request: identification data (name, parents’ names, date of birth, nationality, ID card, CPF, marital status and spouse’s name), photograph, address and postal code, phone numbers, e-mail, social media profiles, professional data (education, position, company, company CNPJ and contacts) and the distinctions and referrals you provide.
- Technical data: your IP address, stored only as an irreversible code (hash) to prevent abuse, and your browser identification (user-agent).
- Browser storage: see the “Cookies and local storage” section.
We do not ask for sensitive personal data (art. 5, II, of the LGPD), such as racial origin, religious belief, political opinion or health data. Please do not include it in your messages.
Why we use it and on what legal basis
- To reply to your contact message — consent (art. 7, I), given by ticking the authorization box on the form.
- To review the recognition request, issue the record summary and, if approved, arrange the investiture — consent (art. 7, I) and preliminary procedures at the data subject’s request (art. 7, V).
- To protect the website and forms against bots, fraud and abusive submissions (bot check, submission limits, hashed IP) — legitimate interest (art. 7, IX), with proportionate safeguards.
- To comply with legal or regulatory obligations and respond to requests from authorities — art. 7, II.
- To measure website usage in aggregate (analytics cookies), only if you allow it — consent (art. 7, I).
We do not sell or rent your data, we do not use it for third-party advertising and we do not make automated decisions about you.
Who we share it with
Your data is accessed only by the ABRAHM staff who need it and by service providers (processors) acting on our instructions, under contractual confidentiality and security obligations:
- the hosting provider for the website, API and database;
- the e-mail delivery provider, for acknowledgements and replies;
- Cloudflare, for the forms’ bot check (Turnstile);
- public postal-code lookup services (ViaCEP and BrasilAPI), which receive only the postal code you type in order to fill in the address.
We may also share data when required by law or by order of a competent authority.
International transfers
Some processors, such as Cloudflare, may process data outside Brazil. In such cases, the transfer follows art. 33 of the LGPD and the ANPD’s regulations, with contractual clauses that ensure a level of protection compatible with Brazilian law.
How long we keep it
We keep data only for as long as the purpose requires:
- contact messages and recognition requests: while being handled or reviewed; once archived, they are automatically deleted within 24 months;
- the request draft in your browser: deleted when you close the tab;
- your cookie choice: 12 months — after that, we ask again.
Data needed to comply with a legal obligation or to exercise rights in legal proceedings may be kept for the required period (art. 16 of the LGPD).
How we protect your data
- encrypted connection (HTTPS) across the website and the API;
- CPF, ID card, parents’ names, date of birth, address, phone numbers and message content are encrypted in the database;
- IP addresses are stored only as hashes, and e-mail and CPF are searchable through blind indexes without exposing the value;
- access to the admin panel is restricted to authorized people, with an audit log of actions.
No system is completely immune to failure. If a security incident may cause significant risk or harm, we will notify you and the ANPD, as required by art. 48 of the LGPD.
Your rights
As a data subject, you may, at any time and free of charge (art. 18 of the LGPD):
- confirm whether we process your data and access it;
- correct incomplete, inaccurate or outdated data;
- request anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
- request portability of your data to another provider;
- request deletion of data processed on the basis of your consent;
- know with which entities we share your data;
- be informed of the possibility of not consenting and of the consequences of refusing;
- withdraw your consent.
To exercise your rights, write to [email protected]. We may ask for information to confirm your identity before acting, to protect your own data. We reply within the time limits set by the LGPD.
If you believe your request was not met, you may file a petition with Brazil’s National Data Protection Authority (ANPD) at gov.br/anpd.
Changes to this policy
We may update this policy to reflect changes to the website or to the law. The current date and version are shown at the top of the page. If a change affects data processed on the basis of your consent, we will let you know and, where necessary, ask for new consent. Please also read our Terms of Use.