Privacy Policy

Wintegrity is operated by Wintegrity Tecnologia Ltda., a Brazilian company registered with the CNPJ (Brazilian corporate taxpayer registry) under No. 68.408.054/0001-24, headquartered at Av. Brigadeiro Faria Lima, 1.572, sala 1022, Jardim Paulistano, São Paulo/SP, CEP 01451-917, Brazil (“Wintegrity”, “we”, “us”). We offer a governance, risk and compliance platform for companies and law firms.

The LGPD distinguishes between whoever decides on the processing and whoever processes data on someone else’s behalf. We act in both roles, in different situations:

• As controller, we process the data of website visitors, people who create an account, representatives of customers and prospects (contracting, billing, support and communication) and the platform’s security logs. Section 3 describes this processing.
• As processor(“operador” under the LGPD), we process the data that each customer organization enters or generates on the platform: employees, assessed third parties, Integrity Channel reports, contracts, lawsuits, meetings, evidence and anything else the customer records (“Customer Data”). In these cases the controller is the customer organization, which defines the purposes and the legal basis. We process this data only to provide the service and in accordance with the customer’s instructions.

If your data is on the platform because a company or law firm recorded it (for example, you are an employee, a supplier, a party to a lawsuit or the author of a report), contact that organization first: it is responsible for responding to your request. If the request reaches us, we will forward it to the responsible organization and support it in responding.

We do not sell personal data and do not use it for behavioral advertising. We may send product communications to users and customer representatives; you can stop receiving them at any time through the notification settings or the link included in the messages. Essential service notices (security, billing, contractual changes) continue to be sent while the account exists.

Depending on the modules each customer uses, the platform may contain, among other things:

• Employees:name, CPF (Brazilian individual taxpayer number), employee ID, job title, department, manager, hiring and termination dates, compensation, employment documents, PPE (personal protective equipment) records and data imported from eSocial (the Brazilian government’s employment reporting system) by the customer itself.
• Third parties (suppliers, partners, customers): registration data, ownership structure, answers to due diligence questionnaires and results of checks in public sources, such as sanctions and politically exposed persons lists, registries of sanctioned companies, news, lawsuits and certificates.
• Lawsuits and claims: parties, lawyers and case updates obtained from public Judiciary sources, and administrative claims (such as NIPs from the ANS, the Brazilian health insurance regulator) imported with credentials provided by the customer.
• Integrity Channel reports, contracts, meeting minutes and recordings, tasks, risks, controls, audits, evidence and documents.

Customer Data is processed exclusively to provide the contracted service: storing, organizing, analyzing, generating reports and alerts, and running the integrations the customer itself enables. We do not use this data for our own purposes, except for aggregated and anonymized statistics on platform usage.

The Integrity Channel allows anyone to submit a report to a customer organization, either identified or anonymously.

• For anonymous reports, the platform does not ask for or store name, email or phone number. The system rejects anonymous reports that contain the reporter’s identifying data.
• Follow-up is done with a protocol number and an access code. The code is stored only in cryptographic form and cannot be recovered by anyone, not even by us.
• The channel pages do not load Google Analytics, analytics cookies or a cookie banner.
• We use the IP address only momentarily, to limit the volume of requests and protect the channel against abuse, and we do not associate it with the report. As with any internet service, hosting providers may log connections for technical and security reasons.

The content of the report and its attachments are received by the chosen organization, which is the controller of this data and is responsible for investigating the case. Remember that the text itself and the attachments may reveal your identity: avoid including information you do not want to share.

• Third-party forms:whoever answers a questionnaire sent by a customer provides the data requested by that customer. Upon submission, we record the declarant’s name, the date, the time and the IP address, as proof of the declaration of truthfulness.
• Electronic signature:when the customer sends a contract for signature, we share with Clicksign the document and the signatories’ data provided by the customer (name, email, CPF, phone and date of birth, when required for authentication).
• Contract counterparties:messages and attachments exchanged by email from the platform are recorded in the customer’s contract history.
• Meeting participants: when the customer records or uploads the audio of a meeting, the audio is transcribed and summarized. The customer is responsible for informing participants about the recording.

The platform uses artificial intelligence models to, for example, transcribe meetings, suggest risks, controls and tasks, analyze documents and evidence, screen news and answer in the chat assistant. To do so, excerpts of Customer Data are sent to AI providers engaged by us, listed in section 8.

• We use these providers through their enterprise offerings, whose terms do not allow the data sent to be used to train their models.
• AI suggestions are only suggestions: they remain pending until a person accepts, edits or rejects them.
• Each organization can turn off automatic AI analyses in its settings.
• The results of automated checks on third parties are indications for human review. If a decision affecting your interests is made solely on the basis of automated processing, you may request its review (art. 20 of the LGPD) from the responsible organization.

We share personal data only with those who need it to provide the service, under contract and with confidentiality and security obligations:

Some features query official public sources, such as Brazil’s National Electronic Court Gazette (DJEN), the National Council of Justice’s DataJud database, the Brazilian Federal Revenue Service (via BrasilAPI), the Transparency Portal and sanctions lists. These queries send the necessary search terms, such as name, CPF, CNPJ or Brazilian Bar Association (OAB) number. When the customer connects its own systems or government portals (eSocial, ANS), the data exchange takes place on the customer’s behalf and at its instruction.

We may also share data (a) with public authorities, when there is a legal obligation, court order or request from a competent authority; (b) to exercise rights in judicial, administrative or arbitration proceedings; and (c) in a corporate transaction, such as a merger or acquisition, in which case the successor is bound by this policy. This list may change as the service evolves; we keep this page up to date.

Some of our providers, including the main database infrastructure, are located outside Brazil, mainly in the United States. These transfers follow art. 33 of the LGPD and ANPD regulations, based on contractual clauses that require the provider to ensure a level of protection compatible with Brazilian law, in addition to the other applicable legal grounds. Customers with specific data localization needs may address the matter in their contract.

You can review your decision about website cookies at any time. The button below clears the saved choice and shows the banner again. You can also delete cookies and site data through your browser settings.

We adopt technical and administrative measures to protect data, including:

• encrypted traffic (TLS) and data encrypted at rest by the infrastructure providers;
• isolation between organizations enforced directly in the database, with access rules by role and by module;
• integration credentials (such as digital certificates and portal passwords) stored with our own encryption;
• files in private repositories, accessed only through temporary links;
• authentication with signed tokens, request limits and logging of relevant actions in audit histories;
• internal access restricted to those who need it to operate and support the service, under a duty of confidentiality.

No system is completely immune to incidents. If a security incident occurs that may result in relevant risk or harm to data subjects, we will notify the affected customers and, where we are the controller, the ANPD and the data subjects, within the deadlines and in the manner set out in the regulations.

• Account: while it is active. When the account is deleted, we remove the name and email from the profile and deactivate access; records created by the person on behalf of an organization continue to belong to that organization.
• Access logs: at least 6 months, as required by art. 15 of the Marco Civil da Internet.
• Contracting and billing data: for the period required by tax and accounting law, generally 5 years, or for the applicable limitation period.
• Customer Data:for the duration of the contract and in accordance with the customer’s instructions. Items deleted on the platform are no longer available and are permanently erased later. After termination, the data remains available for export for the period set out in the Terms of Use and may then be erased or anonymized.

We may keep data for longer when the law allows or requires it, such as to comply with a legal or regulatory obligation or for the regular exercise of rights (art. 16 of the LGPD).

Under art. 18 of the LGPD, you may request, at any time:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or erasure of unnecessary or excessive data, or data processed in breach of the law;
• portability of the data to another provider, subject to commercial and industrial secrets;
• erasure of data processed on the basis of your consent;
• information about who we share your data with;
• information about the possibility of not consenting and its consequences;
• withdrawal of consent, such as consent to analytics cookies;
• review of decisions made solely on the basis of automated processing.

For data we process as controller, send your request to gabriel.matos@wintegrity.app. We may ask for information to confirm your identity before responding, to prevent your data from being handed to someone else. We respond within the legal deadlines. For data that a customer organization recorded on the platform, see section 2.

You may also file a complaint with the Brazilian National Data Protection Authority (ANPD), at gov.br/anpd.

The website and the platform are intended for professional use by people over 18 and are not directed at children or adolescents. If a customer records data of adolescents, such as young apprentices, it is responsible for complying with art. 14 of the LGPD and the best interests of the data subject.

Our channel for data subjects and the ANPD is the email gabriel.matos@wintegrity.app. Through it you reach Wintegrity’s Data Protection Officer (“encarregado” under the LGPD).

Mailing address: Wintegrity Tecnologia Ltda., Av. Brigadeiro Faria Lima, 1.572, sala 1022, Jardim Paulistano, São Paulo/SP, CEP 01451-917, Brazil.

We may update this policy to reflect changes in the service, in our providers or in the law. The date at the top indicates the latest version. When a change is material, we will notify platform users by email or by a notice in the service itself before it takes effect.