LGPD, governance and rights.

01 / OVERVIEW

Personal data needs context.

Brazil’s General Data Protection Law (LGPD) establishes rules for processing personal data in Brazil. This page is for institutional website visitors, client representatives, partners, candidates, or anyone seeking to understand how rights and responsibilities enter Caristeo relationships. It explains general concepts and verifiable limits of the current implementation; it does not replace the law, applicable contracts or legal advice.

02 / ROLES

Roles vary by operation.

LGPD assigns responsibilities according to who decides the purpose and means of processing, who carries out operations on another organization’s behalf, and who provides a communication bridge. Caristeo’s position is not the same in every relationship:

• Data subject: the natural person to whom personal data relates.
• Controller: the organization or person that makes the main decisions about the purpose and means of processing.
• Processor: a party that processes data for a controller, within applicable instructions and context.
• Data protection officer: an LGPD communication point between controller, data subjects and ANPD, when applicable.
• On the institutional website, Caristeo may act as controller for flows it actually defines. In products, projects and services, roles depend on the contract, product, client instructions and concrete operation.

03 / PRINCIPLES AND BASES

Principles that guide decisions.

Data governance should consider LGPD principles from experience design through evolution. This page does not claim a certified program; it presents references that should guide choices proportionate to context:

• Purpose, adequacy and necessity: process what makes sense for a legitimate, explicit and proportionate purpose.
• Free access, quality and transparency: enable understanding of processing and correction of information where applicable.
• Security, prevention and non-discrimination: reduce risk and avoid uses incompatible with people’s rights.
• Accountability: support decisions and controls with documentation proportionate to the case.

Legal bases are context, not an automatic label.

LGPD provides different legal grounds for processing personal data, depending on purpose, parties and context. Consent is one of them, but not the only one and should not be presumed. The choice must be made before a flow goes live and documented in a way consistent with its risk.

• Consent, when applicable and valid for the stated purpose.
• Performance of a contract or related procedures, when a relevant contractual relationship exists.
• Compliance with a legal or regulatory obligation, when actually applicable.
• Regular exercise of rights and other legal grounds provided by law, assessed case by case.

Audited implementation does not allow assigning a specific legal ground to every future activity, product, external tag or contractual relationship. This page does not create consent or declare a legal ground for unvalidated flows.

04 / DATA-SUBJECT RIGHTS

Rights to know and intervene.

In plain language, and always subject to LGPD, its regulation and processing context, a data subject may request:

• confirmation of processing and access to personal data;
• correction of incomplete, inaccurate or out-of-date data;
• anonymization, blocking or deletion of unnecessary, excessive or non-compliant data where applicable;
• portability, subject to applicable rules and regulation;
• information about sharing, where applicable;
• withdrawal of consent and objection to processing in legally provided situations;
• review of decisions made solely on the basis of automated processing, where applicable.

05 / REQUESTS AND SECURITY

How to prepare a request.

For a rights request to be understandable and secure, it is necessary to identify the relationship with Caristeo and the processing to which it refers. Responses should observe applicable legal deadlines and requirements; this page does not promise an SLA, operational deadline, ticket or automatic result.

1. Describe the request: which right you wish to exercise, in which product, project, website or context and, if known, what data is involved.
2. Provide only contact details and context sufficient for review. Do not send passwords, tokens, patient data, identity documents or sensitive data through an interface not validated to receive them.
3. Open the existing institutional contact page. Its current form states that it sends and stores no data and does not confirm receipt; it is not currently a technically confirmed rights-exercise channel.
4. Once an appropriate intake channel is approved and published, Caristeo should explain how identity will be proportionally verified, scope confirmed and response delivered under applicable law.

No DPO email, ticket number, ticketing system or published operational workflow for LGPD requests exists in the audited project. These elements should only be announced after real validation and implementation.

Some requests may require assessment or be limited by legal obligations, security protection, fraud prevention, confidentiality, third-party rights or other legal situations. A limitation should be communicated with context compatible with the case, without removing rights guaranteed by law.

Security and incidents are part of governance.

Data protection depends on technical and organizational controls proportionate to the system, people and risk. The Security page describes institutional practices within a responsible scope. To report a possible vulnerability, use only the guidance published there and avoid sending sensitive information through unvalidated channels.

06 / PRIVACY AND ANPD

Privacy, cookies and external oversight.

The Privacy Policy describes verifiable website flows; the Cookies page separates local storage, cookies and external resources. When a person cannot exercise their rights with the controller or identifies a possible violation, ANPD and competent bodies may be paths provided by law, depending on the case.

07 / UPDATES

Updates, version and contact.

This information hub should be reviewed when data flows, products, contracts, service channels, regulation or technical evidence change. Its version and date identify the text’s current state. The contact page is the only public institutional destination available on the website, with the intake limitation described on this page.

INFORMATIONAL VERSION 0.1 · AUGUST 23, 2026