Privacy Policy
Last updated: 2026-07-26
Who we are
Campeão Sec is a Brazilian technology company that operates the digital identity infrastructure platform available at campeaosec.com. We act as a data processor under Brazil’s General Data Protection Law (Law No. 13,709/2018 — LGPD), processing personal data on behalf of our clients (data controllers) to provide the contracted services.
What data we collect
Account data: email address, name, and company information (CNPJ/CPF) provided at signup.
Usage data: API call logs, consumption volumes, IP addresses, and access timestamps.
End-user data (via API): CPF, CNPJ, biometric images (selfie + document), and data returned by lookups — processed exclusively to provide the service to the client.
Technical data: HTTP headers, session identifiers, and diagnostic data for platform security and stability.
How we use the data
The collected data is used exclusively to:
- Provide the contracted services (KYC and CPF/CNPJ lookups)
- Billing and credit management
- Platform security and fraud prevention
- Compliance with legal and regulatory obligations
- Operational communications (usage alerts, service updates)
We never use data for third-party marketing purposes or to build external behavioral profiles.
Legal basis (LGPD)
Data processing is based on the following LGPD legal bases:
Art. 7, V — Contract performance: account data and usage logs are processed to fulfill the service agreement.
Art. 11, II, a — Explicit consent (sensitive data): biometric images are collected by the KYC widget through the end user’s explicit, non-dismissible consent, shown before any capture.
Art. 7, II — Compliance with a legal obligation: retention of logs and records as required by applicable regulations.
Data sharing
We never resell data. Your users’ data is never shared with third parties for commercial, advertising, or analytics purposes.
We may share data exclusively with infrastructure subprocessors (hosting and security providers) that operate under confidentiality agreements and are subject to equivalent data protection obligations.
Data processing agreements (DPA) are available on request for clients who require this documentation. Contact us at privacidade@campeaosec.com.
Retention and deletion
Biometric images: retained for 5 years after verification, as required by Brazilian regulations applicable to the sector.
CPF/CNPJ lookup logs: retained for 12 months.
Account data: kept while the account is active and for 5 years after closure, to comply with legal obligations.
To request early deletion or data portability, contact us at privacidade@campeaosec.com.
Your rights
Under the LGPD, you have the right to:
- Access the data we hold about you
- Correct incomplete or inaccurate data
- Request deletion of data, where permitted by law
- Port your data to another provider
- Withdraw consent, where applicable
- Be informed about how your data is shared
To exercise your rights, contact us at privacidade@campeaosec.com. We respond within 15 business days.
Security
We implement technical and organizational measures to protect your data: AES-256-GCM encryption at rest, TLS 1.3 in transit, HMAC-SHA256 signatures on webhooks, role-based access control (RBAC), and continuous security monitoring. Our infrastructure is located in Brazil.
DPO Contact
Our Data Protection Officer (DPO) can be reached at privacidade@campeaosec.com. For LGPD-related requests, include in the subject line: "LGPD Request — [request type]".