1. Controller and Contact

Controller: Neps Academy, company registration number 26.361.627/0001-61, address Av. Antônio Sales 1317, Room 604, ZIP Code 60135-101, Fortaleza, Ceará, Brazil.

Data Protection Officer (DPO): Thiago Nepomuceno.

2. Data We Collect

Registration data: name, email, identification document(s), and payment details (processed by partners).

Platform usage: interactions, progress, results, and support communications.

Technical data: IP address, device, browser, identifiers, logs, and cookies.

Marketing/Image: according to the consent provided in the Terms of Service (for example, publication of results, newsletter).

3. Purposes and Legal Bases

Performance of a contract: to provide and operate the Platform, support, and billing.

Legitimate interest: security, fraud prevention, service improvement, and statistics (with impact assessment whenever necessary).

Legal or regulatory compliance: tax, accounting, and security obligations.

Consent: marketing communications and Image Rights (revocable at any time).

4. Cookies and Similar Technologies

We use essential cookies (required for operation) and, with consent, performance and analytics cookies. You can manage preferences through the banner or your browser settings. Withdrawal of consent does not affect the lawfulness of prior processing.

5. How We Use the Data

To operate Platform features (classes, exercises, rankings, certificates).

To provide support, detect abuse, and preserve academic integrity.

To personalise the experience and improve content and features.

To send transactional communications; marketing only with consent.

To produce statistics and reports with aggregated and/or anonymised data.

6. Sharing

We share data with operators and partners that help us operate the Platform (hosting, payments, analytics, communication), under contracts that require security and confidentiality. We may also share data to comply with the law, lawful authority requests, or to protect rights.

7. International Transfers

Your data may be processed in other countries by cloud and service providers. We adopt transfer mechanisms allowed by the LGPD (for example, standard contractual clauses, specific obligations, consent where applicable) to ensure an adequate level of protection.

8. Security

We apply technical and administrative measures proportionate to the risk (encryption in transit, access controls, event logs, and periodic testing). No system is 100% secure, but we continuously work to improve our practices.

9. Retention

We keep data for as long as necessary for the purposes of this Policy, including to comply with legal or contractual obligations and protect rights. After that period, we delete or anonymise the data, except where retention is legally required.

10. Data Subject Rights

You may request confirmation of processing, access, correction, anonymisation/deletion, portability, information about sharing, objection where applicable, and withdrawal of consent. We will respond immediately in simplified form or with a complete statement within up to 15 days, as provided by the LGPD.

11. Automated Decisions

We may use automated mechanisms (for example, fraud detection and academic-integrity checks). When those decisions affect your interests, you may request review by a person, subject to legal exceptions.

12. Image Rights

Use of your name, image, and voice for publication of academic or professional results occurs only with specific consent and may be revoked at any time through the contact channels. Revocation does not affect disclosures already made under valid consent; we will make reasonable efforts to stop future uses and remove publications under our control.

13. Third Parties and Links

Links to third-party websites and services follow their own policies, for which we are not responsible. We recommend reading their privacy policies.

14. Changes to this Policy

We may update this Policy to reflect legal, technical, or operational changes. We will publish the new version with its effective date and, when changes are material, provide reasonable advance notice (for example, by email or notice on the Platform).

15. Contact

Questions, data-rights requests, or consent withdrawal: [email protected]