Privacy Policy and LGPD

Back to website

1. Controller and Contact

For processing performed in its own capacity, the controller is 67.602.865 KRYSTIANO INACIO FERREIRA, CNPJ 67.602.865/0001-07, with a business address at Rua Alfredo Merlo, 104, Rio Marinho, Vila Velha/ES, postal code 29112-360. The service’s trade name is Dono da Oficina and the contact is [email protected].

2. Data Processing Roles

Dono da Oficina acts as the controller of data needed for registration, authentication, billing, support, security, first-party communications, and administration of programs offered by the platform.

For customer, vehicle, work order, inventory, and other information entered by the workshop to manage its business, the the workshop is the controller and Dono da Oficina generally acts as the processor, following the workshop’s lawful instructions. Each workshop must inform its own customers about data processing and determine an appropriate legal basis.

3. Data processed and its source

• Registration and Account: name, email, phone number, CPF or CNPJ, address, users, roles, and authentication credentials.
• Billing and documents: plan, payment history, tax information, and transaction identifiers. Full payment details are processed by the payment provider.
• Workshop Operations: customers, vehicles, work orders, scheduling, inventory, financial transactions, tax documents, and communications entered by the workshop.
• WhatsApp Integration: connected number, recipient, technical session data, connection status, send identifiers, date, time, delivery, and error. Content needed for automation is transmitted temporarily and is not retained by Dono da Oficina as a message history.
• Usage and Security: IP address, browser, device, date and time, pages visited, event logs, failures, and actions relevant to security.
• Referrals and loyalty: participant identification, referral association, credits, redemptions, acceptance, and records needed to prevent fraud.

Data is provided by the data subject or the workshop responsible for the account, through user-activated integrations, or collected automatically while using the website and system.

Dono da Oficina does not import conversations, access groups, or provide human access to a WhatsApp inbox. The details are set out in the WhatsApp Integration Rules.

4. Purposes and Legal Bases

• Service delivery and support: contract performance or pre-contractual procedures under Article 7, item V, of the LGPD.
• Billing, tax invoicing, and required retention: contract performance and compliance with legal or regulatory obligations under Article 7, items II and V.
• Security, fraud prevention, and defense of legal rights: legitimate interest, credit protection, and the regular exercise of rights under Article 7, items VI, IX, and X, subject to necessity and proportionality.
• Service communications: performance of the contract and legitimate interest. Promotional communications include an option to unsubscribe.
• Website Analytics and Advertising: consent to cookies and optional technologies, which may be refused or withdrawn at any time.

5. Sharing

Dono da Oficina does not sell personal data. Sharing is limited to what is needed for the stated purposes and may involve:

• Google Firebase and other providers of hosting, databases, authentication, and security;
• Google Analytics and Google Ads, configured with optional storage denied by default. Optional cookies and identifiers are activated only after consent;
• payment providers, tax invoice issuance, messaging, and integrations requested by the user;
• professional advisors and public authorities, where needed to meet legal obligations, prevent fraud, or exercise rights; and
• a potential successor to the operation, subject to appropriate safeguards and notice when required.

Data subjects may request information about specific entities with which their data was shared, subject to commercial and industrial secrets and legal limits.

6. Cookie and Similar Technologies Policy

Optional cookies are disabled by default. Visitors can accept all optional cookies or reject them. You can change your selection at any time using the link Cookie Preferences in the footer.

Google Analytics and Google Ads are not loaded until at least one optional category is authorized. Third-party technical timelines may change, and the browser lets you delete identifiers already stored. When you revoke a category, the website stops new optional processing and attempts to remove accessible identifiers.

7. Retention and Deletion

Data is retained for as long as needed to provide the service, meet legal obligations, and exercise rights. After cancellation, the workshop’s operational data may remain available for up to 90 days to recover the account. After this period, data will be deleted or anonymized, except for records that must be retained to meet legal obligations, prevent fraud, or defend rights. Backups are deleted according to the applicable technical lifecycle.

8. Security and Incidents

Technical and administrative measures are tailored to processing risks, including communication protection, access controls, and security logs. No environment is completely immune to incidents. If an incident may create a relevant risk or harm, containment measures and notices required by the LGPD and ANPD will be carried out.

9. Data Subject Rights

Under Article 18 of the LGPD, the data subject may request:

• confirmation of whether data is being processed and access to the data;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data;
• portability, subject to applicable regulations and commercial and industrial secrets;
• deletion of data processed with consent, subject to legal retention exceptions;
• information about sharing and the consequences of not providing consent;
• withdrawal of consent and objection to unlawful processing; and
• filing a complaint with the ANPD and consumer protection agencies.

The request is free and may require identity verification to prevent fraud. Simplified confirmation and access will be provided as soon as possible; a complete access request will be fulfilled within 15 days under Article 19 of the LGPD. Other requests will follow applicable legal and regulatory deadlines.

10. Data Protection Officer

The data protection officer is the contact for data subjects and the ANPD:

• Data Protection Officer: Krystiano Inacio Ferreira
• Email: [email protected]

11. International Transfer

Use of global infrastructure and services, including Google, may involve processing in other countries, such as the United States. International transfers will occur only under an applicable legal basis and one of the mechanisms permitted by Article 33 of the LGPD and ANPD regulations, including ANPD-approved standard contractual clauses when used.

12. Changes and Contact

This policy may be updated to reflect legal or operational changes. Material changes will be communicated appropriately. For questions, requests, or complaints, email [email protected].

Last updated: August 14, 2026.