Privacy Policy

1. Data controller

The data controller is EDUARDO MARCIO PINTO DE CARVALHO - ME, trading as EMPC, Brazilian company registration number 07.920.461/0001-21, located at Rua Frei Orlando, 1035, suite 201, Caiçara, Belo Horizonte, Minas Gerais, Brazil, ZIP code 30770-570.

Privacy requests and data subject rights may be submitted to empcti@empcti.com.br and are handled by the EMPC TI Privacy Team.

2. Anonymous mode

The assessment can be completed without providing a name, company, or email address. While the user remains in anonymous mode, answers and progress are stored temporarily in the browser.

Assessment data is only sent for storage when the user expressly requests saving and confirms the email address.

3. Data processed

• Name, email address, and optional company name.
• Answers submitted during the assessment.
• Overall score, dimension results, alerts, priorities, and initial plan.
• Language, methodology version, and technical contract version.
• Permissions, accepted Terms and Privacy Policy versions, and acceptance date.
• Creation, confirmation, access, withdrawal, expiration, and deletion dates.
• Minimum technical data required for security, abuse prevention, and service operation.

4. Purposes and legal bases

Data is processed to generate and save the assessment, confirm the email address, provide private access to the result, issue the report, manage permissions, prevent abuse, and respond to data subject requests.

Commercial or advisory contact will only occur when the user provides separate and optional authorization.

• Consent when the user requests storage or authorizes contact.
• Steps requested by the data subject to provide the service features.
• Compliance with legal or regulatory obligations, when applicable.
• Legitimate interests related to security, fraud prevention, service protection, and necessary technical records, subject to data subject rights.

5. Service providers

EMPC uses infrastructure providers that are strictly necessary to operate the service. They process data according to their contractual functions and security controls.

• Supabase: database, technical authentication, functions, and recovery resources.
• Vercel: application hosting, function execution, and technical logs.
• Resend: delivery of assessment confirmation messages.

6. International transfers

Some technology providers may process data or provide support from other countries. EMPC seeks to use providers with contractual commitments, security controls, and mechanisms compatible with applicable law.

7. Retention and deletion

A saved assessment remains available for up to 180 days unless the data subject requests earlier deletion. At the end of this period, active data is removed by the retention routine.

Temporary recovery copies may remain for up to 7 days after deletion from the active environment. Technical logs have separate and limited retention periods according to security and operational purposes.

8. Security

Technical and administrative safeguards include access controls, protected credentials, encrypted connections, email confirmation, expiring tokens, request limits, technical logs, and retention routines.

No environment is entirely risk-free. Relevant incidents will be handled according to applicable law.

9. Data subject rights

• Confirm processing and request access to personal data.
• Request correction of incomplete, inaccurate, or outdated data.
• Request anonymization, restriction, or deletion when applicable.
• Withdraw contact authorization without deleting the assessment.
• Request permanent deletion of the saved assessment.
• Obtain information about sharing and the consequences of withholding consent.
• Submit a request to EMPC or a petition to the Brazilian National Data Protection Authority.

10. Automated result

Scores are calculated using deterministic rules from the EMPC AI Readiness methodology. The result is advisory and does not constitute a legally binding decision, audit, certification, or technical opinion.

Material decisions should rely on additional evidence and human validation.

11. Children and sensitive data

The service is intended for professionals and organizations and does not intentionally request children’s data, adolescents’ data, or sensitive personal data. Users should not submit such information.

12. Policy changes

This policy may be updated to reflect legal, technical, or operational changes. Material changes will result in a new version and effective date. The version accepted when saving the assessment is recorded with the consent.