Privacy Policy

Draft pending review. This text was prepared by BRACCA's technical team so that the platform stops asking people to accept a document that does not exist. It has not been reviewed by a lawyer and has not been approved by the Board. Items in [square brackets] still need BRACCA's information.

This policy explains what personal data the Brazilian College Counseling Association (BRACCA) collects from its members and applicants, why it collects it, and what rights you have over it. It follows Brazil's General Data Protection Law (LGPD, Law 13.709/2018).

Controller: BRACCA — Brazilian College Counseling Association, [CNPJ], [address]. Contact for data matters: info@bracca.org.br.

What we collect, and why

When you apply for membership. Full name and preferred name, email address, phone number with country code, country, state and city, the institution you work for and its website, your position, the type of school and the curricula it offers, the number of students in the final year, and your LinkedIn or professional website. We use this to assess whether you meet the criteria of the membership category you applied for, and to reach you about your application.

When your membership is active. Your profile photo, if you upload one, and the short biography you choose to write. Your membership status, category, start date and renewal date.

When you pay. Payments are processed by Asaas, a Brazilian payment provider acting as our processor. We do not receive or store your card number. We keep the amount, the date, the method and the payment reference, so we can prove your membership is current.

When you use the members' library. We record which documents you open or download, and when. We use this to understand which material is useful and to plan what we publish next. These records are visible only to BRACCA's administration, are kept for 12 months and are then deleted automatically. They are not used to build profiles or to make automated decisions about your membership.

Technical data. Standard server logs and the cookies needed to keep you signed in and to remember your language choice. We do not use advertising cookies.

Legal basis

We process your data to perform the membership agreement between you and BRACCA (LGPD art. 7, V), to comply with legal and accounting obligations (art. 7, II), and, for the optional items you tick at registration — internal sharing of your contact details and use of your photo and biography — on the basis of your consent (art. 7, I). Consent given for the optional items can be withdrawn at any time without affecting your membership.

Who else sees your data

Other members. Only if you consented to internal sharing. In that case, your name, position, institution, city and the professional details you provided may be visible to other active members in BRACCA's internal directory and communications. Your phone number and email are shared only under the same consent.

Service providers. Asaas (payments), our email delivery provider, and our hosting provider, each acting under contract and only to the extent needed to run the association's systems.

Authorities. When we are legally required to.

We do not sell your data, and we do not share it with universities, agencies or sponsors for commercial purposes.

How long we keep it

Membership records are kept while your membership is active and for [period] after it ends, so BRACCA can prove its own institutional history and meet accounting obligations. Library access records are kept for 12 months. You may ask us to delete data that we are not legally required to retain.

Your rights

Under LGPD art. 18 you may ask us to confirm what data we hold about you, to give you a copy of it, to correct it, to anonymise or delete data processed without a legal basis, to tell you who we shared it with, and to withdraw consent for the optional items. Write to info@bracca.org.br and we will answer within [prazo] days.

Security

Access to the administration panel is restricted to authorised BRACCA staff. Documents in the members' library are stored outside the public web directory and are served only after the system checks your permission. Payment credentials are held encrypted.

Changes

If we change this policy in a way that affects your rights, we will notify members by email. This version is dated [data].