Legal
LGPD Compliance
Last updated: July 30, 2026. Branchly's commitment to Brazil's General Data Protection Law.
The Lei Geral de Proteção de Dados (LGPD — Law No. 13,709/2018) is Brazil's comprehensive data protection framework. As a Brazilian company operating in Brazil, Branchly Tecnologia Ltda. is subject to the LGPD and is committed to full compliance.
1. Data Controller
Branchly Tecnologia Ltda. acts as the Data Controller (Controlador) for the personal data processed through the Branchly platform. Our DPO (Encarregado) can be reached at privacidade@branchly.com.br.
2. Legal Bases for Processing
We process personal data under the following LGPD legal bases (Art. 7): Consent (consentimento) for optional analytics and marketing communications; Contract performance (execução de contrato) to deliver our service; Legitimate interest (legítimo interesse) for fraud prevention and service improvement; Legal obligation (obrigação legal) for tax and compliance records.
3. Your Rights Under LGPD
Under Art. 18 of the LGPD, you have the right to: (i) confirm whether we process your data; (ii) access your data; (iii) correct incomplete, inaccurate, or outdated data; (iv) anonymize, block, or delete unnecessary or excessive data; (v) port your data to another provider; (vi) delete data processed with your consent; (vii) information about third parties we share your data with; (viii) information about the possibility of denying consent and the consequences; (ix) withdraw consent at any time.
4. How to Exercise Your Rights
Submit a request to privacidade@branchly.com.br with your full name, CPF (if applicable), email address on the account, and a description of the right you wish to exercise. We will respond within 15 days as required by the LGPD, and will request identity verification before disclosing or modifying data.
5. Data Retention
We retain personal data for as long as your account is active, plus any period required by Brazilian law (e.g., fiscal records under Lei 9.430/1996). Upon account deletion, personal data is anonymized or permanently deleted within 30 days, except where retention is legally required.
6. International Data Transfers
Our service uses infrastructure hosted in the United States (Vercel, Supabase, Cloudflare). These transfers are made under standard contractual clauses or to countries with an adequate level of protection as recognized by the ANPD, in accordance with Art. 33 of the LGPD.
7. Data Security
We implement technical and organizational measures appropriate to the risk, including TLS 1.2+ encryption in transit, encryption at rest, access controls, and regular security reviews. See our Security page for details.
8. Incident Notification
In the event of a security incident that may result in significant risk or harm to data subjects, we will notify the ANPD (Autoridade Nacional de Proteção de Dados) and affected users within the timeframes established by ANPD Resolution CD/ANPD No. 15/2024 (within 3 business days for ANPD notification of high-risk incidents).
9. Consent Management
Where consent is the legal basis for processing, you may withdraw it at any time without consequence to the continued use of core service features. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. To manage your consent preferences, contact privacidade@branchly.com.br.
10. Children's Data
Our service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children or adolescents. If we become aware of such collection, we will promptly delete the data and notify the responsible guardian.
11. ANPD Complaints
If you believe your rights have not been respected, you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at www.gov.br/anpd. We encourage you to contact us first so we may resolve your concern directly.
12. DPO Contact
Data Protection Officer (Encarregado de Dados): privacidade@branchly.com.br | Branchly Tecnologia Ltda., Brazil.
This page supplements our full Privacy Policy.