Privacy Policy

1. Who is the data controller

The controller of the personal data processed through the platform is Chaplin Ecossistema de Entretenimento S.A., CNPJ 64.766.324/0001-18, headquartered at Rua Rio de Janeiro, 471, Centro, Belo Horizonte, MG, 30160-041, Brazil. For any matter related to privacy and data protection, contact us at humbertocr@viachaplin.com.

2. Which personal data we collect

We collect only the data needed to operate the platform:

• Account data: name and e-mail address provided at sign-up and login, processed through our digital identity partner W3Block.
• CPF (Brazilian taxpayer number): requested when you activate the benefits club, to create your account with our partner Alloyal (Lecupon).
• Transaction data: information about PAK purchases made through the W3Block checkout, including payment data processed by the payment providers connected to that checkout.
• Browsing data: IP address, browser information and the cookies described in our Cookie Policy, including language preference, authenticated session and, only with your consent, the affiliate referral code.
• Contact data: information you voluntarily send us, for example by e-mail.

3. Why we use your data and on which legal bases

We process personal data only under the legal bases set out in article 7 of the LGPD:

• Performance of a contract (art. 7, V): creating and maintaining your account, processing PAK purchases, delivering rewards and providing access to the benefits club.
• Consent (art. 7, I): use of non-essential cookies, such as the affiliate-attribution cookie. You may withdraw consent at any time without affecting your use of the platform.
• Legitimate interest (art. 7, IX): keeping the platform secure, preventing fraud and improving our services, always respecting your reasonable privacy expectations.
• Compliance with a legal or regulatory obligation (art. 7, II): retention of access logs required by the Brazilian Internet Civil Framework and of tax and accounting records.

4. Who we share your data with

We do not sell personal data. We share only what is necessary to provide the services, with processors contractually required to protect your data, or when required by law or by a competent authority. Our main processors and partners are:

• W3Block: digital identity (login) and processing of the PAK purchase checkout.
• Alloyal (Lecupon): operation of the benefits club, which requires your CPF to activate the benefits account.
• Google Cloud: hosting of the platform infrastructure.
• Payment providers connected to the W3Block checkout, to process purchase payments.

5. International data transfers

Part of our infrastructure relies on cloud computing services that may process or store data outside Brazil. In those cases we adopt the safeguards provided for in Chapter V of the LGPD, such as engaging providers that offer adequate data protection guarantees.

6. Cookies

We use cookies that are necessary for the site to work and, with your consent, marketing cookies for affiliate-program attribution. The full list of cookies, their purposes and lifetimes, and instructions for managing your preferences are in our Cookie Policy.

Read the Cookie Policy

7. How long we keep your data

We keep your personal data while your account is active and for as long as needed to fulfil the purposes described in this policy. Some data is kept for specific legal periods, such as access logs (6 months, under the Brazilian Internet Civil Framework) and tax records (5 years). After those periods, data is securely deleted or anonymized.

8. How we protect your data

We adopt technical and organizational measures to protect your data, such as encryption in transit (HTTPS), access control, least-privilege principles and data minimization. Even so, no system is fully immune to incidents; if a security incident occurs that may cause you relevant risk or harm, we will notify you and the Brazilian Data Protection Authority (ANPD), as required by the LGPD.

9. Your rights as a data subject

The LGPD grants you, at any time and upon request, the rights set out in article 18:

• Confirmation that your data is being processed.
• Access to the data we hold about you.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of unnecessary or excessive data, or data processed in violation of the law.
• Portability of your data to another service provider, subject to applicable regulations.
• Deletion of data processed on the basis of your consent, except where the law allows retention.
• Information about who we share your data with.
• Information about the possibility of refusing consent and the consequences of doing so, as well as withdrawal of consent at any time.

10. How to exercise your rights

To exercise any of these rights, send an e-mail to humbertocr@viachaplin.com with the subject "Personal data". We will respond as quickly as possible, within the deadlines set by the LGPD and ANPD regulations. If you are not satisfied with our response, you may also file a complaint with the ANPD (gov.br/anpd).

11. Data protection officer

The contact channel for Chaplin's data protection officer (DPO, "encarregado" under the LGPD) is humbertocr@viachaplin.com.

12. Children and adolescents

The platform is intended for people aged 18 or over. We do not knowingly collect personal data from children or adolescents; if we identify such an account, the data will be deleted.

13. Changes to this policy

We may update this policy to reflect changes in the platform or in the law. The date of the last update appears at the top of the page and, in case of relevant changes, we will notify you through the platform's channels. We recommend revisiting this page periodically.