At Huggy, we
take Data Privacy
seriously.
And now, we want to
take it to the world.

• consumers;

• employees;

• app users;

• representatives of partner companies.

• consent of the data subject;

• legitimate interest of the processing agent or third parties;

• execution of a contract;

• compliance with a legal or regulatory obligation;

• exercise of the right of defense in judicial or administrative proceedings;

• among others.

According to the legislation, the consent of a person is not always necessary for personal data processing, and it should even be avoided in some cases. Therefore, a legal analysis of each personal data processing carried out by an organization is essential to ensure that there is a legal basis that legitimizes it.

The idea, therefore, is not to make processing impossible, but to ensure it is done safely, using the minimum amount of personal data necessary to achieve a specific and legitimate purpose, providing maximum transparency to the data subject regarding how the data is processed.

1 - the right to information for data subjects, including access to information about their personal data stored by third parties;

2 - correction of incorrect, outdated, or incomplete information;

3 - cancellation of authorization for data processing;

4 - data portability;

5 - deletion of data, in some cases.

Data subjects can request the exercise of these rights at any time from those responsible for the processing, who must maintain a dedicated channel for receiving requests and publicize it in their privacy policies.

1 - Purpose – It is no longer possible to process personal data for generic or indeterminate purposes. The processing of each piece of personal information must be carried out for specific, legitimate, explicit, and informed purposes to the data subject;

2 - Necessity (or minimization) – Companies can only use data that is indeed necessary to achieve their purposes;

3 - Free access – The data subject has the right to consult, simply and free of charge, all the data that the company holds about them;

4 - Transparency – All information about personal data processing carried out by the company must be available to the data subject in a clear, precise, and truthful manner.

• Map the entry and exit points of personal data in the organization;

• Appoint a Data Protection Officer (“DPO”) to lead the actions necessary to comply with data protection laws and manage data subject requests and communication with external authorities;

• Check if all personal data processing activities carried out by the organization are based on a legal ground and comply with the principles of the law;

• Identify risks and attention points in the processing activities and develop action plans with the implementation of privacy and information security policies, process reengineering, and team training;

• Clearly state on your pages the objectives for which each piece of personal data is being captured, and what processing is carried out;

• Create a dedicated channel for handling data subject requests;

• Provide, correct, or delete stored data of an individual if they request it with legal support;

• Amend terms of use, contracts, and privacy policies to transparently reflect the circumstances of personal data processing in the organization.

Compliance with LGPD and GDPR is an ongoing process that involves, including, a cultural and behavioral change within organizations - involving, for example, the alteration of various internal processes.

Therefore, the engagement of leadership and all sectors of the company is crucial to ensure that the actions instituted are adhered to in the work routines, through an effective awareness process.

Many other measures are necessary and advisable, so it is important to have a technical team and lawyers specializing in personal data protection and the digital universe.