Privacy Policy

1. Who decides about the data

On the sales page and in school registration, recreo is the controller of the data.

Within the platform, each school is the controller of the data of its students, parents or guardians and staff, and recreo acts as processor, processing that data on the school's behalf and in accordance with its instructions. Requests concerning that data may be made to the school or to us, and we will forward them to the school where appropriate.

2. What data we process

• School registration: institution name, CNPJ, school name, city, state (UF), number of students, name, email and phone number of the contact person and the message sent.
• Cafeteria staff: name, email, access roles, login and session records, and two-step verification data.
• Parents and guardians: name, email, phone number, link to students, top-ups, balance and purchase history.
• Students: name, class, shift, identification code, balance, orders and, when provided by parents or guardians or by the school, allergies and dietary restrictions.
• Payments: data on Pix and card transactions, processed by the payment providers chosen by the school. Card data is entered and processed directly with the payment providers.
• Technical data: IP address, date and time of access, browser and device type, and audit logs of actions taken on the platform.

3. Data of children and adolescents and health data

We always process data of underage students in their best interest (art. 14 of the LGPD), solely to enable school meals, payment and food safety, and with the participation of their legal guardians.

Allergies and dietary restrictions are sensitive health data. They are used exclusively to block the sale of incompatible products and alert cafeteria staff, on the basis of protecting the student's life and health and of the parents' or guardians' consent.

Facial biometric identification features are disabled by default and may only be enabled by the school on its own legal basis and with the specific consent of parents or guardians.

4. What we use the data for and on what legal basis

• Reviewing the school's registration and contacting the contact person about the subscription (pre-contractual procedures and consent).
• Providing the service: orders, payments, balance, kitchen, TV, reports and support (performance of a contract).
• Protecting students' health through allergy control (protection of life and consent of parents or guardians).
• Keeping the platform secure, preventing fraud and logging access (legitimate interest and compliance with a legal obligation, such as the Marco Civil da Internet, Brazil's Internet Civil Framework).
• Sending service emails, such as registration confirmations, access invitations and account notices (performance of a contract).

5. Who we share it with

We do not sell personal data. We share only what is necessary with:

• The contracting school and cafeteria, which see the data of their own students, parents or guardians and staff.
• Payment providers chosen by the school (such as Asaas, Mercado Pago or PagSeguro), to process top-ups and sales.
• Cloud infrastructure, email delivery and security verification providers (Cloudflare Turnstile, used at registration and login to block bots).
• Public authorities, where there is a legal obligation or a court order.

Some of these providers may process data outside Brazil. In such cases, we require adequate protection safeguards, in accordance with arts. 33 to 36 of the LGPD.

6. Cookies and local storage

This page does not use advertising cookies or third-party tracking tools. The form's security check (Cloudflare Turnstile) may use technical browser data to distinguish people from bots.

On the platform, we use a secure session cookie (httpOnly) and browser tab storage to keep you signed in, as well as preferences such as language.

7. How long we keep it

We keep data for as long as necessary for the purposes of this Policy and for the duration of the school's subscription. Rejected school registrations are deleted or anonymized within 12 months.

Access logs are kept for at least 6 months, as required by the Marco Civil da Internet, and financial and tax data for the periods required by law. After the subscription ends, the school's data is deleted or anonymized in accordance with the Terms of Use.

8. How we protect the data

We use encrypted connections (HTTPS), encryption of payment credentials, two-step verification for staff, revocable sessions, isolation between schools, role-based access control and audit logging of sensitive actions.

No system is completely immune to incidents. If an incident with relevant risk occurs, we will notify the school, the affected data subjects and the Autoridade Nacional de Proteção de Dados (ANPD, Brazil's National Data Protection Authority), as required by law.

9. Your rights

You may, at any time, request:

• Confirmation that we process your data and access to it.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of unnecessary data or data processed in breach of the LGPD.
• Portability of the data and information about whom it has been shared with.
• Withdrawal of consent and deletion of data processed on the basis of it.

Parents and guardians may also exercise these rights on behalf of the students in their care. To make a request, write to [E-MAIL DO ENCARREGADO]. We respond within the legal deadline. You may also file a complaint with the ANPD.

10. Data protection officer and contact

recreo's data protection officer (encarregado) can be contacted at [E-MAIL DO ENCARREGADO]. Address: [ENDEREÇO DA SEDE].

11. Changes to this Policy

We may update this Policy. The date of the last update appears at the top of this page, and material changes will be communicated by email or on the platform.