Please do not register at https://www.ccrmetrobahia.com.br/ if you are under 16 years old.

Although we prohibit registration of children and adolescents under the age of 16, parents must supervise the online activities of their underage children.

All activities of adolescents over 16 and under 18 years of age must be assisted by their parents or legal representatives.

Data, including Personal Data, may be collected when You submit it or when You interact with the https://www.ccrmetrobahia.com.br/ and services, that includes:

Most of our services depend directly on some Data informed in the chart above, mainly Registration Data. If you choose not to provide some of this Data, we may be unable to provide all or part of our services to You.

You are solely responsible for the accuracy, reliability or lack of it in relation to the Data you provide or for its out-date. Be aware that it is your responsibility to ensure accuracy or keep them updated.

Likewise, We are not be under any obligation to process or handle any of your Data if there is reason to believe that such processing or handling may attribute to CCR S.A. any violation of any applicable law or if you are using https://www.ccrmetrobahia.com.br/ for any unlawful, illicit, or unethical purpose.

The database constituted through the collection of Data is our property and is under our responsibility, and its use, access and sharing, when necessary, will be done within the limits and purposes of the business described in this Policy.

We use the following technology(s):

Functionality Cookies, it is up to you to configure your Internet browser if you want to block them. In this case, some features we offer may be limited.

All technologies used will always respect the current legislation and the terms of this Policy.

We do not use any type of solely automated decision that impacts You.

We do not share your personal data with third parties, with the following exceptions:

(i) We may share your personal data when we have gained your consent to do so;

(ii) We may share your personal data with affiliates within CCR METRÔ BAHIA;

(iii) We may share your personal data with Group CCR’s service providers and business partners that process personal data on the Company’s behalf;

(iv) With service providers and business partners of CCR METRÔ BAHIA, in the context of the concession agreement, in addition to other illicit conduct with high risk of damage, in the interest of CCR METRÔ BAHIA and the protection of third parties;

(v) We may share your personal data with government bodies in compliance with legal and contractual obligations, including within the scope of concession, permission, and authorization contracts;

(vi) We may share your personal data with police authorities as required by law or when it is reasonably necessary, so as to protect the rights, properties and/or ensure the safety of users, third parties and/or CCR METRÔ BAHIA; and

(vii) We may share your personal data with competent legal, administrative and government authorities whenever there is a legal determination, request or court order;

(viii) We may share your personal data when it is required to perform commercial activities and to provide our services through our website https://www.ccrmetrobahia.com.br/;

(ix) We may share your personal data automatically in case of corporate changes, such as consolidation, acquisition and merger.

For the purposes of market intelligence research, disclosure of data to the press and advertising, the data provided by You will be shared anonymously, that is, in a way that does not allow its identification.

It is very important that you protect your Data from unauthorized access to your computer, account, or password, and make sure to always click "exit" when you exit from a shared computer. It is also very important that you know that we will never send electronic messages requesting data confirmation or with attachments that can be executed (extensions: exe, .com, among others) or even links for eventual downloads.

Internally, the Personal Data collected are only accessed by properly authorized professionals, respecting the principles of proportionality, necessity and relevance to the objectives of our business, in addition to the commitment to confidentiality and preservation of your privacy under this Policy.

When you use https://www.ccrmetrobahia.com.br/, you may be conducted, via link to other portals or platforms, which may collect your information and have their own Data Processing Policy.

You are responsible for reading the Privacy and Data Processing Policies of such platforms or portals outside our environment and it is your responsibility to accept or reject it. We are not responsible for the privacy and data processing policies of third parties and the content of any websites content or services linked to environments other than ours.

We have business partners that can eventually offer services through features or websites that can be accessed from https://www.ccrmetrobahia.com.br/. The Data You provide to these partners will be the responsibility of these partners, thus being subject to their own data collection and use practices.

In case third party companies perform the Treatment on our behalf of any Personal Data we collect, they will respect the conditions here stipulated and the information security rules, mandatorily.

As controllers of your personal data, we are responsible for:

(i) recording data processing activities;

(ii) adopting technical and administrative security measures;

(iii) ensuring information security;

(iv) respecting holders’ rights;

(v) cooperating with the National Data Protection Authority;

(vi) ensuring compliance with the principles and legal bases of the Brazilian General Data Protection Law (LGPD).

To optimize and improve our communication, when we send an email to You we can receive a notification when they are opened, provided this possibility is available. It is important that you be aware because e-mails are sent only by the domain: @grupoccr.com.br.

Collected personal data and recorded activities are stored in a secure and controlled environment within our local servers.

We keep your personal data for the period necessary to comply with the purposes set out in this Privacy Policy, including to comply with legal and contractual obligations within the scope of concession, permission and authorization contracts. For specific information on the data retention periods, you may email our Data Protection Officer at encarregado.dadospessoais@grupoccr.com.br.

The Data collected will be stored in our servers located in Brazil, as well as in an environment of use of resources or servers in the cloud (cloud computing), which may require a transfer and/or processing of this Data outside Brazil.

According to the LGPD, you are entitled to:

(i) request the confirmation of whether your personal data will be processed;

(ii) request the access to your personal data;

(iii) request the correction of incomplete, inaccurate or out-of-date personal data;

(iv) request the anonymization, blocking or deletion of unnecessary or excess data, as well as data that is not processed in compliance with the LGPD, if applicable;

request the portability of your personal data to another provider, subject to the regulation of the National Data Protection Authority (ANPD);

(vi) request the erasure or anonymization of personal data processed on the basis of your consent, except where the law authorizes the retention of such data on another basis;

(vii) obtain information about the public and private entities with which we have shared your personal data;

(viii) to request information about the possibility of not consenting to the processing of your personal data and the consequences of this action;

(ix) to withdraw your consent.

In case you request the deletion of your Personal Data, it may occur that the Data need to be kept for a period longer than the request for deletion, according to article 16 of the General Data Protection Regulation, in order to (i) fulfill a legal or regulatory obligation, (ii) study by a research organization, and (iii) transfer to a third party (respecting the data process). In all cases by anonymizing the Personal Data, as long as possible.

Once the maintenance period and the legal requirement have expired, the Personal Data will be deleted using safe disposal methods or used anonymously for statistical purposes.

You hereby agree that we have the right to change the content of this Policy at any time, for any purpose or need, as appropriate and in accordance with the law or any rule that has equivalent legal force, and it is your responsibility to check it whenever you access https://www.ccrmetrobahia.com.br/ or use our services.

If there are updates to this document that require further collection of consent, You will be notified through the contact channels You inform.

Should any part of this Policy be deemed inapplicable by a Data Authority or court, the remaining conditions will remain in full force and effect.

You understand that any communication made by e-mail (to the addresses informed in your registration), SMS, instant communication applications or any other digital form, are also valid, effective and sufficient for the disclosure of any matter that refers to the services we provide, your Data, as well as the conditions of its provision or any other subject addressed therein, being the exception only that this Policy provides as such.

In case of any doubt regarding the provisions of this Privacy and Data Processing Policy, you may contact through the Communication Channel E-mail: encarregado.dadospessoais@grupoccr.com.br.

This Policy will be interpreted according to the Brazilian legislation, in the Portuguese language, being elected the forum of its domicile to settle any controversy that involves this document, except for specific reservation of personal, territorial or functional competence by the applicable legislation.

If You do not reside in Brazil, and because of the services offered by Us only in the national territory, you submit yourself to the Brazilian legislation, agreeing, therefore, that in case of litigation to be resolved, the lawsuit should be proposed in the Courts of São Paulo - SP.

For the purposes of this Policy, the following definitions and descriptions should be considered for your best understanding:

(i) Data: Any information inserted, processed or transmitted through the https://www.ccrmetrobahia.com.br/.

(ii) Personal Information: Data related to an identified or identifiable individual.

(iii) Anonymization: Use of reasonable and available technical means at the time of the Treatment, by which a data loses the possibility of association, directly or indirectly, to an individual.

(iv) In charge (Data Protection Officer -DPO): Person designated by Us to act as a communication channel between the controller, the data owners and the National Data Protection Authority (ANPD).

(v) Cloud Computing: Or cloud computing, is service virtualization technology built from the interconnection of more than one server via a common information network (e.g. the Internet), aiming to reduce costs and increase the availability of sustained services.

(vi) https://www.ccrmetrobahia.com.br/: Assigns the electronic address [•] and its subdomains.

(vii) Cookies: Some small files sent by https://www.ccrmetrobahia.com.br/, saved on your devices, which store the preferences and few other information, in order to customize your navigation according to your profile.

(viii) IP: Abbreviation for Internet Protocol; It is an alphanumeric combination that identifies users' devices on the Internet;

(ix) Logs: Activities registers of any users who use https://www.ccrmetrobahia.com.br/.

(x) Decisions only automated: These are decisions that affect a user that have been programmed to operate automatically, without the need for a human operation, based on automated processing of personal data.

(xi) Treatment: Every activity executed with Personal Data, such as the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination or extraction.

Update: March 22, 2022.