Privacy Policy

1. Who we are

RIDP — Product Registration and Identification is a private platform that operates unified product registration in Brazil. This policy describes how we collect, use, store and protect your personal data.

2. Data we collect

We collect only the data necessary to provide the service:

2.1. Registration data

• Legal name, trade name and CNPJ of the company;
• Email, phone and business address;
• Name, email and password (bcrypt hashed) of users.

2.2. Product data

• Name, description, brand, model, color, material, dimensions;
• Images, SKU, RIDP, provided GTIN/EAN and other identifiers;
• RFID tags (EPC, TID) and reads received via API.

2.3. Technical data

• IP address, user-agent, access and audit logs;
• Session cookies (required for authentication);
• Language and theme preferences (stored locally).

3. Purpose of processing

We use your data to:

• Operate the product registration and consultation platform;
• Generate RIDP identifiers, QR Codes, barcodes and labels;
• Authenticate users and ensure account security;
• Receive and process RFID tag reads via API;
• Comply with legal and regulatory obligations;
• Improve the platform and prevent fraud.

4. Legal basis (LGPD)

We process personal data based on:

• Contract performance (art. 7, V) — to provide the contracted service;
• Legal obligation (art. 7, II) — when required by law;
• Legitimate interest (art. 7, IX) — for security, fraud prevention and service improvement;
• Consent (art. 7, I) — when applicable, such as analytics cookies.

5. Data sharing

We do not sell your personal data. We share only when necessary:

• With infrastructure providers (hosting, database);
• With public authorities, upon court order or legal request;
• With payment partners, when applicable;
• In case of merger, acquisition or asset sale, with prior notice.

6. Storage and security

Data is stored on secure servers, with in-transit encryption (HTTPS), bcrypt-hashed passwords, role-based access control, audit logs and periodic backups. We retain data for the time necessary to provide the service or as required by law.

7. Data subject rights (LGPD)

You have the right to:

• Confirm the existence of processing of your data;
• Access the data we keep about you;
• Correct incomplete, inaccurate or outdated data;
• Request anonymization, blocking or elimination of unnecessary data;
• Request data portability to another provider;
• Eliminate data processed based on consent;
• Obtain information about data sharing;
• Revoke consent at any time.

To exercise your rights, email privacidade@ridp.org with the subject "LGPD — [your right]". We will respond within 15 days.

8. Cookies

We use cookies strictly necessary for authentication (session) and preferences (language and theme). We do not use third-party tracking cookies without your consent. You can disable cookies in your browser, but this may affect the functioning of the service.

9. International transfer

Currently, data is stored on servers located in Brazil. If future international transfer is required, we will ensure it occurs only to countries with an adequate level of protection or through specific contractual clauses, in accordance with the LGPD.

10. Data Protection Officer (DPO)

For questions related to data protection, contact our DPO at dpo@ridp.org.

11. Changes to this policy

We may update this policy periodically. Significant changes will be communicated by email or notice on the platform. Continued use after the update implies agreement with the new version.

12. Contact

Questions about this policy? Contact us at privacidade@ridp.org or through the contact page.