Privacy and data subject rights

The LGPD gives data subjects the right to receive a copy of everything the company holds about them (portability) and to be erased when there is no longer a reason to keep the data. This screen carries out both with one click, records who did it, when, and why — and the protocol field is your proof that the request was handled within the deadline.

The export button depends on VIEW: handing the data subject what is already theirs is reversible. The anonymize button depends on DELETE, because it de-identifies permanently. That's why whoever administers the account received export access without receiving anonymization access — a verb is granted by looking at what the button does, not at the screen's subject.

"Download the complete package" takes records, chart of accounts, centers, 24 months of receivables/payables and the attachments, in open CSV. It's the portability policy: the data is yours and leaving never depends on asking permission or paying a fee.

The employee or student the client put on the uniform contract list is also a data subject. The client of the contract decides about the data; you process it on their behalf. When the client passes on a request from the person, choose them here: the report brings their line and the record of who admitted them or changed their size; anonymizing replaces the name with a marker and erases the staff number and embroidered name. Without a request, this happens on its own 180 days after the contract ends or the person leaves (Parameters: uniform list period).

The LGPD itself (art. 16) requires data to be KEPT when another law demands its retention — payroll and tax documents have their own legal retention periods. The system applies these deadlines automatically: if the retention period has expired, it anonymizes; if not, it refuses and explains until when the data needs to exist. The refusal is also logged in the trail — refusing within the law is fulfilling the request, not ignoring it.

De-identification permanently overwrites the name, CPF, and contact information. The statistical record continues to exist (the financial and payroll history does not disappear), but the person is no longer identifiable. Confirm you have the right data subject beforehand — the screen asks for explicit confirmation precisely because there is no undo.

The export scans the tables that hold the person's data (registration, payroll, transactions, logs) and generates a single file. Deliver it to the data subject through a secure channel — the file contains exactly what the law says they have the right to receive, that is, everything.

The package comes out as a ZIP: dossie.json with all of the data subject's data, the anexos/ folder with the actual files and the index anexos.csv. Before 08/19/2026 only the index came out — and the signed contract, the receipt and the medical certificate were left behind. Under the LGPD, the attached document IS personal data: it has to come out in the portability request.

The package has a size cap (parameter EXPORT.LIMITE_ANEXOS_MB, 200 MB by default). An attachment that doesn't fit stays listed in anexos.csv with the "incluido" column set to "nao" and the reason written. A package silently truncated would be read as "everything came" — and that's exactly what can't happen in a data subject's request.

An individual supplier (the contractor, the self-employed) is a data subject: they can request a file with their data and be anonymised through this screen. Contractor network data has a retention period and is removed when it expires.

This screen is the ON-DEMAND service. Automatic deadlines (expired candidate résumés, an employee in the trash bin past the labor-law retention period, old logs) run every day in the scheduled purge, without depending on anyone remembering.

The LGPD (art. 16) allows keeping data when another law requires retention — payroll and tax documents have their own period. The screen applies those periods on its own: if the retention period has expired, it anonymizes; if not, it explains until when the data needs to exist. A refusal due to legal retention is not a system error, and it stays in the trail as ANONIMIZACAO_RECUSADA.

In the Demo prospect panel, pick the person by name or e-mail. Export dossier delivers everything we keep about them: the links requested, the screens they saw, the contact score and the access-limit warnings. Anonymize erases name, e-mail and screens from every link of that e-mail and erases the contact's data.