Machine translation. The Portuguese version is the official one.

Privacy and Data Protection Policy

This Policy explains what personal data CIDES-VRC processes when you use this portal, why it processes them, with whom it shares them, for how long it keeps them, and how you can exercise your rights. It follows Lei nº 13.709/2018 (General Data Protection Law — LGPD), the Lei nº 12.527/2011 (Access to Information Law), Lei 13.460/2017 and the Marco Civil da Internet (Lei nº 12.965/2014) (Brazilian Internet Civil Rights Framework).

Current version: August 19, 2026.

1. Who processes your data

The controller of the personal data processed on this portal is the Consórcio Intermunicipal de Desenvolvimento Econômico e Social do Vale do Rio Cuiabá (CIDES-VRC), a public consortium established in accordance with Lei nº 11.107/2005, with legal personality under public law and interfederative autarchic nature, registered under CNPJ nº 07.950.742/0001-27.

Address: Rua Professor João Félix, nº 1024, Quadra 5, Lote 60 — Bairro Lixeira, Cuiabá/MT, CEP 78008-435
Phone: (65) 3359-2808
Email: ouvidoria@consorciovaledoriocuiaba.com.br
Service hours: Monday to Friday, 8am to 12pm and 2pm to 6pm

As a legal entity under public law, data processing by CIDES-VRC follows Chapter IV of the LGPD (arts. 23 to 32), which governs processing by public authorities.

2. Data Protection Officer

The Data Protection Officer is the person designated to act as the communication channel between the consortium, data subjects, and the National Data Protection Authority (ANPD), as provided in art. 41 of the LGPD.

To contact the Data Protection Officer, use any of these channels, indicating that the matter relates to the protection of personal data:

Ombudsman's Office: file a complaint
Information request (e-SIC): open a request
Email: ouvidoria@consorciovaledoriocuiaba.com.br
In person or by mail: at the address indicated in item 1

3. Who this Policy applies to

It applies to everyone who uses this portal: citizens consulting information, people filing complaints with the Ombudsman's Office or information access requests, representatives of establishments requesting registration in the inspection service, suppliers monitoring public bids, and staff and collaborators who access the restricted area.

Personal data is any information related to an identified or identifiable natural person — name, CPF, email, phone, IP address, among others. Sensitive personal data is data about racial or ethnic origin, religious belief, political opinion, union membership, health, sex life, genetic or biometric data.

4. Principles guiding data processing

All processing carried out by this portal follows the principles of art. 6 of the LGPD, notably:

Purpose: data is used only for the purpose stated at the time of collection.
Necessity: we collect the minimum required. For example, complaints filed with the Ombudsman's Office may be anonymous, and the virtual assistant usage log keeps the IP address in a reduced form.
Transparency: this Policy describes each actual data flow on the portal, not a generic text.
Security and prevention: we adopt the technical and administrative measures described in item 9.
Non-discrimination: no data is used for discriminatory, unlawful, or abusive purposes.

5. What data we process, for what purpose, and for how long

5.1. Portal browsing

Data: IP address, date and time of access, requested address, browser, and operating system.
Purpose: keep the portal online, investigate failures, and contain attacks and abuse.
Legal basis: compliance with a legal obligation (art. 7, II, of the LGPD, combined with art. 15 of the Marco Civil da Internet) and legitimate interest in the security of the service.
Retention period: application access logs are kept for 6 months, in accordance with art. 15 of the Marco Civil da Internet.

5.2. Ombudsman's Office and information access requests (e-SIC)

Data: type of complaint, subject, description, attachments, and, when you identify yourself, name, email, phone, and identification document (CPF or CNPJ). The IP address and browser used to submit the request are also recorded, as an anti-fraud measure. Complaints may be anonymous: in that case no identifying data is requested.
Purpose: receive, investigate, and respond to complaints and requests, meet legal deadlines, allow tracking by protocol number and key, and produce statistics.
Legal basis: execution of public policy and fulfillment of a legal duty (art. 7, II and III, and art. 23 of the LGPD), in accordance with Lei 13.460/2017 and Lei nº 12.527/2011.
Retention period: the records are kept for the document retention period applicable to public administration. After that period, identifying data is anonymized, and only depersonalized content is preserved for statistical and institutional memory purposes.
Confidentiality: complaints may be classified with restricted access when required by law, and the complainant's identity is protected as provided in art. 10, §7, of Lei 13.460/2017.

5.3. Inspection service (SISBI/SIM)

Data: data of the establishment and its representative (company name, CNPJ or CPF, address, contact information), documents attached to the request, and, in the sanitary complaint channel, the description and files submitted.
Purpose: process registration requests, enrollment, and other acts of the inspection service, and investigate reports of unlicensed operations.
Legal basis: execution of public policy and regular exercise of administrative authority (art. 7, II and III, and art. 23 of the LGPD), in accordance with Lei nº 14.515/2022 and Portaria MAPA nº 672/2024.
Retention period: for the duration of the administrative process and the applicable document retention period.
Sanitary complaints: anonymous complaints are accepted. When you submit photographs, the portal automatically removes the location data recorded by the device before storing the file.

5.4. Contact Us

Data: name, email, subject, and message.
Purpose: respond to your message.
Legal basis: preliminary procedure at the request of the data subject (art. 7, V) and exercise of a public duty (art. 23).
Retention period: for the time necessary for the response and the corresponding administrative record.

5.5. Virtual assistant (Cidinha)

The assistant works in two stages.

Before identification. The first questions are answered without any registration. We keep the question, the answer given, a random conversation identifier, and the reduced IP address — the last digits are discarded before recording, so the log does not point to a specific access.

From the third question onward. To continue, the assistant asks for name, email, mobile phone, and WhatsApp and confirms the email address with a six-digit code sent to you. From then on:

the service request receives a protocol number and the conversation becomes linked to you;
the conversation history is sent to your email, so you keep a record of what you asked and what was answered;
if you wish, the assistant opens on your behalf a complaint with the Ombudsman's Office or a request in e-SIC, with a protocol number, a tracking key, and a legal deadline — in this case, the conversation accompanies the record so that whoever handles it has the context.

Recognition between visits: after confirming the email, the portal stores in your browser a cookie with a random code (not your data) to recognize you next time without asking for registration again. Confirmation by code is repeated every 24 hours, and the "that's not me" button in the chat immediately erases this recognition. In another browser, simply entering your email is enough: registration is not requested again.
Purpose: provide and record the service, allow tracking by protocol number, send the history, forward the request to the appropriate formal channel, and prevent abuse of the service.
Legal basis: execution of public policy and exercise of a legal duty (art. 7, II and III, and art. 23 of the LGPD); when the conversation becomes a formal complaint, Lei 13.460/2017 and Lei nº 12.527/2011 also apply.
Retention period: the record is kept for the document retention period applicable to public administration. The confirmation code is discarded as soon as it is used or expires, and is never stored as readable text.
You are not required to identify yourself. If you prefer to proceed without registering, use the Ombudsman's Office — which accepts anonymous complaints — or search the portal directly through search and the document archive.
Note: even when identified, the assistant is an information channel. For a formal response with a legally guaranteed deadline, the request must be filed with the Ombudsman's Office or e-SIC — which the assistant itself does at your request.
Third-party processing: the question is sent to the language model provider to generate the answer. Your name, email, and phone number are not sent to that provider — only the text of the question and the portal excerpts used as source material. See item 7.

5.6. Polls

Data: the option chosen, without any identification. A cookie in your browser records that that poll has already been answered.
Purpose: tally the survey and prevent repeated votes.
Legal basis: exercise of a public duty (art. 23).

5.7. Restricted area (staff and collaborators)

Data: name, institutional email, position, phone number, password (stored in encrypted and irreversible form), and access logs and records of actions performed in the system.
Purpose: authenticate users, control permissions, and maintain an audit trail.
Legal basis: compliance with a legal obligation and exercise of a public duty (arts. 7, II and III, and 23).
Retention period: for the duration of the employment/service relationship, and audit records for the applicable retention period.

6. With whom data is shared

CIDES-VRC does not sell, rent, or transfer personal data for commercial purposes. Sharing occurs only in these situations:

Public and oversight bodies: when there is a legal, judicial, or oversight body request (Court of Auditors, Public Prosecutor's Office, ANPD), or when the information is subject to mandatory disclosure.
Member municipalities: when the matter falls under municipal jurisdiction, so that the municipality can act — which is the very purpose of the consortium.
Contracted processors: companies that process data on behalf of the consortium, under instruction and contract, without autonomy to use them for their own purposes. These are:
- Hosting provider — keeps the portal online and stores its access logs.
- Database and file storage provider — stores the portal's content and the data submitted through forms, on servers located in Brazil (São Paulo region).
- Language model provider — processes the question sent to the virtual assistant to generate the answer. See item 7.
- Email delivery provider — delivers automatic messages with protocol numbers, deadlines, and responses.
- Text recognition provider — converts public scanned documents into searchable text. It does not process form data.
VLibras: the Federal Government's official Libras (Brazilian Sign Language) translator is loaded from vlibras.gov.br on all pages, so that deaf people can access content in Brazilian Sign Language. This loading provides the service with your IP address. It does not depend on consent and cannot be turned off on the portal, since it stems from the accessibility duty (Lei nº 13.146/2015 and Decreto nº 5.296/2004) — making accessibility conditional on cookie consent would exclude precisely the people it exists to include.
Third-party embedded content: YouTube videos and Google Maps, which are only loaded after your consent. See the Cookie Policy.

7. International data transfer

Some processors are based outside Brazil. In such cases, transfer follows arts. 33 to 36 of the LGPD and is limited to what is strictly necessary:

Virtual assistant: the typed question and the portal excerpts used as source material are sent to the language model provider, based in the United States, exclusively to generate the response. Your name, email, phone number, IP, or any registration data are not sent: identification takes place on the portal itself and does not accompany the question. Even so, avoid writing third-party data in the question text.
Content indexing: texts already public on the portal are sent to a foreign provider to generate the search index. There is no visitor personal data in this process.
Embedded content: by authorizing videos and maps, your access becomes known to Google, under that company's privacy policy. Until you authorize it, nothing is sent to them.

8. Cookies

This portal uses only the cookies necessary for its operation and, upon authorization, loads embedded third-party content. There is no advertising or audience analytics cookie. Details are in the Cookie Policy, and your choice can be reviewed at any time via the cookie icon in the footer.

9. Information security

In compliance with arts. 46 to 49 of the LGPD, we adopt, among others, the following measures:

encrypted traffic (HTTPS) throughout the portal;
passwords stored with a cryptographic hash algorithm, with no possibility of reverse reading;
access control by profile and by department, with granular permissions and an audit trail;
data isolation in the database through row-level access policies;
protection against mass submissions, form fraud, and request rate limiting;
automatic removal of location metadata from images submitted via the sanitary complaint channel;
periodic backups;
logging of operations performed in the restricted area.

No system is immune to incidents. In the event of a security incident that could cause significant risk or harm, the consortium will notify the ANPD and affected data subjects, as provided in art. 48 of the LGPD.

10. Your rights

Art. 18 of the LGPD guarantees you, at any time and free of charge:

confirmation of the existence of processing;
access to the data;
correction of incomplete, inaccurate, or outdated data;
anonymization, blocking, or deletion of unnecessary or excessive data, or data processed non-compliantly;
portability to another provider, upon express request;
deletion of data processed based on consent;
information about with whom the consortium has shared your data;
information about the possibility of not consenting and the consequences thereof;
withdrawal of consent, when this is the legal basis used;
review of automated decisions that affect your interests.

How to exercise these rights: through e-SIC, through the Ombudsman's Office, or by email at ouvidoria@consorciovaledoriocuiaba.com.br. To protect you, we may request additional information to confirm your identity before responding to the request.

Limitations: as a public body, some data cannot be deleted upon request, because its retention stems from a legal obligation, a document retention period, or the public interest in accountability (arts. 16 and 23 of the LGPD). In such cases, we will explain the reason and the legal basis.

You may also file a request directly with the National Data Protection Authority (ANPD) (art. 18, §1).

11. Children and adolescents

This portal is not directed at children and does not request data from minors under 12 years of age. If it becomes necessary to process a child's data in any service, this will be done in their best interest and with the specific consent of at least one parent or legal guardian, as provided in art. 14 of the LGPD.

12. Public data and active transparency

Part of the content of this portal is subject to mandatory disclosure and contains personal data whose disclosure is required by law — for example, names and salaries of public employees, partners of contracted companies, and those responsible for administrative acts. This disclosure is based on Lei nº 12.527/2011, on Lei Complementar nº 131/2009, and on art. 23 of the LGPD, and does not depend on consent.

13. Changes to this Policy

This Policy may be updated when there is a change in legislation, in the portal's services, or in the tools used. The date of the current version is shown at the beginning of the document. Significant changes in how we process data will cause the cookie notice to be shown again, so you can review your choice.

14. Applicable law and jurisdiction

This Policy is governed by Brazilian law. The courts of the Comarca de Cuiabá, State of Mato Grosso are elected to settle any disputes arising from it, with waiver of any other, however privileged it may be.