Data protection officer (DPO)
Your rights over your data, and where to exercise them
Who our DPO is, what Brazil's LGPD lets you request, and how long we take to answer. Requests are filed on this page.
Requests are free of charge and do not require a platform account.
Who the DPO is
Article 41 of the LGPD requires appointing a data protection officer and publicly disclosing their identity and contact details. Ours is a contracted firm, with its own company registration and address - not a generic company inbox.
- Officer
- PRIVACY POINT
- Company ID (CNPJ)
- 44.649.485/0001-14
- Website
- privacypoint.com.br
Who answers for your data
You have an APIBrasil account
Sign-up, billing, platform usage and support: we collect that data and decide how it is processed. Here APIBrasil is the controller and handles the request end to end.
Your data showed up in a lookup
A customer of ours decided to run that lookup - they are the controller of that processing, and APIBrasil acts as the processor. Write to us anyway: we take the request and point you to the responsible agent, as article 18, §4 requires.
APIBrasil brokers lookups against public sources and suppliers; it is neither the origin of the registry data nor its controller. Claiming otherwise here would sound friendlier and would not solve your problem.
What you can request
These are the rights in article 18 of the LGPD, plus the review of automated decisions in article 20. All of them go through the same channel, free of charge.
- art. 18, I
Confirmation of processing
Find out whether we process any data about you - including when the answer is that we process none.
- art. 18, II
Access to the data
Receive a copy of what we hold about you, in a format you can actually read and check.
- art. 18, III
Correction
Fix incomplete, inaccurate or out-of-date data held by us.
- art. 18, IV
Anonymisation, blocking or erasure
Applies to data that is unnecessary, excessive or processed beyond what the law allows.
- art. 18, V
Portability
Move your data to another provider, subject to trade secrets and to ANPD regulation.
- art. 18, VI
Erasure of consented data
Delete what was processed on the basis of your consent, except for the retention cases in article 16.
- art. 18, VII
Who we shared it with
Find out which public and private entities received your data through APIBrasil.
- art. 18, VIII
What changes if you refuse
Be told that you may withhold consent, and what happens if you do.
- art. 18, IX
Withdrawal of consent
Change your mind at any time, free of charge and without hurdles.
- art. 20
Review of automated decisions
Ask for review of a decision made solely by machine that affects your interests. The controller is the one who decides, and the request reaches them through this channel.
How a request is handled
You send it
Through the form on this page or straight to the DPO's address. Tell us which right you want to exercise - that is what sets the deadline for the answer.
We confirm it is you
Where the request calls for it, the DPO asks you to confirm your identity. This form asks for no ID document: demanding one from everyone in order to answer a data protection request would collect more than necessary.
We answer
Confirmation and access come immediately in simplified form, or as a complete statement within 15 days (article 19). Where the request cannot be met right away, you get the reasons in fact or in law (article 18, §4).
Requests are free: the LGPD (article 18, §5) does not allow charging the data subject for exercising these rights. A platform account is not required either.
What happens to what you write here
You are about to send personal data in order to exercise a right over personal data. We take that seriously, and these are the four things this channel does with what you write.
The request does not stay on the site
The form delivers straight to the data protection officer's channel. This site does not keep your request: there is no request database here.
Only what you typed travels
Your name, e-mail, the right you chose, your relationship with APIBrasil and your account of it, plus the page language and the time of sending. Nothing else is attached.
Your account never reaches the log
If delivery fails, the technical log records that it failed, not what you wrote. The content of a request is personal data and is treated as such.
Encrypted in transit
All traffic is HTTPS, with HSTS and Content-Security-Policy applied at the edge. The site accepts no unencrypted connection.
And if the channel is down, the screen says so and hands you the officer's e-mail on the spot. You never get a confirmation for a submission that did not happen.
Send a request to the DPO
Tell us who you are and which right you want to exercise. The more specific the account, the fewer rounds of back-and-forth before an answer.
Prefer email? Write straight to dpo@privacypoint.com.br.
Not satisfied with the answer? Article 18, §1 grants the right to petition against the controller before the Brazilian Data Protection Authority (ANPD).
The full documents are the Privacy Policy and the Terms of Use. For the summary compliance teams usually ask for, see Security and privacy.