1. WHO WE ARE

This Privacy Policy applies to the Honsha companies listed below:

2. PURPOSE

Honsha is highly committed to compliance, and the processing of personal data is no exception. Since the LGPD (Brazil’s General Data Protection Law) was published, the privacy of our stakeholders, employees, clients and society at large has been one of our main internal topics of discussion. This Privacy Policy aims to consolidate that work and clarify the main points regarding the processing of personal data by Honsha.

Accordingly, this Policy presents the most important information about the personal data processing operations carried out by Honsha, so that we fulfill our duty of transparency and answer any questions you may have on this subject.

Data subjects have the right to know the type of processing their data undergoes, its duration, the purposes it serves, the cases in which it is shared, and whether any automated decision-making is applied to it, provided that Honsha’s right not to disclose any information that constitutes a trade or industrial secret is respected.

3. TERMS AND CONDITIONS

To help clarify terms that may not be entirely clear, we provide a brief glossary of concepts and definitions commonly used in the LGPD, as well as others  that support  a good understanding of the subject:
a) Personal Data: Any information relating to an identified or identifiable natural person. In other words, any information, regardless of format (physical or electronic), that allows a natural person to be identified or that, once the person is identified, can be associated with them, revealing a characteristic about them.
b) Sensitive Personal Data: Any personal data concerning racial or ethnic origin, religious belief, political opinion, membership of a trade union or of a religious, philosophical or political organization, data concerning health or sex life, and genetic or biometric data, when linked to a natural person.
c) Data Subject: The natural person to whom the personal data being processed refers. That is, if you are reading this Policy and Honsha processes your data, you are a data subject.
d) Controller: The natural or legal person, under public or private law, responsible for decisions regarding the processing of personal data. The controller holds decision-making power over the data processed, including its necessity, purposes, legal bases, retention period and method of disposal. In some situations, Honsha will be the controller of the personal data it processes.
e) Processor: The natural or legal person, under public or private law, who processes personal data on behalf of the controller. The processor only processes data in accordance with the controller’s instructions, provided they do not violate the LGPD or other legislation, and must strictly follow the processing scope defined by the controller and ensure the security of the data processed. In some situations, Honsha will be the processor of the personal data it processes.
f) Processing: Essentially, any operation performed with personal data constitutes processing. The LGPD specifies several (although the list is not exhaustive), such as those relating to collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination or extraction.

4. HOW AND WHY WE COLLECT PERSONAL DATA

Honsha companies focus on providing management consulting services using the concept of total quality management, and on developing management and performance-monitoring software, serving other companies (B2B business model). For this reason, the processing of personal data is not the core business of any Honsha company. Your data may therefore be collected from the following sources:
a) Sharing by the company where the data subject works: In most cases, your personal data will be provided to us by the company you work for, so that we can perform the contracted service properly. In this case, Honsha companies act as personal data Processors and take measures to require controllers to comply with privacy and data protection rules. We also always require that only the personal data strictly necessary to achieve the specific purpose of the contracted service be shared and, preferably, that it be passed to us in anonymized form.
b) Data provided by the data subject: Data may be provided directly by the data subject to Honsha in two distinct situations: through express and unequivocal consent collected beforehand for specific purposes, or to perform a contract, or preliminary procedures related to a contract, to which the data subject is a party and at their request. Examples of these situations are, for consent, when the contact form on Honsha’s websites is completed, indicating that the data subject consents to the use of their data for business contact purposes; and, for contract performance or preliminary procedures, the submission of a résumé to take part in selection processes.
c) Cookies collected through interaction with our websites: By accessing and interacting with the websites of any Honsha company, we may collect personal data such as your Internet Protocol (IP) address, the browser used and how you interact with the sites, so that your experience can be personalized and our marketing strategies improved through the collection of cookies.
d) Data provided by parents or legal guardians: All data of persons who are legally incapable (totally or relatively), as well as of children and adolescents, that may be collected will only be processed by Honsha after their parents or legal guardians have given consent authorizing the processing.
e) Data manifestly made public by the data subject: We may also collect personal data that the data subject has manifestly made public, while safeguarding the data subject’s rights and the principles of privacy and data protection.

If this information is not enough and you still have any questions or curiosity about any detail of the processing of your personal data, please contact our DPO at the email address indicated at the end of this Policy. Please note that we reserve the right not to disclose any information that may violate our trade or industrial secrets.

5. WHY WE PROCESS PERSONAL DATA

All personal data processing operations carried out by Honsha are supported by the legal bases listed in Articles 7 and/or 11 of the LGPD, reaffirming the lawfulness of all our operations.
Accordingly, when a Honsha company acts as a personal data Controller, we may process your data under one of the following grounds:

a) With your express and unequivocal consent, in which case the data subject will be informed in advance of the purpose and other details of the processing, except for data manifestly made public by the data subject;
b) To comply with a legal or regulatory obligation of Honsha, that is, in cases where a normative act makes the processing mandatory, such as tax and/or labor legislation;
c) When necessary to perform a contract, or preliminary procedures related to a contract, to which you are a party and at your request;
d) For the regular exercise of rights in judicial, administrative or arbitration proceedings;
e) When we determine it is necessary to serve our legitimate interests or those of third parties, which may be to support and promote our activities or to provide services that benefit the data subject, except where the data subject’s fundamental rights and freedoms that require the protection of their personal data prevail.
In the situations identified in which a Honsha company acts as a personal data Processor, decisions about the purpose and manner in which personal data must be processed will be defined by the data Controller. The vast majority of these situations will occur when the data subject works at a company that is a Honsha client and the data must be shared in order to provide the contracted service.
However, we state in advance that, because the privacy and protection of your personal data are our number one priority across all Honsha companies, we formally inform all controllers whose personal data we process as Processors that we reserve the right to expressly refuse to follow any instruction from controllers that is manifestly unlawful and/or contrary to any provision of the LGPD.

6. HOW WE SHARE PERSONAL DATA WITH PARTNERS

Honsha has no core business economic activity that involves sharing personal data with third-party companies. For this reason, your data may be shared with third parties only when it is:
a) Absolutely necessary for us to provide a service to you or to the company you represent;
b) Important to add security to the data processed and ensure its confidentiality, integrity and availability, for example, when your data is stored in a cloud hosted on a server external to Honsha;
c) Useful for performing our company’s administrative functions, such as measuring employee performance, client satisfaction surveys and organizational climate surveys, developing our products and services, and client support, always using, where applicable, statistical anonymization of the data;
d) Required by court order, legal obligation or by a competent administrative authority.
In the cases above, where sharing results from Honsha’s own choice, we inform you that all contracts with our partners are documented and rigorously drafted with regard to the protection of your personal data, and all are in accordance with and aligned to our requirements. In addition, our information security criteria are high and constantly updated, aiming to avoid any shortfall that could cause harm to you or your personal data. It is important to note that we also require these high security standards from all our partners.
Please note that Honsha does not, under any circumstances, sell the personal data it collects to third parties.

7. END OF PROCESSING AND DATA RETENTION

Data processed is stored for the period necessary or permitted, depending on the processing and the legal basis that justifies it. Accordingly, your data will, as a rule, be deleted:
a) Upon verification that the purpose has been achieved or that the data is no longer necessary or relevant to achieving the specific purpose intended;
b) After the end of the processing period stated;
c) Upon a deletion request by the data subject, where the type of processing allows for such a request;
d) By determination of the National Authority (ANPD), when there is a violation of the provisions of the LGPD.
In addition, some of our documents, both physical and electronic, are sent to a company specialized in document custody and are archived there in accordance with our Retention and Disposal Policy, until their definitive deletion or complete anonymization.
However, in some cases personal data may be retained even after processing ends, for:
i) compliance with a legal or regulatory obligation by Honsha;
ii) ensuring legal certainty in the relationship established with the data subject or with third parties; or
iii) transfer to a third party, provided that the data processing requirements set out in the LGPD are respected.
Please note that we carry out activities to improve our services and products by analyzing graphical indicators that may originally have been generated from personal data. In such cases, we guarantee the complete anonymization of this information, so that it is entirely dissociated from an identified or identifiable natural person, and its use is exclusive to Honsha companies, with third-party access prohibited.

8. HOW WE KEEP YOUR DATA SECURE

In addition to valuing your privacy, Honsha is also concerned about the security of the information that passes through us.
At Honsha, the employees responsible for the information assets that support personal data sign a “Confidentiality and Responsibility Agreement” and are fully familiar with our Information Security Policy, as well as our Code of Conduct and Ethics.
We also have an internal Privacy and Data Protection Policy, which aims to raise awareness among our employees and clarify how personal data must be handled at Honsha, always based on the law, good faith and information security best practices, so that your data is always safe with us.
Regarding information storage, all personal data processed by Honsha may be located in three distinct environments, depending on the type and sensitivity of the information:
a) a Data Processing Center (CPD) with biometric access control;
b) a third-party data center aligned with the best practices set out in the security standard for hosting systems owned by Honsha; or
c) high-security-standard clouds, with trusted providers widely certified under the most rigorous international frameworks.
In addition, our suppliers also adopt various measures to prevent privacy breaches, but should one occur, effective procedures for detection, response and remediation of the incident are followed as quickly as possible, in line with Honsha’s rigorous security standard.
Through these and other measures, Honsha seeks to mitigate as much as possible the risk of security incidents affecting the data it processes. Even in the unlikely event that something of the sort occurs, we are committed to identifying, detecting, protecting against and responding to incidents with maximum efficiency, informing you whenever necessary if the occurrence may pose a risk to your privacy.
Nevertheless, even though we use the best security measures available on the market and are constantly evolving and continuously improving in this regard, it is important to clarify that the total inviolability of the data we process cannot be guaranteed (and this applies to Honsha companies and to any other company). In any case, should this happen, we have a remediation plan so that potential harm is as small as possible or, preferably, nonexistent.

9. WHAT ARE THE DATA SUBJECT’S RIGHTS

The General Data Protection Law (LGPD) sets out, in Articles 9, 18 and 20, the rights of personal data subjects, which can be exercised before Honsha by making a request directly to our Data Protection Officer (DPO) at the email address indicated at the end of this Policy.
Under Article 9 of the LGPD, you, as a data subject, have the right to easy access to the following information about the processing of your data:
i) the purpose of the processing of your data;
ii) its form and duration, provided that our trade and industrial secrets are respected; that is, if a request could violate our trade and industrial secrets, we reserve the right not to comply, as permitted by the LGPD;
iii) the identification and contact information of the data controller;
iv) information about any sharing of the data processed;
v) the responsibilities of the processing agents involved; and
vi) all your rights listed in Article 18 of the LGPD, which are as follows:
a) Confirmation of the existence of processing by any of the Honsha companies;
b) Access to the personal data processed by the Honsha companies, once the existence of processing has been confirmed;
c) Correction or updating of the data processed by Honsha;
d) Anonymization, blocking or deletion of data processed unnecessarily, excessively or in noncompliance with the LGPD, provided it is first assessed by our Data Protection Officer (DPO) and by our Privacy team;
e) Portability of your data to another service or product provider, while preserving Honsha’s industrial and trade secrets;
f) Revocation of Consent and Deletion of Data;
g) Information about the sharing of your personal data with public or private entities, subject to trade and industrial secrets;
h) The possibility of not providing consent and the consequences of not providing it.
In addition to the rights listed above, the data subject may also request a review of decisions made solely on the basis of automated processing of personal data that affect their interests, including decisions intended to define their personal, professional, consumer and credit profile or aspects of their personality. For this purpose, “automated decisions” are those made through a process that automates data filtering based on pre-established criteria, generally through the use of algorithms.
If, for any reason, Honsha is unable to take immediate action on a data subject’s request, we will send a response as soon as possible stating the reason, which may be one of the following:
1. Honsha is not the processing agent for your data, in which case we will indicate the correct agent, if we are aware of it; or
2. There is some factual or legal reason that prevents immediate action on the request, which, where possible, will be stated in the response.
Finally, so that we can fulfill requests and ensure the security of your data, we may ask for certain information to confirm your identity and the authenticity of the request.

10. HOW TO EXERCISE YOUR RIGHTS

If your question has not been answered, or if you wish to discuss any matter relating to privacy and/or personal data protection, you may contact our Data Protection Officer (DPO), Caio Amorim, at any time through the link below or by email at contato@honsha.org.
Submit your request
You can also manage your consents through our Preference Center, without the need to submit a request. If your purpose is to report any suspicious, unlawful and/or unethical conduct or behavior that violates our Code of Conduct, our Compliance Policy, our Anti-Corruption and Public Sector Relations Policy or any applicable legislation, you can use the Whistleblowing Channel at https://honsha.org/compliance/ (which can be used completely anonymously and without any form of retaliation against the reporter, under any circumstances).

11. UPDATES TO THE PRIVACY NOTICE

This Privacy Policy is in its first version. This document is subject to later modifications for updating purposes and may be changed without prior notice.