Facilitamuito Negócios e Serviços Ltda., responsible for EUDR Data Hub, recognizes the importance of privacy, personal data protection and the security of the operational and geospatial information processed by the platform. This Privacy Policy explains how we collect, use, store, share, transfer and delete such information.
Facilitamuito Negócios e Serviços Ltda. acts as data controller of the personal data processed directly by the platform, where applicable.
1. Information we collect
EUDR Data Hub collects information necessary to provide our compliance and traceability services:
- Account data: Name, email, phone and company information
- Operational data: Information about suppliers, batches, geometries and EUDR documentation
- Technical data: Access logs, IP addresses, platform usage data
- Geospatial data: Coordinates, polygons and deforestation analysis
1.1. Geolocation files and data
Geolocation files uploaded to the platform may contain coordinates, polygons, identifiers of properties, farms, sections, suppliers and other information related to the origin of products and to the supply chain.
These files and data are processed to perform technical validations, generate reports, organize evidence, run geospatial analyses, provide the contracted functionalities and support the traceability and due diligence processes conducted by EUDR Data Hub users.
Geolocation files uploaded in any module or plan are stored for the term of the contract or while the corresponding account and services remain active.
2. How we use your information
We use your data exclusively to:
- Provide EUDR compliance and due diligence services
- Generate reports and deforestation risk analysis
- Maintain platform security and integrity
- Communicate important service updates
- Comply with legal and regulatory obligations
- Receive, store, organize and validate geolocation files
- Perform technical checks related to the structure and format of the files
- Run geospatial analyses requested by the user
- Generate reports, evidence and results related to traceability and due diligence
- Enable the operation of the contracted modules and services
- Keep records necessary for security, auditing, technical continuity and legal defense
- Comply with applicable legal, regulatory and contractual obligations
Files, geospatial data and supply chain information will not be used for training, developing or improving artificial intelligence models, algorithms or similar systems without prior, express and written authorization or document from the client. Any such authorization must identify the purpose of the use and may be revoked in writing, without affecting processing lawfully carried out before the revocation.
2.1. Sharing and processing by third parties
In order to perform certain functionalities requested by the user, EUDR Data Hub may share, or allow the processing of, files, coordinates, polygons and other strictly necessary data by providers of infrastructure, storage, security, data processing and geospatial analysis services.
Geospatial analysis services may include platforms, databases, APIs and providers specialized in land cover, vegetation, forests, deforestation, satellite imagery, geometry validation and assessment of territorial information.
Sharing must be limited to the data necessary to perform the requested functionality. Service providers and subprocessors must be subject to contractual obligations of confidentiality, data protection and information security.
Sharing with these services does not transfer ownership of the client's files or data to the provider and does not authorize their use for the provider's own purposes incompatible with the provision of the service.
2.2. International data transfer
Some of the service providers, subprocessors, infrastructure services and geospatial analysis services used by the platform may process or store data outside Brazil.
Where an international data transfer occurs, EUDR Data Hub will adopt measures intended to ensure adequate protection of the data, including data protection contracts and clauses, technical and organizational security measures, and a requirement of compliance with the Brazilian General Data Protection Law (LGPD) and other applicable regulations.
The transfer will be limited to the information necessary to perform the requested functionality, provide the contracted service, ensure platform security or comply with an applicable obligation.
3. Data retention and deletion
Geolocation files, results, reports, records and other data related to the services will be stored for the term of the contract or while the corresponding account remains active.
After termination of the contract, data may be retained for up to 6 months in order to comply with legal or regulatory obligations, carry out audits, regularly exercise rights, provide legal defense, restore information, and ensure security and technical continuity.
Once this period has elapsed, data must be deleted or anonymized, except where retention for a longer period is required to comply with a specific legal or regulatory obligation, a determination of a competent authority, or the regular exercise of rights in judicial, administrative or arbitration proceedings.
Data that has been anonymized in such a way that it cannot reasonably be associated with the data subject or the originating organization may be retained as permitted by applicable law.
Deletion requests
The user or the organization responsible for the account may request the deletion of related files and data through the email support@eudrdata.tech.
The request will be reviewed and answered within 15 days. Data will be deleted where deletion does not prevent the execution of an active service, does not harm the rights of other users or organizations, and does not conflict with legal, regulatory, contractual, audit or security obligations.
Where the deletion of certain data would prevent the continuity of a contracted functionality, EUDR Data Hub must inform this consequence before executing the request.
After deletion from active systems, residual copies may remain in protected backups for up to 90 days. During this period, such copies will not be used for ordinary operational purposes and will be eliminated in accordance with the regular and secure backup rotation cycle.
If a backup needs to be restored during this period, the previously deleted data must be removed again from active systems as soon as technically feasible.
4. Data protection
We implement rigorous security measures:
- SSL encryption for data transmission
- AES-256 encryption for storage
- Role-based access controls (RBAC)
- Complete audit of accesses and modifications
- Secure backup and disaster recovery
- Application of access controls to geolocation files and geospatial data
- Restriction of access to authorized users, staff and subprocessors
- Protection of data in transit and at rest
- Logging of accesses and operations relevant to security and auditing
- Backup, recovery and secure deletion procedures
5. Rights and contact
For privacy questions, contact us:
This contact channel may also be used to:
- Request confirmation of processing
- Request access, correction or update
- Request deletion, where applicable
- Obtain information about sharing and international data transfer
- Revoke a written authorization for model training or improvement
- Clarify questions about retention and processing of geolocation files
To exercise rights related to the data processed by the platform, request deletion, revoke a written authorization or clarify questions about this Privacy Policy, contact us at support@eudrdata.tech.
Email: support@eudrdata.tech
Address: Goiânia - GO - Brazil