Law No. 13,709/2018 (General Data Protection Law – LGPD) was enacted on August 14, 2018. Its approval represented an initial milestone for a new culture, in both the private and public sectors, focused on transparency and the centrality of the individual in the processing of personal data. This new culture brings greater legal certainty for companies and more rights and guarantees for data subjects regarding their information, in addition to demanding greater protection and care in the processing of personal data.
Growing transformations in the market can already be observed since the LGPD came into force: companies implementing the principles and norms of the law in their processes, privacy awareness initiatives, clearer and more accessible contractual texts and privacy policies, greater investment in information security tools and systems, training and certification of data protection professionals, among other actions.
Although the LGPD topic has gained significant visibility, doubts and misconceptions about the law still persist. With this in mind, Nuvia prepared this Basic LGPD Manual, covering the following topics:
- Key Concepts
- Application of the Law
- Principles
- Lawfulness of Processing
- Data Subject Rights
- International Data Transfer
- Security and Best Practices
At the end of each section, we present the "Nuvia and the LGPD" box, in which we contextualize the topics covered to Nuvia's reality.
Note on GDPR: where processing involves data subjects located in the European Union or the United Kingdom, the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the UK GDPR also apply. Details on legal bases, data subject rights, and international transfers are set out in Nuvia’s Privacy Policy.
We hope this material is useful to you and wish you an excellent read!
1. Key Concepts
Nuvia does NOT process sensitive personal data. We do not request or intentionally process data of children or adolescents, nor data such as CPF (national ID), residential address, or personal emails. The data processed by Nuvia include professional and corporate information obtained from public sources or with an appropriate legal basis, as well as technical and browsing data collected on the institutional website and the platform — such as IP address, device and browser identifiers, and cookie and tracking identifiers — as described in the Privacy Policy.
Below, we highlight the main concepts of the LGPD:
- Personal data: Any data that identifies a natural person. In Nuvia’s case, this includes data of professionals in a business context (such as name, job title, and professional email) and technical and browsing data associated with use of the website and the platform.
- Sensitive personal data: Nuvia does not collect or process data of this nature.
- Anonymized data: Occasionally used for statistical purposes.
- Controller: Nuvia acts as Controller with respect to data that it originates and enriches from public sources and licensed providers, as well as data collected on the institutional website.
- Processor: Nuvia acts as Processor when it processes lead data provided or managed by its customers on the platform.
- Processing: All activities performed with data, such as collection, analysis, and storage.
NUVIA AND THE LGPD — Nuvia operates strictly within the limits of the LGPD. It processes professional data of natural persons (name, job title, professional email, etc.), public data of companies (CNPJ, corporate address, shareholder structure, industry sector), and technical and browsing data necessary for the operation of the website and the platform. It does not process sensitive personal data. It does not request or intentionally process data of children or adolescents, CPF, residential address, or personal emails.
2. Application of the Law
The LGPD applies to Nuvia because:
- Nuvia is headquartered in Brazil.
- It collects and processes data of individuals and companies in Brazil, as well as of data subjects located in the European Union and the United Kingdom.
- It provides solutions that use data for lawful commercial purposes.
Where processing involves data subjects in the European Union or the United Kingdom, the GDPR and UK GDPR also apply, as set out in the Privacy Policy.
3. Principles
Nuvia follows all LGPD principles, with emphasis on:
- Purpose and Adequacy: Data is processed for B2B prospecting, market analysis, lead enrichment, and operation of the website and the platform.
- Necessity: Only the minimum and relevant data for the described purposes are used.
- Security: Data is stored with layers of protection and robust protocols.
- Transparency: Whenever there is direct data collection, the data subject is informed and may revoke consent at any time. For data obtained from third parties and public sources, the data subject may request information about the origin of their data and object to the processing through the channel indicated in the Privacy Policy (DPO email: dpo@nuvia.ai).
NUVIA AND THE LGPD — Nuvia collects and processes professional and business data, based on public sources or legitimate private databases, as well as technical and browsing data necessary for the operation of the website and the platform. Data is kept up to date, stored securely, and is not used for discriminatory purposes.
4. Lawfulness of Processing
Nuvia relies on the following legal bases for data processing, aligned with Section 4 of the Privacy Policy:
- Performance of a contract: account creation, authentication, delivery of contracted services, and technical support.
- Legitimate interest: security logs, fraud prevention, continuous service improvement, operational communications, and enrichment of information about companies and professionals in B2B contexts.
- Consent: when the user provides data through a form, including for marketing and promotional communications.
- Compliance with a legal obligation: responding to requests from competent authorities, the ANPD, EU/UK data protection authorities, and tax obligations.
Some of the data processed is obtained from public sources, such as corporate websites, professional social networks, government portals, and commercial registries. Under Article 7, §4 of the LGPD, processing of data made manifestly public by the data subject does not require new consent, subject to purpose, good faith, and the public interest, and remains grounded in the legal basis of legitimate interest.
NUVIA AND THE LGPD — Nuvia does not process sensitive personal data or data of an intimate nature. It does not request or intentionally process data of children or adolescents, CPF, residential address, or personal emails. The processing of professional, corporate, and technical/browsing data has a clear legal basis, with consent records when applicable.
5. Data Subject Rights
Nuvia respects the rights provided by the LGPD (Section 10 of the Privacy Policy), including:
- Confirmation of the existence of processing and access to data
- Correction of incomplete, inaccurate, or outdated data
- Anonymization, blocking, or deletion of unnecessary data or data processed in noncompliance
- Portability
- Erasure of data processed on the basis of consent
- Information about sharing (entities with which Nuvia shares data)
- Withdrawal of consent
- Objection to processing based on legal grounds other than consent
- Review of automated decisions that affect the data subject’s interests, including commercial qualification decisions (Article 20 of the LGPD; Article 22 of the GDPR for data subjects in the EU/United Kingdom)
Data subjects in the European Union and the United Kingdom have equivalent rights under Articles 15 to 22 of the GDPR, including the right to lodge a complaint with the competent data protection authority.
NUVIA AND THE LGPD — Data subjects may contact Nuvia at dpo@nuvia.ai to exercise their rights. We do not process medical data or genetic data. We do not request or intentionally process data of children or adolescents, CPF, residential address, or personal emails.
6. International Data Transfer
Personal data processed by Nuvia are stored and processed in the United States of America, due to the location of the primary infrastructure and of certain contracted providers. Transfers are carried out with contractual safeguards and technical measures to protect data, including Standard Contractual Clauses (SCCs) and, where applicable, safeguards under Chapter V of the GDPR. Details are set out in the Privacy Policy.
7. Security and Best Practices
Nuvia adopts measures such as:
- Secure storage with encryption
- Access control and traceability
- Internal policies and training
- Continuous monitoring
NUVIA AND THE LGPD — All employees involved in data processing sign confidentiality agreements and are trained to ensure correct data use. There is no collection of sensitive data. We do not request or intentionally process data of children or adolescents.
Conclusion
Nuvia combines data intelligence with LGPD compliance. It processes professional and corporate data, as well as technical and browsing data necessary for the operation of the website and the platform, in accordance with the Privacy Policy. It does not process sensitive personal data. It does not request or intentionally process data of children or adolescents, CPF, residential address, or personal email. Thus, it ensures assertive results with responsibility and transparency.