Taking on giants requires structure.
Every case against multibillion-dollar corporations demands research, expert analysis and intense legal work. Your donation invests directly in the cases changing our country’s laws.
Donate via Pix
Data protection · LGPD
Privacy Policy
How Gaia Libertas handles the personal data of those who use this website — what we collect, why, for how long, and what you can demand from us at any time.
Privacy Policy
In force since 31 August 2026. This is the first version of this document.
In short
This website collects very little. It uses no cookies, no audience analytics tool, no social network pixel, and runs no third-party scripts. Typefaces are served from our own domain, not from Google.
The only personal data we receive is what you write and send yourself: the contact form and the newsletter sign-up. Nothing is sold, rented or used for advertising.
The rest of this document details that and explains your rights. If you would rather just ask, write to gaialibertas@gaialibertas.org.
Who is responsible for your data
The controller of the personal data processed on this website is Associação Gaia Libertas, registered under Brazilian company number (CNPJ) 62.960.773/0001-77, a non-profit civil association incorporated in Brazil.
The association’s full registration details, including its registered address, are in the CNPJ certificate published on the Transparency page of this website.
Channel for communication with the data subject (data protection officer, under art. 41 of the LGPD): gaialibertas@gaialibertas.org. Use this address to exercise any of the rights listed below.
This website uses no cookies
We install no cookies, store nothing in your browser’s local storage, and use no Google Analytics, Facebook pixel or any other audience measurement tool. That is why there is no cookie notice here: there would be no consent to ask for.
If that changes — if we ever begin measuring audience, for instance — this policy will be updated before the change goes live, and consent will be requested where the law requires it.
As with any website, the server hosting these pages automatically logs accesses, including IP address, date and time. This logging is performed by the hosting provider for security and maintenance, and is required by art. 15 of the Brazilian Internet Civil Framework (Law 12.965/2014), which mandates retaining access logs for six months.
What we collect, and why
There are three situations, and only three. None of them happens without an action on your part.
Contact form
- What
- Name, institution, e-mail, WhatsApp number, subject and the text of your message. E-mail and WhatsApp are required; the rest are optional.
- Purpose
- To read your message and reply to you.
- Legal basis
- Legitimate interest (art. 7, IX), namely responding to those who reach out to the association. You may object to this processing at any time.
- Retention
- For as long as the exchange lasts and, afterwards, for the period needed to comply with a legal obligation or to exercise rights in proceedings (art. 16). We delete it sooner if you ask.
Newsletter sign-up
- What
- Your e-mail address. Alongside it we keep the date you signed up, the language of the page, the address of the page you signed up from, and the version of this policy then in force — that is the record of your consent, which the law requires us to be able to evidence. We do not keep your IP address.
- Purpose
- To send news about the association’s work. We do not use your e-mail for any other purpose, and the list is not shared.
- Legal basis
- Consent (art. 7, I), given when you sign up and withdrawable at any time, without justification.
- Retention
- Until you unsubscribe or request deletion. To leave the list, simply write to gaialibertas@gaialibertas.org — no justification needed, and we remove your address.
Form abuse protection
- What
- An irreversible code derived from your IP address (a hash), accompanied only by the timestamps of your submissions. The IP address itself is not stored, and the code does not allow it to be recovered.
- Purpose
- To stop spam bots from using the form as a message relay.
- Legal basis
- Legitimate interest (art. 7, IX), namely the security of the service itself.
- Retention
- Ten minutes. That is the rate-limit window; beyond it the record is no longer valid.
What we ask you not to send
The message field is free text and reaches us exactly as you write it. Hence one request, and a serious one: do not write sensitive personal data there — the categories the LGPD defines in art. 5, II: racial or ethnic origin, religious belief, political opinion, membership of a union or of a religious, philosophical or political organisation, data concerning health or sex life, genetic or biometric data.
This matters particularly here. We are a cause-driven organisation, and a message explaining why someone is reaching out often reveals philosophical or political conviction — which is, in legal terms, sensitive data. You do not need to disclose that in order to talk to us.
Likewise, if your message concerns another person — a report of wrongdoing, for instance — send only what is indispensable for us to understand the case. Third-party data that is not necessary should not be included.
If you nonetheless need to tell us something sensitive, do so knowing it will be processed on the basis of your consent, given at the moment of sending, and that you may request deletion at any time.
Who we share data with
We do not sell, rent or transfer personal data to anyone. We do not advertise on the basis of it and we do not hand it to data brokers.
Two companies necessarily touch this data, acting as processors and solely so the service can work: the company that hosts the website and delivers these pages, and the company that operates our e-mail and through which your message reaches our inbox.
To send the newsletter we may use an e-mail delivery tool. In that case your address is provided to it, acting as a processor that may use it only to send our newsletter — never for any other purpose, and never for anyone else. The subscriber list itself is kept on our own server.
We may also share data upon a court order, a request from a competent authority, or a legal obligation — and then only to the precise extent required.
International transfer: our providers’ servers may be located outside Brazil. Where that is the case, the transfer takes place under art. 33 of the LGPD, limited to what is necessary to deliver the service.
Donations do not go through this website
This website does not process payments. When you donate, you are taken to the payment provider’s platform, and it is there that your financial data is entered and processed — under that platform’s privacy policy, not this one.
We never receive, see or store card numbers, bank details or payment credentials.
Links that leave this site
Some pages link to third-party services: Instagram, WhatsApp and the donation platform. On clicking, you leave our site and become subject to the destination’s privacy policy, over which we have no control. None of these services loads anything inside our pages — they exist only as links.
How we protect what we receive
The site is served entirely over an encrypted connection (HTTPS). The form has a bot trap and a per-origin submission limit, and the record backing that limit sits in a folder whose web access is denied. Messages are kept in a mailbox restricted to the people in the association who need to answer them.
No security measure is absolute. Should a security incident occur that may bring relevant risk or harm, we will notify the affected data subjects and the Brazilian National Data Protection Authority, as art. 48 of the LGPD requires.
Your rights
Art. 18 of the LGPD guarantees you, at any time and free of charge:
- Confirmation and access: to know whether we process your data and to obtain a copy of it.
- Correction: to correct incomplete, inaccurate or outdated data.
- Anonymisation, blocking or deletion: of data that is unnecessary, excessive or processed in breach of the law.
- Portability: to receive your data in a format that allows transferring it to another provider.
- Deletion: to erase data processed on the basis of your consent — the newsletter case.
- Information on sharing: to know which public and private entities we have shared your data with.
- Information on refusing consent: to be told that you may refuse consent, and what follows if you do.
- Withdrawal of consent: to withdraw consent at any time, without having to justify it.
- Objection: to object to processing based on legitimate interest — the contact form case (art. 18, § 2).
How to exercise those rights
Write to gaialibertas@gaialibertas.org saying what you want. No form, format or justification is needed. We will reply as soon as possible and, at the latest, within 15 days, as per art. 19, II, of the LGPD.
We may need to confirm your identity before acting — this protects you, and is not an obstacle to your request.
If you are not satisfied with our response, you may lodge a complaint with the Brazilian National Data Protection Authority (ANPD), under art. 18, § 1, of the LGPD.
Children and adolescents
This website is not directed at people under 18 and we do not request data from children or adolescents. If we identify that we have received a child’s data without the specific consent of at least one parent or legal guardian, required by art. 14, § 1, of the LGPD, we will delete the record. If you are a guardian and believe this has happened, write to gaialibertas@gaialibertas.org.
There is no automated decision-making
We do not use your data to build profiles, score, rank or make any automated decision about you. A person reads your message.
Changes to this policy
If this policy changes, the new version takes effect from the date shown at the top of the document, and the change goes live before any change in how we handle data. It is worth re-reading this page from time to time.
