Privacy policy

1. Controller and contact

The controller of personal data processed through this site is Genesys Digital Ltda, CNPJ 57.418.586/0001-26, registered in Brazil. All privacy matters, including requests from data subjects, are handled at support@fieldnotepress.site. The same address serves as the contact point required under Article 41 of the LGPD and, where applicable, Article 27 of the GDPR.

2. What is collected

• Correspondence data. Email address and message content when someone writes to the address above.
• Transaction data. Where material is purchased, the email address, name and order reference supplied at checkout, plus the country and currency of the transaction. Card numbers are never received or stored; payment is processed by third-party providers.
• Technical data. IP address, user agent, referring page, approximate region and pages viewed, collected automatically by the hosting provider and by analytics and advertising tools.

No special categories of data are deliberately collected. Health data, religious belief, political opinion, sexual orientation, biometric and genetic data are not requested at any point, and messages containing such information are not retained beyond what is needed to answer them.

3. Legal bases

• Performance of a contract (LGPD Art. 7 V; GDPR Art. 6(1)(b)) — delivering purchased material, handling refunds and providing support.
• Legitimate interests (LGPD Art. 7 IX; GDPR Art. 6(1)(f)) — site availability, fraud prevention, aggregate audience measurement and answering unsolicited correspondence. A balancing assessment is recorded for each such purpose.
• Consent (LGPD Art. 7 I; GDPR Art. 6(1)(a)) — non-essential cookies, advertising measurement and any marketing email. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
• Legal obligation (LGPD Art. 7 II; GDPR Art. 6(1)(c)) — tax, accounting and consumer-law record keeping.

4. How data is used

Data is used to deliver and support purchased material, to answer messages, to keep records required by law, to measure how the site is used in aggregate, and to measure the performance of advertising placements. Personal data is not sold, rented or traded, and is not used to build profiles for sale to third parties.

5. Sharing and processors

Data is shared only with service providers acting on documented instructions: hosting and content delivery, email delivery, payment processing, and analytics and advertising measurement. Each is bound by a processing agreement limiting use to the instructed purpose. Data may also be disclosed where required by a competent authority, a court order or applicable law.

6. International transfers

The controller is established in Brazil and its providers operate in several jurisdictions, including the United States and the European Union. Transfers out of the EEA or the United Kingdom rely on the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, together with supplementary measures where a transfer risk assessment indicates they are needed. Transfers out of Brazil rely on the mechanisms permitted by Chapter V of the LGPD.

7. Retention

• Correspondence: 24 months from the last message in the thread.
• Transaction and tax records: 5 years from the transaction, in line with Brazilian tax and consumer record-keeping requirements.
• Technical and analytics data: 14 months, or the shorter period set by the provider.
• Consent records: for as long as the consent is relied upon, plus 5 years.

At the end of a retention period data is deleted or irreversibly anonymised.

8. Rights of data subjects

Under Article 18 of the LGPD and Articles 15 to 22 of the GDPR, data subjects may request confirmation of processing, access to their data, correction of incomplete or outdated data, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about entities with which data has been shared, withdrawal of consent, and objection to processing carried out on the basis of legitimate interests. Requests are sent to support@fieldnotepress.site and answered within 15 days under the LGPD and one month under the GDPR, extendable where a request is complex, with notice of the extension.

Identity is verified before a request is fulfilled, using the email address on record rather than by requesting identity documents.

9. Cookies and similar technologies

Strictly necessary cookies keep the site working and are set without consent. Analytics and advertising cookies, including pixels operated by advertising platforms, are set only after consent is given through the banner, and can be refused there or withdrawn later by clearing site data and declining on the next visit. Most browsers also allow cookies to be blocked entirely; blocking strictly necessary cookies may stop parts of the site from working.

10. Data security

Transport encryption is used across the site. Access to systems holding personal data is limited to those who need it and protected by multi-factor authentication. No system is immune to compromise; where a breach is likely to create risk, the affected data subjects and the competent authority are notified within the periods set by the LGPD and the GDPR.

11. Children

This site is intended for people aged 18 and over and is not directed at children. Data known to have been collected from a child is deleted. A parent or guardian who believes such data has been submitted can write to the address above.

12. Complaints

A complaint may be made to the Brazilian data protection authority, the Autoridade Nacional de Proteção de Dados (ANPD). Data subjects in the European Economic Area may complain to their national supervisory authority, and those in the United Kingdom to the Information Commissioner's Office.

13. Changes

Material changes are published on this page with a revised date at the top. Where a change affects processing carried out on the basis of consent, fresh consent is requested before the change takes effect.