Privacy Policy

About this translation

This is an English translation of the Portuguese original. Cleanifly operates from Brazil and processes personal data under Brazilian law; the Portuguese version prevails in the event of any discrepancy between the two texts.

1. Definitions

For the purposes of this policy, the following definitions apply:

• Personal Data: information relating to an identified or identifiable natural person.
• Titular: the natural person to whom the personal data relates.
• Tratamento: any operation carried out on personal data.
• Controlador: the natural or legal person who decides how personal data is processed.
• Operador: the natural or legal person who processes personal data on behalf of the controller.

2. Roles and responsibilities

2.1. The Client (the hospital laundry) is the Controller of the personal data entered into the Cleanifly platform.

2.2. Cleanifly acts as Processor, handling the data according to the Controller's instructions and the provisions of this Privacy Policy.

2.3. The Client is responsible for obtaining consent or any other lawful basis for processing the personal data it enters into the platform.

3. Data we collect

3.1. User account data:

• Full name
• E-mail address
• Job title or role
• Contact phone number
• Access credentials (username and encrypted password)

3.2. Platform usage data:

• Access logs
• IP address
• Browser type
• Operating system
• Date and time of access
• Pages visited
• Actions performed on the platform

3.3. Operational data:

• Collection details (date, time, location)
• Weighing data (dirty weight, clean weight)
• Delivery and return details
• Operational flow records

3.4. Financial data:

• Amounts charged for services rendered
• Invoicing records
• Transaction history related to the laundry service

4. How we use the data

4.1. We use the data we collect to:

a) Provide and maintain the Service:

• Allow access to the platform
• Process collection, weighing and delivery operations
• Generate operational and financial reports

b) Improve the Service:

• Analyse usage patterns to improve the user experience
• Identify technical problems and ship improvements
• Develop new features

c) Security and compliance:

• Detect and prevent fraudulent activity
• Protect against unauthorised access
• Meet legal and regulatory obligations

d) Technical support:

• Answer questions and requests
• Resolve technical problems
• Provide training and guidance

4.2. Personal data will be processed:

• For as long as necessary to fulfil the purposes described in this policy
• In accordance with the Client's (Controller's) instructions
• In compliance with applicable legislation

5. Data sharing

5.1. Cleanifly may share personal data in the following circumstances:

a) With the Client (Controller):

As part of the normal provision of the service;

b) With service providers:

Companies engaged to help run the platform (hosting, monitoring, technical support);

c) To meet legal obligations:

Where required by law, regulation or court order;

d) In the event of a merger or acquisition:

If Cleanifly is acquired by or merged with another company, your data may be transferred to the new entity under the same protection guarantees.

5.2. In every sharing scenario, Cleanifly:

• Requires third parties to adopt adequate data protection measures
• Shares only the data strictly necessary for the specific purpose
• Keeps records of sharing operations

5.3. Cleanifly does not sell, rent or trade personal data under any circumstances.

6. International data transfers

6.1. Cleanifly uses cloud infrastructure (Render.com) that may process data on servers located outside Brazil.

6.2. Where data is transferred internationally, we ensure that:

• The destination countries provide a level of protection adequate under the LGPD; or
• Specific contractual clauses are adopted for the transfer; or
• The data subject's specific consent is obtained.

6.3. Regardless of where the servers are located, we apply the same security measures and meet the requirements of Brazilian data protection law.

7. Data security

7.1. Cleanifly implements technical and organisational measures to protect personal data, including:

a) Infrastructure security:

• Encryption of data in transit (SSL/TLS)
• Encryption of sensitive data at rest
• Firewalls and intrusion detection systems
• Isolated environments per client (separate instances)

b) Access controls:

• Multi-factor authentication
• Strong password policies
• Principle of least privilege
• Periodic access reviews

c) Business continuity:

• Automatic weekly backups
• Disaster recovery procedures
• Continuous availability monitoring

d) Organisational security:

• Security training for the team
• Clear desk and clear screen policies
• Incident response procedures

7.2. Despite every effort, no system is completely secure. In the event of a data breach that may pose a risk to the rights and freedoms of data subjects, Cleanifly will:

• Notify the Client (Controller) within 24 hours
• Assist in investigating and mitigating the incident
• Provide the information the Controller needs to meet its own legal obligations

8. Data retention and deletion

8.1. Retention period:

• Active user data: for the entire term of the contract with the Client
• Operational data: as required by law and operations, typically 5 years
• Access logs: at least 6 months, as required by the Brazilian Internet Civil Framework

8.2. Data deletion:

• After the contract ends, data remains available for the Client to export for 30 days
• After that period, data is anonymised or deleted, except where it must be kept to meet a legal obligation
• Backups containing deleted data are automatically rotated out within 90 days

8.3. The Client may request early deletion of specific data, provided there is no legal or contractual impediment.

9. Data subject rights

9.1. Cleanifly recognises and respects the rights of data subjects as set out in the LGPD, including:

• Confirmation that processing takes place
• Access to the data
• Correction of incomplete, inaccurate or outdated data
• Anonymisation, blocking or deletion of unnecessary or excessive data, or data processed unlawfully
• Data portability
• Deletion of data processed on the basis of consent
• Information about data sharing
• Information about the option to withhold consent
• Withdrawal of consent

9.2. Exercising these rights:

• As a Processor, Cleanifly forwards data subject requests to the Client (Controller)
• Data subjects may also contact the Client directly
• Cleanifly provides the Client with technical support to fulfil data subject requests

9.3. Requests are handled free of charge, except where they are manifestly unfounded, excessive or repetitive.

10. Cookies and similar technologies

10.1. The Cleanifly platform uses cookies and similar technologies to:

• Keep the user session active
• Remember preferences and settings
• Collect usage statistics to improve the service
• Detect and prevent fraudulent activity

10.2. Types of cookies:

• Essential cookies: required for the platform to work at all
• Preference cookies: store the user's settings
• Analytics cookies: collect information about how the platform is used
• Security cookies: help detect suspicious activity

10.3. Users can control cookie acceptance through their browser settings, though this may affect how the platform works.

11. Children's privacy

11.1. The Cleanifly platform is not intended for people under 18.

11.2. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected personal data from someone under 18, we will take steps to delete that information as quickly as possible.

12. Changes to this policy

12.1. This Privacy Policy may be updated from time to time to reflect changes in our data processing practices or in applicable legislation.

12.2. For significant changes, we notify Clients through a notice on the platform or by e-mail, at least 30 days in advance.

12.3. Continuing to use the Service after a change constitutes acceptance of the new Privacy Policy.

12.4. We recommend that Clients review this policy periodically to stay aware of how we protect their information.

13. Data protection officer

13.1. For questions about the processing of personal data, or to exercise your rights as a data subject, you can contact our Data Protection Officer (DPO):

• E-mail: lucas.oliveira@cleanifly.com
• Phone: (81) 99405-1449
• Address: Recife, Pernambuco

13.2. Cleanifly's Data Protection Officer acts as the point of contact between the company, Clients, data subjects and the Brazilian National Data Protection Authority (ANPD).

14. Governing law and jurisdiction

14.1. This Privacy Policy is governed by and construed in accordance with the laws of the Federative Republic of Brazil.

14.2. Any dispute arising from this Policy is subject to the courts of Recife, Pernambuco, Brazil, to the exclusion of any other.