Privacy Policy

For the purposes of this Policy, the following definitions apply, as set out in the LGPD:

• Personal data: information relating to an identified or identifiable natural person, such as name, email, or CPF.
• Sensitive personal data: data on racial or ethnic origin, religious belief, political opinion, health or sex life, genetic or biometric data.
• Data subject: the natural person to whom the personal data relates (you).
• Processing: any operation carried out with personal data, such as collection, storage, use, sharing, or deletion.
• Controller: FineArt Association, which makes the decisions about the processing of your data.
• Processor: a third party that processes data on behalf of the Controller.
• Data Protection Officer (DPO): the contact point between the Controller, data subjects, and the Brazilian Data Protection Authority (ANPD).

The controller responsible for processing your personal data is WFUGISSE ESTUDIO FOTOGRAFICO LTDA (FineArt Association), registered under CNPJ No. 56.209.043/0001-36, headquartered at Av. Afonso Pena, 394, loja 27B, Petrópolis, Natal/RN. For any questions about this Policy or the processing of your data, use the channels indicated in section 13.

We collect personal data in different ways, depending on how you interact with the platform:

a) Data you provide directly:

• identification and contact data: first name, last name, username, email, phone (WhatsApp);
• CPF, required from members residing in Brazil;
• declared location: country and state;
• profile data: profile picture, cover image, biography, and social media handles;
• submitted content: photographs entered into contests, titles, descriptions, and comments;
• access credentials: password (stored securely, with no access to its original content).

b) Data collected automatically: as you browse the platform, we collect data such as your device's internet address (IP), approximate access region, language, cookies, and information about your browsing.

c) Payment-related data: payments are processed by a specialized company (Stripe). We do not have access to your full card details; we store only the information needed to identify and manage your subscription.

Your data is collected when you register; complete or update your profile; take part in a contest and submit photographs; make payments; and browse the platform. Some data is provided directly by you, while other data is generated automatically as a result of using the services.

We process your personal data for the following purposes, each grounded in a legal basis set out in the LGPD:

• Creating and managing your account and profile — legal basis: performance of a contract.
• Enabling contest participation and announcing results — legal basis: performance of a contract and legitimate interest in promoting participants.
• Processing subscriptions and payments — legal basis: performance of a contract and compliance with a legal obligation.
• Sending communications about contests, renewals, and operational notices — legal basis: performance of a contract.
• Sending marketing communications and news — legal basis: consent, which may be withdrawn at any time.
• Platform security and fraud prevention — legal basis: legitimate interest.
• Compliance with legal, tax, and regulatory obligations — legal basis: compliance with a legal obligation.

Cookies are small files stored on your device. We use:

• Necessary cookies: essential for the platform to work, such as maintaining your login session;
• Analytics cookies: let us understand, in aggregate, how the platform is used, and are enabled only with your consent.

You may accept, reject, or manage your preferences at any time through the cookie notice shown on the platform. We also use approximate geolocation by internet address (IP) to present the platform in the appropriate language.

We share only the data strictly necessary with processors that enable our services, always in accordance with the LGPD:

• Stripe — secure payment processing;
• Email delivery provider — sending operational communications and, with consent, marketing;
• Cloud storage provider — storage of images and files;
• Google Analytics — usage analytics, only with your consent;
• IP geolocation provider — identifying the approximate region to set the language.

We may also share data to comply with a legal obligation, court order, or request from a competent authority, as well as in a corporate reorganization, in which case this Policy will be observed. We do not sell your personal data.

Some of our processors store and process data on servers located outside Brazil. In such cases, we adopt the safeguards required by the LGPD to ensure your data maintains an adequate level of protection, regardless of the country where it is processed.

We keep your personal data for as long as necessary to fulfill the purposes described in this Policy and while your account remains active. Once the relationship ends, certain data may be kept for a longer period to comply with legal, tax, or regulatory obligations, or for the regular exercise of rights. Once the periods and purposes are exhausted, the data is deleted or anonymized.

We adopt appropriate technical and organizational measures to protect your data against unauthorized access and accidental or unlawful destruction, loss, alteration, communication, or dissemination. These measures include extra protection for data such as the CPF, secure connections, protected password storage, permission-based access control, and audit trails. Although we use our best efforts, no system is entirely secure, so we recommend that you also keep your credentials confidential.

The platform is intended for professionals aged 18 or over. We do not knowingly collect data from children and adolescents to create accounts. When submitted content depicts a child or adolescent, the user declares that they hold authorization from the legal guardians, in accordance with Law No. 15.211/2025 (Digital ECA), as detailed in the Terms of Use.

Under article 18 of the LGPD, you have the right, at any time and upon request, to:

• confirm the existence of processing of your data;
• access your data;
• correct incomplete, inaccurate, or outdated data;
• request the anonymization, blocking, or deletion of unnecessary or excessive data, or data processed unlawfully;
• request the portability of your data to another provider;
• request the deletion of data processed based on consent;
• obtain information about the entities with which we share your data;
• be informed about the option to withhold consent and the consequences of refusal;
• withdraw consent.

You may exercise your rights directly from your account area — where you can access, correct, and export your data, and request account deletion — or by contacting the FineArt Association Team at fineartassociation@gmail.com. We will respond within the timeframes set by law. You may also lodge a complaint with the Brazilian Data Protection Authority (ANPD).

This Policy may be updated at any time due to legislative changes, improvements to our services, or privacy practices. The current version and the date of the last update appear at the top of this page. For significant changes, we will notify you through appropriate means and may request renewed consent where required by law.