Privacy policy

Who is responsible for the data

The party responsible (the controller, in data protection terms) for the data handled in this system is Legado Fathers & Sons, São Paulo chapter. For any request about your data or your child's, use the contact at the end of this page.

What data we collect

From the father or guardian:

• Name, email and phone
• Preferred language
• Password, stored only in encrypted form — nobody at Legado can read it
• The date you agreed to this policy

Children's and teenagers' data

To organise the event we collect from your child: name, date of birth, dietary and medical restrictions you report, and whether image use is authorised.

This data is always collected based on the consent of the person legally responsible for the child, given by you when completing the registration. We collect only what the participation requires: the date of birth determines the age-based team, and the restrictions exist for safety during the three days.

Image authorisation is separate and optional. Declining it does not prevent participation — it only stops photos featuring the child from being used in promotion.

Why we use this data

Each piece of data has a specific purpose:

• Handling the registration and forming the age-based teams
• Issuing the ticket and running check-in during the event
• Contacting you about the event (practical information, changes, guidance)
• Looking after food and health safety during the event

Who we share with

We do not sell data and do not release it for advertising. We share only with those necessary for the event to happen, and each one receives only what they need:

• Ticket and Go — venda de ingressos e origem dos inscritos
• Hostinger — hospedagem da aplicação e do banco de dados
• Cloudflare (R2) — armazenamento de arquivos e cópias de segurança

Where the data lives

The application and database run on a server contracted from Hostinger, and backups are kept at Cloudflare (R2). The servers currently in use are outside Brazil, which constitutes an international data transfer under article 33 of the Brazilian data protection law. The data remains protected by this policy regardless of where it is hosted.

Backups run daily and are kept separately from the main server, so that a failure does not mean data loss.

How long we keep it

We keep the data for as long as participation in the programme lasts and for the time needed for the participant's history — Legado is a programme built on continued bonds, and families often return in later editions.

You may request deletion at any time. If there is a legal obligation to retain any record, we will tell you which and for how long.

Your rights

Data protection law grants you, and your child through you, the right to:

• Know what data we hold and obtain a copy
• Correct wrong or outdated data
• Request deletion of the data
• Withdraw consent previously given
• Know who the data has been shared with

How we protect it

Passwords are stored encrypted and cannot be read even by system administrators. Access to the dashboard is restricted by role: whoever administers one chapter cannot see another chapter's data. The database is not reachable from the internet. Pages are served over an encrypted connection (HTTPS).

No system is completely immune. If an incident occurs that may pose a risk to you or your child, we will notify you and the Brazilian data protection authority, as the law requires.

Contact

To exercise any of the rights above, or for questions about this text, write to the contact below. We answer as soon as we can.