Privacy Policy

​

This website is maintained and operated by BDL SERVIÇOS DE DESIGN AUTORAL LTDA.

We collect and use certain personal data from individuals who use our website. In doing so, we act as the controller of this data and are subject to the provisions of Federal Law No. 13.709/2018 (General Data Protection Law – LGPD).

We take the protection of your personal data seriously. For that reason, we make this privacy policy available, which contains important information about:

• Who should use our website

• What data we collect and how we use it

• Your rights regarding your personal data

• How to contact us

​

1. Who should use our website

Our website should only be used by individuals over eighteen years of age. Therefore, children and teenagers should not use it.

2. Data we collect and why we collect it

Our website collects and uses some personal data from our users, as described in this section.

2a. Personal data expressly provided by the user

We collect the following personal data that our users provide explicitly when using our website:

• Full name

• Email address

• Shipping address

• Phone number

• CPF and/or RG (Brazilian tax ID or ID document)

These data are collected at the following times:

• When the user fills out a contact or newsletter form

• When the user registers on the website

• When the user makes a purchase

The data provided by our users is collected for the following purposes:

• To allow users to purchase our products and services

• To allow users to contact customer support

• To send our products and offers to registered users

2b. Sensitive data

We do not collect sensitive data from our users, as defined by Articles 11 and following of the LGPD. This means we do not collect data related to racial or ethnic origin, religious beliefs, political opinions, union membership, or membership in religious, philosophical, or political organizations; data concerning health, sex life, genetic or biometric data when linked to a natural person.

2c. Collection of data not expressly listed

Occasionally, other types of data not expressly mentioned in this Privacy Policy may be collected, provided they are given with the user’s consent or when the collection is permitted based on another legal basis provided by law.

In any case, users will be informed about any data collection and respective processing activities.

3. Sharing personal data with third parties

We do not share your personal data with third parties, except when required to comply with a legal or regulatory obligation or by order of a public authority.

4. How long your personal data is stored

Personal data collected by the website is stored and used for the time necessary to fulfill the purposes listed in this document, while considering the rights of the data subjects, the website controller, and applicable legal or regulatory obligations.

Once the storage period expires, personal data is deleted or anonymized, unless retention is required by legal or regulatory reasons.

5. Legal basis for processing personal data

A legal basis for data processing is the legal justification required by law. Every personal data processing operation must have a corresponding legal basis.

We process users' personal data in the following cases:

• With the data subject’s consent

• To exercise regular rights in legal, administrative, or arbitration proceedings

• To execute a contract or pre-contractual procedures requested by the data subject

• When necessary to meet the legitimate interests of the controller or third parties

• For credit protection purposes

5a. Consent

Some personal data processing activities will require the user's prior consent, given freely, clearly, and knowingly.

Users may withdraw their consent at any time. If there is no legal basis allowing or requiring data retention, the data provided with consent will be deleted.

Users may also choose not to consent to certain processing operations. In such cases, some website features may not be available. Users will be informed of the consequences beforehand.

5b. Contract execution

For the performance of purchase or service contracts between the site and the user, other related or necessary data may be collected and stored, including communications with the user.

5c. Legitimate interest

In specific cases, we rely on our legitimate interest to process data. To learn more about when we apply this basis or the assessments we conduct to justify it, please contact our Data Protection Officer using the details provided in the “How to contact us” section.

6. User rights

Website users have the following rights under the LGPD:

• Confirmation of data processing

• Access to their data

• Correction of incomplete, inaccurate, or outdated data

• Anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data

• Data portability to another service or product provider, upon request

• Deletion of personal data processed with consent, except where retention is legally required

• Information on public and private entities with which the controller shared data

• Information on the possibility of denying consent and consequences thereof

• Revocation of consent

It is important to note that under LGPD, there is no right to deletion of data processed on legal grounds other than consent, unless the data is unnecessary, excessive, or unlawfully processed.

6a. How to exercise your rights

Data subjects can exercise their rights by completing the form available at:
https://www.barbaradavila.com.br/politica-de-privacidade

Alternatively, they may contact our Data Protection Officer by email or post. Contact details are in the "How to contact us" section of this Privacy Policy.

To ensure the person exercising their rights is the actual data subject, we may request documents or other information to confirm identity. This will only be done when strictly necessary, and the requester will be informed accordingly.

7. Security measures for personal data

We employ technical and organizational measures to protect personal data from unauthorized access and accidental or unlawful destruction, loss, alteration, or disclosure.

These measures take into account the nature of the data, the context and purpose of processing, potential risks, and industry standards.

Security measures include:

• Data is stored in a secure environment

• Access to user data is restricted to authorized personnel

• We keep records of those who access or process data

While we take all reasonable precautions, no system is immune to risks. Incidents caused by third parties (e.g., hacking) or the user's own actions (e.g., sharing personal data with third parties) may still occur. In such exceptional cases beyond our control, we are not liable.

Nevertheless, if any security incident likely to result in significant risk or harm occurs, we will notify affected users and the National Data Protection Authority, in accordance with the LGPD.

8. Complaints to the data protection authority

Without prejudice to other administrative or judicial remedies, data subjects who feel their rights have been violated may file a complaint with the Brazilian National Data Protection Authority (ANPD).

9. Copyrights

For each work, Barbara d'Avila assures you that: Barbara d'Avila is the sole legal owner and holder of all copyright rights and interests; she has not licensed or assigned the copyright to any third party; and the work is original and not copied, in whole or in part, from any other source.

​

10. Changes to this policy

This version of the Privacy Policy was last updated on: 06/11/2020.

We reserve the right to modify this policy at any time, especially to reflect changes to our website, including the addition or removal of features.

Whenever changes are made, users will be notified.

​

11. How to contact us

If you have questions about this Privacy Policy or the personal data we process, please contact our Data Protection Officer via one of the following channels:

Email: barbara.bdavila@gmail.com
Mailing address:
R. Santa Cruz, 2187 – Room 10
Vila Mariana – São Paulo – SP – Brazil