This translation is provided for convenience. The official version is the Portuguese one.
This policy explains, in plain language, which personal data the Brazilian Red Cross Rio de Janeiro website processes, what it is used for, who receives it, how long it is kept and how you exercise your rights. It follows Brazil's General Personal Data Protection Law (Law No. 13,709/2018, the LGPD).
It covers cruzvermelhariodejaneiro.org and all its pages, including news, the archive and the English and Spanish versions, and the Impacto das Cores project page (projetocores.cruzvermelhariodejaneiro.org). The Venipuncture course has its own website and privacy policy, in Portuguese.
Who looks after your data
The controller, which decides how the data is processed, is the branch below.
Brazilian Red Cross — Rio de Janeiro State Branch (Cruz Vermelha Brasileira — Filial do Estado do Rio de Janeiro)
CNPJ (Brazilian company number) 08.560.973/0001-97
Praça da Cruz Vermelha, 10 — Centro, Rio de Janeiro, RJ, 20230-130, Brazil
Privacy channel: for anything about your data, write to contato@cruzvermelhariodejaneiro.org with the subject “Privacy”, in English, Spanish or Portuguese. Until a data protection officer is appointed, this is the channel for data subjects and for Brazil's National Data Protection Authority (ANPD), as Article 11 of ANPD Resolution CD/ANPD No. 2/2022 allows for small data processing agents.
What data we process, why, and on what legal basis
Each form asks only for what it needs. The legal basis is the provision of the LGPD (Article 7) that authorises each use.
Enrolment in in-person courses
Data
Full name, CPF (the Brazilian individual taxpayer number), e-mail, phone number, chosen course, payment method, payment status and, for cards, only the card brand and the last four digits.
Purpose
To register the enrolment, issue the charge, send the receipt, arrange the class and schedule by e-mail and, once paid, create your enrolment on the school platform.
Legal basis
Performance of a contract and of the steps that precede it, at your request (Art. 7, V); compliance with a legal obligation, for keeping payment records (Art. 7, II).
The “Fale com a gente” contact chat
Data
Subject, course (when the subject is enrolment, a course or payment), name, e-mail, phone number (optional), your message and the page you wrote from.
Purpose
To answer you by e-mail, with a reference number, and keep a record of the exchange.
Legal basis
Handling a request of yours (Art. 7, V) and legitimate interest in answering and keeping a record of the exchange (Art. 7, IX).
Newsletter
Data
Name, e-mail and the record of consent: the text accepted, the date, the IP address and the browser identification.
Purpose
To send news, campaigns and course information, only after you confirm the subscription through the link sent to your e-mail (valid for 72 hours). Every e-mail has a one-click unsubscribe link.
Legal basis
Consent (Art. 7, I), which you can withdraw at any time.
Visit statistics (Google Analytics), only with your permission
Data
Pages viewed, where the visit came from, technical data about the browser and device, approximate city and the cookie identifier.
Purpose
To count visits and understand which pages are read, so we can improve the site.
Legal basis
Consent (Art. 7, I), given in the cookie notice.
Marketing (Meta Pixel), only with your permission
Data
Pages viewed and steps such as opening the chat, starting an enrolment or completing a payment, with the subject or course and the amount. Never your name, CPF, e-mail, phone number or message.
Purpose
To measure the reach of our outreach campaigns on Facebook and Instagram.
Legal basis
Consent (Art. 7, I), given in the cookie notice.
Where the visit came from, only with statistics permission
Data
The campaign parameters in the page address (utm, fbclid and gclid), stored with the enrolment or the message.
Purpose
To know where enrolments and messages come from.
Legal basis
Consent (Art. 7, I).
Form security
Data
IP address, date and time of each enrolment or message sent.
Purpose
To limit repeated attempts and protect the forms against bots and fraud.
Legal basis
Legitimate interest (Art. 7, IX) and fraud prevention.
Donations made up to 25 September 2026
Data
Name, CPF, e-mail, phone number, amount and payment method (for cards, only the brand and the last four digits).
Purpose
To resend receipts and meet legal and accounting obligations. Online donations have been suspended since that date, and no new donation data is collected.
Legal basis
Compliance with a legal obligation (Art. 7, II) and the regular exercise of rights (Art. 7, VI).
Volunteering
Data
The data you enter in the volunteer form, hosted on the Spotform service (form.spotform.com.br).
Purpose
So the volunteering team can contact you and organise your training. The WhatsApp number (21) 97036-0264 belongs to that team only.
Legal basis
Steps prior to joining the volunteer service, at your request (Art. 7, V).
Enrolment payments are processed by ÚnicoPag. Card details pass through our server only on their way to ÚnicoPag, at the moment of payment, and are never stored.
We do not ask for sensitive data (such as health, religion or racial origin) in any form on the site, and we make no automated decisions based on your data. The forms are not aimed at children: if a teenager enrols, it should be done with a parent or legal guardian.
Who receives the data
Only those who need it for the service to work, and each receives only the part it needs:
ÚnicoPag, which processes payments: name, CPF, e-mail and phone number and, for cards, the card details.
The school platform (escola.cursoscruzvermelha.org), for paid enrolments: name, CPF, e-mail and phone number, to create the enrolment and the course access.
Hostinger, which hosts the site, the forms and their database.
Resend, which sends the e-mails (receipts, chat reference numbers and the newsletter). If it is unavailable, e-mails go out through the hosting server.
Vercel and Supabase, which host the system that publishes the news and keeps the newsletter list.
Google and Meta, through the statistics and marketing tools, only with your permission. Google also serves the site's fonts (Google Fonts) and, for that, receives the IP address of whoever opens the page, without cookies.
Spotform, which hosts the volunteer form.
Public authorities, when the law or a court order requires it.
We do not sell personal data, to anyone, under any circumstances.
Transfers outside Brazil
Some of these providers store or process data outside Brazil, such as in the United States and Canada (Google, Meta, Resend, Vercel and Supabase). These transfers follow Article 33 of the LGPD and the ANPD's regulations: they rely on the contractual safeguards offered by the providers and, for the statistics and marketing tools, also on your consent, given in the cookie notice.
Cookies
We use cookies the site needs in order to work and, only with your permission, statistics and marketing cookies. The full list, with how long each one lasts, is in the Cookie Policy. You can change your choice at any time:
Enrolment and payments: during the enrolment and the course and then for the retention period the law requires for tax and consumer records (generally 5 years).
Donations made before the suspension: for the legal retention period for accounting and tax records.
Chat: for as long as it is useful to follow up the exchange. You can ask for deletion at any time.
Newsletter: until you unsubscribe. After that, only a record that you left is kept, so you are not subscribed again by mistake, and it is also deleted if you ask.
Security records (IP): together with the submission they relate to.
Cookies: for the period of each one, listed in the Cookie Policy.
When the period ends, the data is deleted or anonymised, unless the law requires it to be kept.
Security
Form data is kept in databases with access restricted to the team responsible for each subject, and the site only works over a secure connection (HTTPS). No system is infallible: if a security incident occurs that may cause significant risk or harm, we will notify you and the ANPD, as Article 48 of the LGPD requires.
Your rights
The LGPD (Article 18) guarantees that you can ask, at any time, for:
confirmation that we process your data, and access to it;
correction of incomplete, inaccurate or outdated data;
anonymisation, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law;
portability of your data to another provider;
deletion of data processed on the basis of your consent, and withdrawal of that consent;
information about who we share your data with, and about the possibility of not giving consent and what happens if you do not;
objection to processing that breaches the law.
To exercise any of them, write to contato@cruzvermelhariodejaneiro.org with the subject “Privacy”. We may ask for some information to confirm the request is yours. Confirmation and access, as a complete statement, are provided within 15 days (Art. 19 of the LGPD). Some data may have to be kept even after a deletion request, to comply with a legal obligation, such as payment records.
If you feel your request has not been met, you can complain to Brazil's National Data Protection Authority at gov.br/anpd.
Changes to this policy
When this policy changes, the date at the top changes with it. Significant changes are announced on the site and, for newsletter subscribers, by e-mail.
