LGPD — Brazilian Data Protection

Draft for approval. This text was prepared for review and approval by FCA and has not yet been published.

1. What is the LGPD and who it covers

The LGPD (Lei Geral de Proteção de Dados, Law No. 13.709/2018) is Brazil's data protection law. It applies to the personal data of people residing in Brazil, including Brazilian students who enrol through partners in Brazil. Fredericton Christian Academy ("FCA") handles your data in line with the LGPD when you are a resident of Brazil.

2. Who is responsible for your data

FCA, in Canada, is the controller of the personal data that it processes to admit students and to administer their enrolment. The educational partner in Brazil that helps the family is an independent controller of the data that it collects and keeps for its own purposes, under the LGPD. Our Privacy Policy describes what we collect, why, who receives it and how long it is kept.

3. Your rights under the LGPD

If you are a resident of Brazil, you have the right to:

• Confirmation and access: know whether we process your data and access it
• Correction: correct incomplete, inaccurate or outdated data
• Anonymization, blocking or deletion: of unnecessary or excessive data, or data processed in non-compliance with the law
• Portability: transfer your data to another service provider
• Deletion: delete data processed on the basis of your consent
• Information about sharing: know with which public and private entities your data is shared
• Information about refusing consent: know that you may refuse consent and what happens if you do
• Revocation of consent: at any time, for data processed on that basis
• Objection: object to processing that does not comply with the law
• Review of automated decisions: request human review of decisions made automatically

The system does not make decisions about people automatically: the automatic reading of flight tickets and proofs of payment only suggests dates and amounts, and a person checks them.

4. How to exercise your rights and our response times

Write to the Privacy Contact: [email protected]. For a student who is a minor, the request is made by a parent or legal guardian. We may ask you to confirm your identity. We confirm without delay whether we process your data, in a simplified form, and we give you a complete declaration within 15 days from your request, as Art. 19 of the LGPD provides. Other requests are answered as soon as possible and in any case within the legal term. Families can also correct their details through their personal link.

5. Legal basis for processing

• Consent (Art. 7, I): given by checking the boxes in the enrolment form
• Contract performance (Art. 7, V): necessary to process the enrolment that the family requested
• Legal obligation (Art. 7, II): immigration, education and accounting rules
• Legitimate interest (Art. 7, IX): keeping the system secure and preventing misuse

6. Children, adolescents and sensitive data

Most students are under 18. Their data is processed in their best interest and with the specific and prominent consent of at least one parent or legal guardian (Art. 14). Health information and religion (homestay profile) are sensitive data (Art. 11): they are collected only for the school, the homestay and the student's well-being, and are accessed only according to the role of each profile.

7. International transfer of data

The database and the uploaded files are stored in São Paulo, Brazil (Amazon Web Services sa-east-1 region, through Supabase), so data of students in Brazil stays in Brazil. It is accessed by FCA in Canada and by authorized partners in other countries, which is an international transfer. This transfer is based on the need to carry out the enrolment that the data subject requested (Art. 33, IX) and, where applicable, on the consent given in the enrolment form (Art. 33, VIII), with the safeguards described in the Privacy Policy: access restricted by profile, short-lived signed links to files, automatic reading of documents on our own server and no third-party artificial intelligence services.

8. Retention

We keep the data only as long as needed for the enrolment and for legal, accounting and security obligations, and then we anonymize or delete it. The periods and the process are in section 10 of the Privacy Policy.

9. Data protection officer (DPO)

The data protection officer (encarregado) is reachable through the Privacy Contact: [email protected]. General questions and support: [email protected] or [email protected] (WhatsApp +55 19 99964-9625).

10. Complaints to the ANPD

If we have not answered satisfactorily, you may file a complaint with the Brazilian National Data Protection Authority (ANPD): gov.br/anpd