Privacy Policy

1. Controller and Data Protection Officer (DPO)

The data controller is BSR Automação Industrial. To exercise your rights or ask questions about this policy, contact our Data Protection Officer at tecnologia@bsrindustrial.com.

2. Data we collect

• Registration and contact data: name, e-mail and phone number.
• Tax and business data: entity type (individual/company), CPF or CNPJ, legal name and state registration.
• Address: postcode, street, number, complement, district, city and state.
• Order data: items of interest, messages and request history.
• Technical data: access logs strictly necessary for the security and operation of the account.
• Photos and files (mobile app): images you capture with the camera or select from the gallery, and documents you attach to your projects and equipment. They are uploaded to our servers and linked to the corresponding project. The app accesses only the files you choose at the moment of upload — never your gallery as a whole.
• Notification identifier (mobile app): a device token, provided by the operating system, used solely to deliver notifications about your projects. It is removed from our servers when you sign out.

The app does not collect your location, does not access contacts, calendar, microphone or call history, and does not use third-party advertising or tracking tools.

3. What we use it for and on what legal basis

We process your data only for specific purposes, each with a legal basis set out in the LGPD:

• Registration and authentication — performance of a contract and preliminary procedures (art. 7, V and VII).
• Issuing and managing orders — performance of a contract (art. 7, V).
• Retention of tax data — compliance with a legal and regulatory obligation (art. 7, II).
• Transactional e-mails (order confirmation, verification code, password reset) — performance of a contract and legitimate interest (art. 7, IX).
• Photographic and documentary record of projects — performance of a contract (art. 7, V). The photos and files uploaded through the app document how the equipment progresses and are visible only to you and to the team responsible for the project.
• Notifications about project progress — performance of a contract (art. 7, V). The device token is used solely for that delivery, never for advertising.
• Security and fraud prevention — legitimate interest (art. 7, IX).

4. Sharing with third parties

We do not sell your data. We share the minimum necessary with processors that provide services to us, under security and confidentiality obligations:

• Cloud hosting provider — infrastructure that stores and processes the application data, within Brazilian territory.
• Transactional e-mail provider — to send notifications about your account and orders.
• Error monitoring provider — to diagnose technical failures, with no commercial use of the data and with personal data stripped from the error record.
• Anti-automation protection service — the security challenge on the sign-up, sign-in, password recovery and support pages receives your IP address to tell a person from a bot.
• Notification delivery services — in the mobile app, the push service and the Google and Apple platforms receive the device token and the notification text in order to deliver it.
• Postcode lookup service — only the postcode is sent, to fill in the address automatically, on the website and in the app.
• Public authorities — when required by law or court order.

5. Cookies

We use only cookies and local storage strictly necessary for the operation and security of the site — none for advertising or behavioural analytics. Details in our Cookie Policy.

6. How long we keep it

We keep your data for as long as your account exists and for the periods required by legal obligations (tax obligations, for example). Once processing ends, the data is deleted or anonymised.

7. Your rights

At any time you may (art. 18 of the LGPD):

• confirm that processing exists and access your data;
• correct incomplete, inaccurate or outdated data;
• request the anonymisation or deletion of unnecessary data;
• request the portability of your data — the export includes your registration, orders, tickets, service calls, projects, equipment and acceptance history;
• withdraw consent and obtain information about how the data is used.

Signed-in clients can export e delete their own account directly in the account area. We also handle requests by e-mail at tecnologia@bsrindustrial.com.

8. How to delete your account and data

You can request the deletion of your account without contacting us, through any of these routes:

• In the mobile app: Profile → Privacy and data → Delete my account. You will be asked to confirm your CPF or CNPJ.
• On the website: account area → Privacy and data → Delete my account.
• By e-mail: tecnologia@bsrindustrial.com, if you cannot access the account.

Deletion is processed immediately and is irreversible. We exercise the right to erasure through anonymisation (art. 18, IV and VI of the LGPD): your data ceases to be personal because it permanently loses any link to you.

In practice, when you delete the account:

• your name, e-mail, phone number and job title are erased from the record;
• the contact details recorded in your orders, tickets and service calls are replaced by an anonymous marker;
• if the company record is for an individual and you were its last active contact, the CPF, name and address are erased as well — in that case they are your own data;
• the company's phone number and e-mail are erased when they are yours;
• all sessions are terminated and the account is deactivated, with no possibility of signing in again;
• your device's notification token is deleted and you stop receiving any notifications.

If the record is for a company, the legal name, CNPJ, state registration and company address remain: they are company data, not yours, and the LGPD protects the data of natural persons. The company continues to exist as a client, simply without you as its contact.

The following remain stored, now without identifying you: the order records and the corresponding tax documents, for the period required by Brazilian tax legislation (as a rule, five years). This retention is a legal obligation (art. 7, II and art. 16, I of the LGPD).

The address where a service call was carried out remains in the record of that service call: it documents where the work was performed and is no longer part of your registration data. For the same reason, photos and technical documents attached to contracted projects form part of the record of the work performed and are kept linked to the contracting company’s project, not to you as an individual. If you want a specific file removed, request it at the e-mail above before deleting the account.

9. Security

We adopt technical and administrative measures to protect your data, including password hashing, two-factor authentication, role-based access control and transmission over HTTPS.

10. International transfers

The hosting of the application and the backups are located within Brazilian territory (São Paulo region), by configuration of our cloud infrastructure. Your registration data, orders, projects, photos and documents do not leave the country.

Only specific data leaves Brazil, in these three cases: the error monitoring (technical context of the failure, without your personal data), the anti-automation protection on the public pages (your IP address) and the notification delivery in the mobile app (device token and notification text). In those cases we require adequate protection safeguards, in accordance with arts. 33 to 36 of the LGPD.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated and the "last updated" date at the top will be revised. If necessary, we will ask you to accept it again.