1. Who we are and to whom this Policy applies
This Policy explains how GasHub Brasil Ltda. ("GasHub") collects, uses, shares, stores and protects the personal data of those who visit the gashub.com.br website or fill in its forms.
| Item | Information |
|---|---|
| Controller | GasHub Brasil Ltda. |
| CNPJ (Brazilian company registration number) | 61.317.824/0001-84 |
| Address | Rua Pais Leme, 215, conj. 1.713, Pinheiros, São Paulo/SP, CEP 05424-150, Brazil |
| Data Protection Officer (Encarregado) | Ramon de Oliveira Júnior |
| Privacy contact | [email protected] |
GasHub complies with the Brazilian General Data Protection Law (Law No. 13,709/2018 – LGPD), the Brazilian Internet Civil Framework (Law No. 12,965/2014 – Marco Civil da Internet) and the regulations of the Brazilian National Data Protection Authority (ANPD), using ISO/IEC 27001 and 27701 as references for good practice.
This Policy applies to website visitors and to representatives of companies that contact GasHub through it.
Platform users. The processing of data on the GasHub platform (hub.gashub.com.br), such as registration, authentication, transactions and contract signature, is governed by the Platform Privacy Policy, available when accessing the platform, and by the Participation Agreement (Termo de Adesão).
2. Personal data we collect
We collect only the data needed for each interaction with the website:
| Context | Personal data |
|---|---|
| Website forms (contact, requests for summaries and sample editions) | Name, company, corporate e-mail, phone number (when provided), subject of interest and message |
| Website browsing | IP address, date and time of access, browser, operating system, pages visited, referring page and cookie data (section 5) |
| Communications following the contact | Messages exchanged by e-mail, phone or online meetings scheduled through the website |
Sources. Data is provided by the data subject when filling in the forms or collected automatically while browsing.
Sensitive data. GasHub does not request sensitive personal data (LGPD, art. 5, II). We recommend not including such data in messages sent through the website. If a message contains this type of data, we apply access restrictions, encryption, minimum retention and secure deletion.
3. Purposes and legal bases
Each processing activity has a specific purpose and a legal basis under art. 7 of the LGPD:
| Purpose | Examples | Legal basis (LGPD) |
|---|---|---|
| Responding to requests made through the website | Replying to contacts; sending the information security summary or the standard contract summary; scheduling meetings | Pre-contractual steps at the data subject's request (art. 7, V) / Legitimate interest (art. 7, IX) |
| Sending publications and corporate communications | Sample editions of reports, event invitations | Consent (art. 7, I), which may be withdrawn at any time |
| Website operation and security | Preventing attacks and form abuse, essential cookies, retention of access logs | Legitimate interest (art. 7, IX) / Compliance with a legal obligation (art. 7, II; Marco Civil, art. 15) |
| Website improvement | Browsing and performance metrics | Consent, for non-essential cookies (art. 7, I) / Legitimate interest, for aggregated metrics |
| Exercise of rights | Responding to requests from authorities and defending legal proceedings | Compliance with a legal obligation (art. 7, II) / Regular exercise of rights (art. 7, VI) |
Where processing is based on legitimate interest, GasHub assesses in advance its necessity and its impact on the data subject, who may object through the channel in section 8. Where processing is based on consent, the data subject may withdraw it at any time, without affecting processing already carried out.
4. Sharing and international transfers
GasHub does not sell personal data. Data is shared only when necessary and to the minimum extent required for each purpose:
| Recipient | Purpose | Processing location |
|---|---|---|
| Website hosting and protection provider | Hosting, firewall, attack protection and access logs | United States, with global nodes |
| E-mail, collaboration and relationship management providers | Receiving and responding to requests, sending publications | Brazil and United States |
| Public authorities | Compliance with legal or regulatory obligations or court orders | Brazil |
| Legal advisors and auditors | Exercise of rights and compliance reviews, under confidentiality obligations | Brazil |
Service providers act as processors under contracts containing data protection clauses, subject to a prior security assessment and periodic reassessment. In the event of a corporate transaction (merger, acquisition or reorganization), data may be transferred to the successor, which will be bound by this Policy.
International transfers. Part of the processing takes place outside Brazil, as indicated above. In these cases, GasHub adopts the mechanisms of art. 33 of the LGPD and of the ANPD International Data Transfer Regulation (Resolution CD/ANPD No. 19/2024), such as standard contractual clauses, together with encryption and access controls.
5. Cookies and similar technologies
Cookies are small files stored in the browser. The website uses only essential cookies without consent; all others depend on your choice in the cookie notice:
| Category | Purpose | Consent |
|---|---|---|
| Strictly necessary | Security, protection against automated access and page operation | Not required (always active) |
| Functional | Preferences such as language (Portuguese or English) | Required |
| Performance and analytics | Browsing metrics, preferably aggregated | Required |
| Marketing | Campaign measurement | Required |
You can change your preferences at any time in the cookie notice or in your browser settings. Blocking strictly necessary cookies may prevent the website from working properly.
6. How long we keep data
Data is kept only for as long as necessary for its purpose or as required by law. At the end of that period, it is deleted or anonymized:
| Data | Retention period |
|---|---|
| Requests and contacts received through the website | Up to 2 years after the last contact |
| Publications and corporate communications | Until consent is withdrawn |
| Website access logs | 12 months |
| Browsing metrics | Up to 2 years, aggregated whenever possible |
| Security incident records | At least 5 years |
Longer periods may apply where required by law or for the regular exercise of rights. If a contact leads to registration on the platform, retention periods follow the Platform Privacy Policy.
7. Information security and incidents
GasHub maintains a formal information security program, with controls proportionate to risk:
- Encrypted connection to the website (HTTPS, TLS 1.2 or higher, with HSTS) and encryption of stored data.
- Web application firewall and protection against denial of service and automated form submissions.
- Internal access to data restricted by role, with multi-factor authentication on corporate accounts.
- Event monitoring and audit logs.
- Mandatory privacy and security training for employees and service providers.
No security measure is absolute. For this reason, GasHub manages risks continuously and maintains an incident response plan.
Incidents. In the event of a security incident that may result in relevant risk or harm to data subjects, GasHub will notify the ANPD and the affected data subjects within 3 business days of becoming aware of the incident, in accordance with Resolution CD/ANPD No. 15/2024. The notice will describe the nature of the data affected, the risks involved and the measures taken. Suspected incidents may be reported through the channel in section 1.
8. Your rights and how to exercise them
Under art. 18 of the LGPD, you may request from GasHub:
- confirmation that processing takes place and access to your data;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
- data portability, subject to commercial and industrial secrecy;
- deletion of data processed on the basis of consent, except where retention is permitted by law;
- information on the entities with which we share your data;
- information on the possibility of not giving consent and its consequences;
- withdrawal of consent;
- objection to processing based on other legal grounds, in case of non-compliance with the LGPD;
- review of decisions made solely on the basis of automated processing.
How to exercise your rights. Send your request to [email protected]. For your security, we may verify your identity before responding. Confirmation of processing or access in simplified form is provided immediately; a complete statement is provided within 15 days of the request (LGPD, art. 19). You may also file a petition with the ANPD.
Automated decisions. The website does not make decisions based solely on automated processing that produce legal effects for the data subject.
9. General provisions
Children and adolescents. The website is intended for companies and their representatives, not for persons under 18 years of age. If we identify data from a minor collected inadvertently, it will be deleted.
Third-party links. The website may contain links to third-party websites, which have their own privacy policies. GasHub is not responsible for the practices of those websites.
Changes. This Policy may be updated to reflect legal, regulatory or operational changes. The current version will always be published on this page, with its update date.
Governing law and language. This Policy is governed by Brazilian law. This English version is provided for convenience; in case of any discrepancy, the Portuguese version prevails.
Contact. Questions, requests and complaints about privacy: [email protected], attention of the Data Protection Officer.