Privacy Policy

1. Controller and contact

The controller of your personal data is Midwestern Tech, which operates the Platform and is legally responsible for the event. VIGIA is only the event's name and has no separate legal personality. WMDG supports the event by including it in its UFG community outreach activity (Atividade de Extensão); WMDG is not the controller under this Policy.

Midwestern Tech Soluções Digitais LTDA, CNPJ 45.298.695/0001-78, with its registered office at R. Copaíba, nº 01, Shopping DF Plaza, Torre B, Sala 1015/154, Norte (Águas Claras), Brasília/DF, CEP 71.919-540. Data-rights contact channel: pedrozaalexandre@gmail.com or (62) 8276-3702.

2. Data we collect

We collect only what we need to run the event:

• Account data: e-mail address, display name (codinome), and a password stored only as a cryptographic hash.
• Date of birth, used to confirm you are 18 or older.
• Optional profile data you choose to add: a short bio and an avatar image. These are public — please do not put sensitive information in your bio.
• Contact and event-operation form data: telephone number; availability and expected attendance; equipment and accessories you can bring or need; workshop interest, responses, and participation; and any other answers you submit through event forms.
• Food-safety form data: dietary restrictions, allergies, and other food-related information you submit. Allergies and some restrictions may reveal health data, which the LGPD treats as sensitive personal data.
• Acceptance log: the date and time, your IP address, your browser's user-agent, and which version of the Terms and this Policy you accepted.
• Optional partner-sharing choice: whether you allowed disclosure for coupon or benefit validation and redemption, and when you last changed that choice.
• Basic technical data needed to serve the site, such as session cookies.
• Audience measurement data: a random pseudonymous identifier in the existing signed session cookie, normalized page routes, language, coarse device and browser categories, external referrer domain, and UTM campaign tags. We do not store IP addresses or raw user-agent strings for audience measurement.

3. Purposes and legal bases

We process your data for these purposes and legal bases under the LGPD:

• To create and manage your account and let you take part in the event — legal basis: performance of a contract and preliminary procedures at your request (art. 7, V).
• To confirm the 18+ eligibility requirement — legal basis: performance of a contract (art. 7, V).
• To contact you about practical event matters using the telephone number you provide. Legal basis: performance of a contract and preliminary procedures at your request (art. 7, V).
• To plan attendance, workstations, electrical capacity, equipment support, team formation, and workshops from your availability, equipment, skills, and workshop answers. Legal basis: performance of a contract and preliminary procedures at your request (art. 7, V).
• To plan food quantities and safe meal handling from dietary restrictions and allergies. Before collecting or using answers that reveal health information, Midwestern Tech must document the applicable legal basis under LGPD art. 11 and provide any required separate consent and withdrawal channel.
• To keep a record that you accepted the Terms and this Policy, including the IP address — legal basis: legitimate interest and the defence of our rights (art. 7, IX).
• To keep the Platform secure and working — legal basis: legitimate interest (art. 7, IX).
• To understand aggregate attendance and where sessions begin and end, without advertising or user profiles — legal basis: legitimate interest (art. 7, IX).
• With your optional consent, to disclose your codename (display name) and e-mail address to the partner responsible for validating or redeeming your campaign coupon or benefit. The only purpose is validation or redemption. Legal basis: consent (art. 7, I).

We do not use your data for marketing. Partner sharing is optional, uses a separate checkbox that is unchecked by default, and does not affect account creation or access to a coupon or benefit.

Your filed answers are not public. The current form system allows only you and Platform administrator accounts to read them. Before launch, Midwestern Tech must restrict each answer group to the administrator roles that need it, with separate access controls for dietary and allergy data. The form importer reads only public question text from Google Forms; it does not send answers filed here to Google.

4. Sharing your data

We do not sell your data. If you give the separate optional consent, we disclose your codename (display name) and e-mail address only to the partner responsible for validating or redeeming your campaign coupon or benefit. The partner receives them only for that validation or redemption. If you refuse, your identity stays hidden and the partner can still validate the code. You can grant or revoke consent from your profile; revocation stops future disclosure.

Apart from that optional disclosure, we share data only with providers that help us operate the Platform:

• Fly.io, our hosting and database provider, which stores the application data in its GRU region (São Paulo, Brazil).

We may also disclose data when required by law or a competent authority.

5. Cookies

We use only first-party cookies. The signed, HTTP-only session cookie keeps the site secure and, for audience measurement, carries a random pseudonymous identifier. We do not use advertising cookies, third-party tracking cookies, cross-site tracking, or audience data to build user profiles.

6. International data transfers

Our hosting and database provider, Fly.io, stores the application data in Brazil (the GRU region, São Paulo). If a future provider processes data outside Brazil, we will use a transfer mechanism allowed by the LGPD (arts. 33–35), such as an adequacy decision or standard contractual clauses. If a transfer depends on your consent, we will ask for it separately.

7. Data retention

We keep your account data, including the acceptance log, for up to 5 (five) years after the event, as evidence that you accepted these documents and for the period allowed by law. When data is no longer needed, we delete or anonymize it, except where the law lets us keep it (LGPD art. 16).

We keep telephone and event-form answers, including attendance, equipment, workshop, dietary, and allergy data, for up to 5 (five) years after the event, including in backups, after which we delete or anonymize them.

A daily cleanup deletes raw audience page views older than 90 days and audience session records whose last activity is older than 90 days. The report history is limited by those retention rules, and no long-term audience archive is kept. The audience report is restricted to administrators and is not published on public pages.

8. Security

We take reasonable technical and organizational measures to protect your data, including storing passwords only as hashes, restricting account access, and limiting the audience report to administrators. No system is perfectly secure; if a breach is likely to create risk to you, we will act as the LGPD requires.

9. Your rights

Under the LGPD you may, at any time and free of charge, ask us to:

• Confirm that we process your data, and access it.
• Correct incomplete, inaccurate, or outdated data.
• Anonymize, block, or delete unnecessary or excessive data, or data processed contrary to the law.
• Port your data to another provider, as regulated.
• Delete data processed with your consent, and withdraw that consent.
• Get information about the entities with which we shared your data.
• Be informed about the option not to consent and about the consequences of refusing.

To exercise these rights, use Midwestern Tech's data-rights contact channel once it is published on the Platform. You may also petition the Autoridade Nacional de Proteção de Dados (ANPD).

10. Minors

The Platform is intended for people aged 18 or older and does not knowingly accept accounts from minors. If we learn that a minor created an account, we will delete it.

11. Changes to this Policy

We may update this Policy. The version and date at the top show the current one. When a change is material we will make it visible and, where appropriate, ask you to accept the new version. Earlier versions are kept so we can tell which one you accepted.