privacy policy.

We want to keep things simple, so we have tried to make this Privacy Policy (“Privacy Policy”) as easy to understand as possible. If any questions remain, please feel free to contact us through the channel mentioned below.

Handover has established a Privacy Policy that applies to all of its companies, including parent, subsidiary, affiliated and commonly controlled companies within Brazilian territory. The purpose of this policy is to show our commitment to protecting your personal data securely, transparently and with privacy.

Our Privacy Policy contains information about the personal data we collect, its use, storage and sharing, as well as your rights relating to that data. We strongly recommend that you review it carefully.

Introduction

When you use the services offered by Handover, you share personal data and/or your company’s data with us so that our products and services can be contracted and, above all, so that we can provide a quality experience. At Handover, we value privacy, security and transparency, and we always apply best practices to maintain the confidentiality and integrity of your data.

By agreeing to the terms presented in this Privacy Policy, you acknowledge that Handover Tecnologia LTDA, CNPJ no. 32.157.419/0001-48, headquartered at Av. Paulista, 171 – 4th floor, Bela Vista, São Paulo – SP, ZIP 01311-000, is the main controller of your data, that is, it is responsible for making decisions about the processing of your personal data.

The User’s use of the platform will occur whenever and only if the User agrees with the conditions established in this document and in any other conditions eventually present in other documents previously accepted by the User.

If you have any questions or complaints after reading this Privacy Policy, or wish to exercise your rights relating to your personal data, you can contact our Data Protection Officer (DPO) at dpo@oihandover.com.

1. What personal data Handover collects

Data provided by direct interaction: when each User registers on Handover’s platform, the minimum data necessary is requested so that not only the registration but also future access is possible. Data such as name, phone number and email are essential for a relationship to exist between Handover and the User.

Data collected automatically when Handover’s solutions are used:

• Device information: Handover collects specific information about the device used by the User, such as the operating system version and unique identifiers. The name of the mobile network the User’s device is accessing may also be collected.
• User data present on other platforms, social networks and email accounts: for the solutions to work properly, Handover may access and interact with data held by the User on other platforms. Access to such information via API and the approval to track such data are necessary exclusively so that Handover can manage the sending of emails and messages related to the Platform.
• Location information: Handover may collect geographic location data relating to the User.
• User data and access logs: Handover collects access log data to comply with privacy laws, with the Brazilian Internet Civil Framework and with the General Data Protection Law. Technical details, including the device’s IP, registration date, date of the last password change, date of the last login, browser type and version, among other data relevant to the protection of the system and of the User’s account.

The practices described in this Privacy Policy apply only to the processing of your personal data in Brazil, and are subject to the applicable local laws, notably Law no. 13.709/2018 (the General Personal Data Protection Law, or “LGPD”).

2. How Handover uses the personal data of Users and third parties

Handover uses your personal data in order to provide a high-quality service and offer the best products, to keep the platform running, and to comply with legal or regulatory obligations.

Data passed directly to Handover by the User is under no circumstances sold for any purpose.

Providing access to the Platform: if the User logs in using their email ID or any other information that identifies them individually, Handover will hold that data to identify them as a user and allow access to the Platform. Login information is also used to provide the services in accordance with the authorized Terms and Conditions of Use.

Enabling a secure Platform: Handover uses access data and identifiers to protect the User and the platform itself (including troubleshooting, data analysis, testing, fraud prevention, system maintenance, assistance, communication and data storage).

3. Your rights as a personal data subject

Under the General Data Protection Law (LGPD), as the subject of your data, you have the right to exercise your rights before the controllers. The User has, among others, the rights set out below:

• Access: request access to your personal data, receiving a copy of the data Handover holds about you.
• Correction: request corrections to any incomplete or incorrect data; Handover may verify the accuracy of the new data provided.
• Deletion: request that we erase or remove your personal data. For certain purposes, we may be legally required to retain your data.
• Portability: receive, or nominate a third party to receive, your personal data in a structured, electronically readable format.

No charge: the User will not have to pay any fee to access their personal data or to exercise any of the other rights. However, Handover may charge a reasonable fee if the request is manifestly unfounded, repetitive or excessive.

Response time: Handover aims to respond to all legitimate requests within one month. Occasionally it may take longer if the request is particularly complex or if several requests have been made; in that case the User will be notified and kept informed.

In addition, the User has the right to lodge a complaint, at any time, with the competent data protection authority. Before that, we would appreciate the chance to address your concerns first, at dpo@oihandover.com.

4. Communication and advertising

Handover will communicate essentially by email, phone call, video call, chat or notifications displayed in and associated with the platform.

The User will not receive third-party marketing communications originated and/or managed by Handover.

5. No data sharing

In general, Handover does not share Users’ data. It may, however, be directed to:

• Affiliated companies: companies with corporate ties to Handover that help provide better services, such as product improvement, customer support and fraud detection mechanisms.
• Third-party service providers: above all technology infrastructure, such as the “cloud” storage services offered by Amazon Web Services, Azure and GCP. Providers may be located inside or outside Brazil and declare themselves compliant with the applicable rules.
• Authorities, regulators and others: when required to comply with legal or regulatory requirements.
• Potential mergers and acquisitions: in the event of a change relating to the business, the new owners may use your personal data as described in this Privacy Policy.

6. International transfer of personal data

Some or all of your personal data may be transferred abroad, for example when it is stored by Handover on cloud computing servers located outside Brazil. We comply with all the requirements established by the applicable legislation and adopt the best security and privacy practices to ensure the confidentiality and integrity of your personal data.

7. Retention period and location of your data

For as long as you are a Handover Client or Prospect, your personal data will be kept in a secure, controlled environment. The data will be stored and processed both inside and outside Brazil, on secure servers.

Personal data will only be kept for as long as necessary to serve the purposes for which it was collected, including meeting legal, statistical and communication requirements. To determine the appropriate retention period, we consider the amount, nature and sensitivity of the data, the potential risk of harm, the purposes of the processing and the applicable legal requirements.

8. Security measures

To ensure the integrity of your personal data, Handover uses several security measures, including industry-established standards during collection and storage. We have a highly qualified team dedicated to ensuring best security practices, including:

• Authentication by a combination of credential validation methods for login systems;
• reCAPTCHA validation;
• Package pickup only with the unique code provided;
• Data encryption, to ensure the integrity of the information;
• Continuous monitoring of the environment;
• Continuous information security analysis and testing of our systems and processes.

Handover continuously assesses the security of its platform to: (1) help protect data from accidental or unlawful loss, access or disclosure; (2) identify reasonably foreseeable risks to network security; (3) minimize security risks, including through risk assessments and regular testing.

Despite the measures implemented, transferring data over the internet is never completely secure. Your Handover platform password is personal and non-transferable; do not share it with third parties, and be careful when exposing your personal data in public settings, such as social media.

9. Activity logs

When you use our apps, websites or blogs, we may keep records of the activities you carry out, creating logs that contain the IP address, the access and actions performed, the date and time of each action and information about the device used.

Cookies: temporary internet files that store information about the pages visited. Handover uses cookies on its websites and blogs, and receives information from partners about cookies placed on their own sites. You can block or delete cookies at any time in your browser settings; some parts of the page may not work properly. See the Cookie Policy Code of Ethics.

Web beacon: a technique that makes it possible to identify visitors’ behavior on a web page and its relationship with other sites or servers.

Analytics tools: collect information about how you visit a site, including which pages are visited and when.

Handover’s platform may contain links to third-party websites or applications; each platform will have its own privacy policy, and Handover is not responsible for those policies.

10. Consent

Some personal and/or company data will be collected by Handover with your consent, and may only be processed with authorization and for the purposes described. By reading this Privacy Policy and agreeing at the end, you consent to the processing of personal data in the ways indicated here.

The processing of this data is a necessary condition for us to provide our services and deliver our products to you. If you have questions: dpo@oihandover.com.

11. Changes to this Privacy Policy

Handover may change this Privacy Policy at any time. Whenever a relevant condition is changed, the changes will be valid, effective and binding after the new version is published on our website or sent to you by email.

Whenever a relevant change is made, we will send a notice indicating the new version in force. By continuing to use our products and services after a change, you agree to the new conditions, and you can always express your disagreement at dpo@oihandover.com. Where changes depend on your consent, it will be requested again.

12. Contact us