política de privacidad

0. Who we are and how to contact the DPO

0.1 Who we are

The solutions described in this policy — the aprepara.com website and the LTRdeO portal/app — are provided by C SANTOS DE OLIVEIRA DESENVOLVIMENTO DE SOFTWARE (CALSOFT), a private legal entity registered with the Brazilian CNPJ/MF under no. 36.359.868/0001-20, headquartered at R Major Lara Ribas 72 - Bela Vista, Palhoça/SC, 88.132-789, Brazil.

0.2 How to contact us (DPO)

If, after reading this Policy, you have any questions or wish to submit a request regarding your personal data, you may contact our privacy team or our Data Protection Officer at: contato@aprepara.com / WhatsApp +55 (48) 9.9916-4500.

0.3 General provisions of this policy

We may update this policy from time to time by publishing a new version on this same page. We recommend checking this page occasionally to make sure you understand any changes. Relevant changes may be communicated by email or through the portal's messaging system.

Language: this policy is originally written in Portuguese (Brazil) and is also available in English. In case of any divergence between the versions, the Portuguese (Brazil) version prevails.

For adults aged 18 and over only: the LTRdeO portal and app are intended exclusively for persons aged 18 or over. Minors under 18 must not register, access or use the system. We do not knowingly collect personal data from minors under 18; if we become aware of a registration or data belonging to a minor, we will block access and delete the data, retaining only what is necessary to prevent a new registration attempt.

1. Institutional website (aprepara.com)

1.1 What we collect here

When you visit aprepara.com without registering or submitting any information, general data is collected automatically (server logs), including browser type, operating system, internet service provider, IP address and similar data — used to keep the website running securely and reliably.

The website has no forms: registration, including for the free trial, takes place on the portal (section 2).

We use a session cookie (PHPSESSID) to keep your chosen language and the attribution of the originating campaign (UTM) when you reach the website from an ad.

We store your display preferences — font size and contrast — in your browser (not in a cookie), to remember your choice on your next visit. This does not identify you and is not used for tracking.

We use Google Analytics to understand, in aggregate, how the website is used (pages visited, where the visit came from, device type) — but only after you accept cookies in the banner shown on your first visit (see 1.3). Before you accept, or if you reject them, no Google script is loaded and nothing is sent to Google.

1.2 Cookies and trackers

1.3 How to reject / manage

On your first visit, a banner asks whether you accept or reject non-essential cookies (Google Analytics). Your choice is remembered for 180 days, and you can change it at any time through the Cookie preferences link in the website footer.

Regardless of that choice, you can also block or delete cookies directly in your browser settings — which may affect the usability of parts of the website:

• Mozilla Firefox
• Google Chrome
• Safari
• Microsoft Edge

2. Portal / App (ltrdeo.aprepara.com + app)

2.1 What we collect here

Registration and use of the web panel and the app:

• profile information — name, job title, profile photo;
• contact information — email, phone;
• data entered while using the service, including service orders, checklists and operational records;
• information generated when using the platform — when, how often and under what circumstances you use it;
• communications sent by email or through the support system.

Location (mobile app):

We collect precise or approximate location data while you are logged into the mobile app (Android/iOS), both in the foreground (app open and on screen) and in the background (app open, off screen). We use this data for: starting and finishing activities, showing the last known location to the manager, presence/connection status and calculating the distance between points.

Background collection can be disabled, or its schedule configured, by the account holder. You can use the app without enabling location collection on your device, but this limits some features (e.g., the manager will not see your last location). Location data collected during use remains linked to your account even if background collection is disabled, including for receipts, support, fraud prevention, insurance and legal disputes.

Service order photo and signature:

When you take a photo during an activity, it is saved on the device itself until it is sent — this works even without signal, and it is uploaded later without being lost. As soon as the upload is confirmed, the photo is moved to your device's gallery (the same one where the photos taken with the camera are kept). From that moment on it is yours: the app never deletes it (neither over time nor to free up space), and if you delete it from the gallery the app cannot recover it. Deleting it from the gallery does not remove the copy already sent to the system, which remains available to your manager in the panel. The signature collected during the activity, unlike the photo, is deleted from your device once the upload is confirmed — it is disposable and stays encrypted while it remains on the device.

A photo that is never sent — because you removed it from the activity, or because you logged out or signed in with another account on the same device before the upload — also goes to the gallery, in the LTRdeO/Unsent album, and becomes yours in the same way: it does not reach the system, and the app does not delete it. In these same cases, the signature and any other data not yet sent are lost; before that, the app shows what will be lost and asks for your confirmation.

2.2 Cookies and trackers

2.3 Sub-processors and international transfers

We may disclose your personal information to employees, officers, insurers, professional advisers, agents, suppliers or subcontractors, as reasonably necessary for the purposes described in this policy; to any member of our group of companies, on the same terms; when required by law or legal proceedings; to establish, exercise or defend our legal rights; and to the buyer (or prospective buyer) of any business or asset we are selling or considering selling. Outside these cases, we do not provide your personal information to third parties.

Some of the technology services we use process data outside Brazil, specifically in the United States and Australia, under Art. 33 of the LGPD and Art. 44 of the GDPR. International transfers take place exclusively to the suppliers below, which adopt appropriate safeguards:

The following Brazilian suppliers (no international transfer) also access personal data in the course of the contracted services:

• Banco Inter S.A. (CNPJ 00.416.968/0001-01) — payment processing and issuance of bank slips (boletos bancários);
• IPM Sistemas Ltda. / Municipality of Palhoça/SC — issuance of electronic service invoices (NFS-e) for Brazilian clients registered with a CNPJ or CPF.

The international transfers described in this section are carried out exclusively for the purposes and suppliers indicated here, based on the safeguards listed in the table above — and not on consent presumed from use of the platform.

2.4 How we use your information

We use your personal information to:

1. administer the platform and provide the contracted services;
2. issue invoices, bank slips and payment reminders, and collect your payments;
3. send notifications you have specifically requested;
4. answer questions and complaints related to the service;
5. keep the platform secure and prevent fraud;
6. verify compliance with the Terms of Use.

If you submit personal information for publication on the platform, we will publish and use that information in accordance with the licence you have granted us. Without your express consent, we do not provide your personal information to third parties for direct marketing purposes, whether ours or theirs.

3. Your rights

3.1 Brazil (LGPD)

Under the Brazilian General Data Protection Law (Law 13.709/2018 — "LGPD"), you have the right to:

1. confirm that we process your personal data;
2. access your personal data;
3. request the correction of incomplete, inaccurate or outdated data;
4. request the anonymisation, blocking or deletion of unnecessary or excessive data, or of data processed in breach of the LGPD;
5. request the portability of your data to another provider, subject to our commercial and industrial secrets, once regulated by the ANPD;
6. request the deletion of data processed on the basis of your consent, except in the retention cases provided for in the LGPD;
7. request information about whom we share your data with;
8. request information about the possibility of not giving consent and its consequences;
9. withdraw your consent, where processing is based on it;
10. object to processing that breaches the LGPD;
11. request a review of decisions made solely by automated means that affect your interests, such as access blocking or service suspension, under Art. 20 of the LGPD.

SPAM practices: we oppose any practice that promotes SPAM and are committed to ensuring that messages sent by the platform are always of interest to the recipient. You can stop receiving emails at any time by adjusting your preferences or cancelling your account.

3.2 European Union (GDPR)

You have the following rights regarding your personal data:

• Information about the data we store and how it is processed (Art. 15 GDPR);
• Rectification of inaccurate personal data (Art. 16 GDPR);
• Erasure of your data stored by us (Art. 17 GDPR);
• Restriction of processing, where we cannot delete your data due to a legal obligation (Art. 18 GDPR);
• Objection to the processing of your data (Art. 21 GDPR);
• Data portability, provided you have consented to the processing or entered into a contract with us (Art. 20 GDPR).

If you have given us consent, you may withdraw it at any time, with effect for the future. You may lodge a complaint with a supervisory authority at any time, such as the authority of your country of residence or the one supervising us as the controller.

3.3 Common rights — how to exercise them

You may ask us to provide any personal information we hold about you. This is subject to appropriate proof of your identity. Before responding to a request to exercise your rights, we may ask for additional information to confirm your identity. We may withhold the requested information to the extent permitted by law.

4. Retention, security and review

4.1 Data retention

Without prejudice to the following paragraph, we will delete or anonymise personal data within the periods below, counted from the termination of the contract or cancellation of the account:

Notwithstanding the periods above, we will retain documents containing personal data when required by law or regulation, when relevant to ongoing or potential legal proceedings, or to establish, exercise or defend our legal rights.

In the event of non-payment and account blocking, data remains stored during the blocking period and for 60 days after the effective cancellation, to allow the data subject to export it. After that period, the periods defined above apply.

4.2 Information security

We take technical and organisational precautions to prevent the loss, misuse or alteration of your personal information, including storage on secure servers (protected by password and firewall) and SSL/HTTPS encryption of data in transit. You acknowledge that the transmission of information over the internet is inherently insecure and that we cannot guarantee the absolute security of data sent over the internet. You are responsible for keeping the password used to access the platform confidential; we will never ask for your password, except when you log in.

4.3 Security incidents

Brazil (LGPD): in the event of a security incident that may cause relevant risk or damage to data subjects, under Art. 48 of the LGPD and ANPD Resolution CD/ANPD no. 15/2024: we will notify the Brazilian National Data Protection Authority (ANPD) within 3 business days of becoming aware of the incident; we will notify the affected data subjects when there is relevant risk or damage, within a reasonable time; and we will provide the ANPD with additional information within 20 business days, when requested.

European Union (GDPR): in the event of a personal data breach that results in a risk to your rights and freedoms, under Arts. 33 and 34 GDPR: we will notify the competent supervisory authority within 72 hours of becoming aware of it, where feasible; and we will inform the affected data subjects without undue delay when the breach is likely to result in a high risk.

To report a vulnerability or a suspected security incident, please contact our team at: contato@aprepara.com.

4.4 Third-party websites

Our website and portal may include links to third-party websites. We have no control over, and are not responsible for, the privacy policies and practices of third parties.

4.5 Legal bases for processing (Brazil)

Under Art. 7 of the LGPD, we process personal data on the following legal bases, according to the activity:

4.6 Legal bases for processing (European Union)

Under Art. 6(1) GDPR, we process personal data on the following legal bases, according to the activity:

Where processing is based on legitimate interest, you may object to it at any time (Art. 21 GDPR — see section 3.2).