Privacy Policy
Version of
This is an English translation of the Portuguese original, provided for convenience. In case of any conflict or inconsistency between the two versions, the Portuguese version shall prevail.
1. Who We Are and What Our Role Is
HEMIL LTDA., registered with the Brazilian National Corporate Taxpayer Registry (CNPJ) under No. 69.832.640/0001-64, with its registered office at Rua Professor Pedro Viriato Parigot de Souza, No. 5285, CIC, Curitiba/PR, CEP 81.280-330 ("Hemil"), makes Hemil available, business management software offered over the internet. This Policy describes how Hemil processes personal data, pursuant to the Brazilian General Data Protection Law (LGPD) (Lei nº 13.709/2018).
Hemil processes personal data in two capacities:
- As controller, when it is for Hemil to decide on the processing, as in the case of the data of website visitors, of representatives of companies interested in engaging the service, and of the service access and usage logs. Section 2 addresses such data.
- As processor, when it processes personal data on behalf of the legal entity that engages Hemil ("Customer"), which is the controller, covering all content that the Customer and its users enter into Hemil, under the Company Terms of Service. Section 3 addresses such data.
2. Data We Process as Controller
2.1. Business contact. Data: name, email address, telephone, company and job title. Data subjects: representatives of companies that approach Hemil to learn about or to engage Hemil. Purpose: to respond to, present and negotiate the service. Legal basis: preliminary procedures relating to a contract (Article 7, V, of the LGPD) and legitimate interest (Article 7, IX).
2.2. Contract and billing. Data: name and email address of the persons responsible for the contract and for billing. Data subjects: persons designated by the Customer. Purpose: to perform the contract, to bill and to issue invoices (nota fiscal). Legal basis: performance of a contract (Article 7, V) and compliance with a legal obligation (Article 7, II).
2.3. Access logs. Data: IP address, date and time of access. Data subjects: users of Hemil. Purpose: to retain the access logs required by law and to protect the service. Legal basis: compliance with a legal obligation (Article 7, II, in conjunction with Article 15 of Lei nº 12.965/2014) and legitimate interest (Article 7, IX).
2.4. Usage logs. Data: actions performed and screens accessed, without the content. Data subjects: users of Hemil. Purpose: to maintain, protect and improve the service and to generate aggregated and anonymized data. Legal basis: legitimate interest (Article 7, IX).
2.5. Support. Data: messages sent to support. Data subjects: those who contact support. Purpose: to respond to and resolve the request. Legal basis: performance of a contract (Article 7, V) and legitimate interest (Article 7, IX).
2.6. Usage logs record the action performed, and not its content (for example, the creation of a contract, without the text thereof). Aggregated and anonymized data, which do not allow the identification of the Customer or of any person, may be used to improve the service, including for the training of artificial intelligence models. The content of Customers that is not anonymized shall be used for that purpose only upon the express authorization of the Customer.
3. Customers' Data
All content that the Customer and its users enter into Hemil is processed by Hemil on behalf of the Customer, which is the controller. This includes users' data (name, email address, photograph and job title) and third-party data recorded by the Customer, such as contacts, suppliers and contract parties.
With respect to such data:
- Hemil processes them exclusively for the provision of the service, in accordance with the Customer's instructions and the Data Processing Agreement entered into with it;
- it is for the Customer to decide which data are entered, who has access to them, for how long they are retained and when they are deleted;
- Hemil's team accesses the data only in the cases provided for in the Company Terms of Service, such as handling a support request, contracted implementation or the investigation of a security incident, with a record of each access;
- requests from data subjects relating to such data must be addressed to the Customer. If received by Hemil, they shall be forwarded to the Customer, to which Hemil shall provide assistance.
A user who accesses Hemil through a Google or Microsoft account has his or her name, email address and, if any, photograph provided by that provider, exclusively for the creation and maintenance of his or her account.
4. With Whom We Share
Hemil does not sell personal data. Sharing occurs only in the following cases:
- Sub-processors: the cloud infrastructure that hosts Hemil, stores the files and sends the electronic messages (Amazon Web Services).
- Public queries: to fill in addresses and company data, Hemil queries postal code (CEP) and CNPJ services, transmitting only the CEP or CNPJ entered.
- AI tool connected by the user: if the Customer so permits and the user connects a third-party artificial intelligence tool to Hemil, Hemil shall provide to it the data that it requests, within the limits of that user's access. The tool's provider is not a sub-processor of Hemil and processes the data under its own terms, engaged by the Customer or by the user.
- Demo scheduling and email: Google LLC, through Google Workspace, which hosts Hemil's email and its demo scheduling page, with respect to business contact data (item 2.1).
- Authorities: when required by law or by court order.
- Corporate transactions: in the event of a merger, corporate absorption (incorporação) or sale of Hemil, with the protections of this Policy being maintained.
5. International Transfer
Hemil's servers are located in the United States. The international transfer of data is based on the standard contractual clauses approved by the Brazilian National Data Protection Authority (ANPD) (Article 33, II, b, of the LGPD, and Resolução CD/ANPD nº 19/2024), entered into with the cloud provider.
6. How Long We Keep Data
| Data | Period |
|---|---|
| Business contact without a contract | 2 years from the last contact |
| Contract and billing data | 5 years after the end of the contract, for tax and statute-of-limitations periods |
| Access logs (IP, date and time) | 12 months; the legal minimum is 6 months (Marco Civil, Article 15) |
| Usage logs | 24 months; thereafter, only in anonymized form |
| Customers' data | For the term of the contract with the Customer; upon termination, delivered to the Customer, if requested, and deleted 30 days later, pursuant to the Company Terms of Service |
Upon expiry of the period, the data are deleted or anonymized, unless the law requires their retention for a longer period.
7. Your Rights
The data subject may request, pursuant to Article 18 of the LGPD: confirmation of the existence of processing and access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data or of data processed in noncompliance with the law; portability; and information on the entities with which the data have been shared. The data subject may also request the review of decisions made solely on the basis of automated processing (Article 20 of the LGPD), object to processing carried out on the basis of legitimate interest (Article 18, § 2) and petition the ANPD.
- Data processed by Hemil as controller (section 2): the request must be addressed to the Data Protection Officer (encarregado) (section 10) and shall be answered within 15 (fifteen) days.
- Customers' data (section 3): the request must be addressed to the Customer, which shall decide, with the assistance of Hemil.
Deletion of a user account. Once the Customer has granted the deletion request, the user's email address and photograph are deleted. The name remains in the records produced by the user, identified as deactivated, in order to preserve the integrity of the Customer's records, including audit records. The retention of the name is based on compliance with a legal or regulatory obligation and on the regular exercise of the Customer's rights (Article 16, I, and Article 7, VI, of the LGPD).
8. Security
Hemil adopts technical and administrative measures to protect data, including: encryption of data in transit and at rest; segregation of the data of each Customer; staff access limited to what is necessary and recorded; backups; and periodic review of the security of the code.
Should a security incident occur that may entail risk or relevant harm to data subjects, Hemil shall notify the ANPD and the affected data subjects, as provided by law. If the incident affects Customers' data, Hemil shall notify the Customer, which is responsible for the notification in its capacity as controller.
9. Cookies
Hemil uses only cookies strictly necessary for its operation, intended to maintain the user's session and to protect it against misuse. As they are indispensable to the provision of the service, they do not depend on consent. The browser also stores user preferences, such as the light or dark theme.
Hemil does not use advertising cookies. Any adoption of analytics or advertising cookies on its website shall be preceded by consent.
Hemil's website displays, in an embedded frame, the Google Calendar demo scheduling page provided by Google LLC. The name, email address and other information that a prospective customer enters to schedule a demo are collected through that page and processed by Hemil as set out in item 2.1. When the frame loads, the browser may receive Google cookies, which are governed by Google's privacy policy and over which Hemil has no control. Anyone who prefers not to use that page may request a demo at contato@hemil.com.br.
10. Data Protection Officer, Contact and Changes
Hemil's Data Protection Officer for the processing of personal data is Matheus de Albuquerque Schulhan Vidal, who can be contacted at privacidade@hemil.com.br.
This Policy may be amended. The current version shall always be available on this page, with the date of the last amendment, and relevant amendments shall be notified in advance, by email or within Hemil itself.