1. Introduction to our Privacy Policy
Z-API Omni (“we”, “our” or the “Company”), registered under CNPJ no. 33.269.419/0001-00, headquartered at Av. João Paulino Vieira Filho, 672, 1º Andar, Zona 01, CEP 87020-015, Maringá/PR, Brazil, in order to demonstrate its commitment to Privacy and Data Protection, hereby establishes this Privacy Policy (the “Policy”).
2. Purpose
This Policy aims to explain, in a simple and accessible way, how Z-API Omni processes personal data — that is, how it collects, shares, stores it and so on — in compliance with applicable data protection laws.
Our commitment is to protect the privacy and security of the information provided by data subjects when using our services, ensuring a reliable and secure experience. This Policy details the types of data collected, the purposes for which they are used, the rights of data subjects and the measures implemented to ensure the confidentiality and integrity of this information.
This Policy may be updated from time to time to reflect internal procedures or legal requirements.
3. Definitions
Because we value transparency and communication, below is a glossary of technical terms and concepts related to privacy and data protection that may be used in this Policy:
- Processing: any operation performed with personal data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination or extraction.
- Cookies: small files sent by websites and saved on your devices that store preferences and a few other pieces of information in order to personalize your browsing according to your profile.
- Data subject/User: the natural person to whom the personal data being processed refers, such as customers, visitors and other people who interact with the website.
- Personal data: any information relating to an identified or identifiable natural person.
- Anonymization: the use of reasonable technical means available at the time of Processing through which data loses the possibility of being associated, directly or indirectly, with an individual.
- Purpose: the reason for which personal data will be processed. The purpose must be legitimate, specific, explicit and communicated to the data subject.
- Controller: a natural or legal person, governed by public or private law, responsible for decisions regarding the processing of personal data.
- Processor: a natural or legal person, governed by public or private law, that processes personal data on behalf of the controller.
- Data Protection Officer (DPO): the person appointed by the controller and processor to act as a communication channel between the controller, data subjects and the Brazilian National Data Protection Authority (ANPD).
- Brazilian General Data Protection Law (LGPD): Law No. 13,709 of August 14, 2018, which governs the processing of personal data in Brazil, by digital or physical means, by natural persons or legal entities governed by public or private law, with the aim of protecting the fundamental rights of freedom and privacy and the free development of the personality of the natural person.
4. About the personal data provided
All personal data provided to Z-API Omni is handled with the highest levels of security and care and is used only for the purposes specified in this Policy. The data provided to the Company depends on the process in which the Data Subject is involved.
Personal data for contracting/registering in the system
- Data collected: name; company name; CPF/CNPJ (Brazilian tax ID); phone number; email; address.
- Purpose of processing: registration to use the Platform; identification of the User/Data Subject; communication between the Company and the User; billing and/or sending correspondence.
- Legal basis: performance of a contract or of preliminary procedures related to a contract, art. 7, V, LGPD.
Personal data for financial routines
- Data collected: full name; CPF/CNPJ; subscribed plan; bank details.
- Purpose of processing: identification and payment management of the User/Data Subject; issuing invoices; subscription management.
- Legal basis: performance of a contract or of preliminary procedures related to a contract, art. 7, V, LGPD.
Personal data for Z-API Omni newsletters and updates
- Data collected: full name; email.
- Purpose of processing: sending Z-API Omni newsletters and updates to the email registered for the newsletter.
- Legal basis: legitimate interests of the controller or third parties, art. 7, IX, LGPD.
Personal data from the contact form
- Data collected: name of the person in charge; company name; email; phone; state and city.
- Purpose of processing: providing a contact channel on the Company’s website for the general public to obtain information about plans and tailored options for the User’s business; customer support.
- Legal basis: performance of a contract or of preliminary procedures related to a contract, art. 7, V, LGPD; legitimate interests of the controller or third parties, art. 7, IX, LGPD.
5. Data collected by Z-API Omni
The data listed above refers to data provided directly by the Data Subject to the Company. However, some other personal data may be processed by the Company:
- Mobile device data from accesses to the digital platform and other information, such as the type and version of the browser used.
- Log data.
- IP address.
- Email and instant messaging systems — services used to maintain communication between the Data Subject and the Company, such as social networks, website chat, email and WhatsApp.
- Cookie data — described in section 6.
In addition to the purposes defined above, the Company may process personal data for any of the following purposes:
- Proper performance of its business, such as providing and maintaining the API services as contracted, managing accounts and authentication, improving the functionality and performance of the API, developing new features based on the Data Subject’s behavior and improving the algorithms and efficiency of the service provided.
- Detecting and preventing fraud or unauthorized use of the service, in order to protect the integrity of the Platform.
- Diagnosing and resolving technical issues.
- Generating internal reports on Platform performance.
- Complying with legal obligations or applicable legal requirements, whether in response to legal proceedings or a request from a competent legal authority — such as the Judiciary — or to protect the rights of data subjects, their privacy, their physical or material integrity, to comply with the terms of any necessary agreements or contracts, or with our terms.
6. Use of cookies by Z-API Omni
Cookies are small files sent by websites and saved on your devices that store preferences and a few other pieces of information in order to personalize your browsing according to your profile. By accepting the cookie banner or using the features of the Z-API Omni website, you allow the Company to use cookies to monitor your use of the website or online platform. The Company uses cookies on its website for different purposes:
- A) Necessary cookies: essential for the website or online platform to work, allowing you to browse and access the basic features of our site.
- B) Analytics cookies: allow us to analyze visitor behavior patterns. This information is used to improve the overall experience or identify areas of the website that need maintenance. It is anonymous and used for statistical purposes only.
- C) Functionality cookies: used by Z-API Omni to store your preferences for useful features, so you don’t need to reconfigure the site on every visit. If the user chooses to disable these cookies, some or all of these features may not work properly.
- D) Performance cookies: help Z-API Omni understand how its website or online platform is used and how visitors behave, allowing us to find out what works and what doesn’t and to continuously improve by monitoring and quickly fixing issues. If the user chooses to disable these cookies, Z-API Omni will not be informed of their visits to the website.
- E) Advertising cookies: set on our website by our advertising partners. When the user visits the Z-API Omni website or online platform, some third parties may also use cookies for advertising, helping provide ads more relevant to their interests based on their browsing habits. For information on third-party cookies, please refer to their respective privacy and cookie policies.
- F) Control your cookie options: the User is not required to accept the installation of cookies on their device and may block them, review previously granted permissions or enable notifications when cookies are sent to their device.
Data Subjects can also change cookie settings directly in their browser:
7. Sharing of personal data
Z-API Omni may share Data Subjects’ personal data to provide and operate services and to achieve a legitimate and specific purpose. We will take the measures available on the market and within our reach to ensure that all information security standards are observed and that processing is carried out in strict accordance with the purposes described here. Accordingly, we may share your personal data with:
- Judicial, administrative or government authorities: upon request, requisition or court order, Z-API Omni may share personal data with the competent authorities. Only the data necessary to meet the request will be shared, or when necessary for us to present a defense or exercise a right.
- Professional consultancy: Z-API Omni may rely on outsourced help for certain specific activities, such as accounting services for tax records.
Personal data will only be shared with third parties to achieve a legitimate, specific purpose previously disclosed to the Data Subject in our System or in this Policy.
8. Personal data retention period
Your personal data and other information will be stored only for as long as strictly necessary to fulfill the purpose for which it was obtained or for the periods provided for in legal and contractual provisions. Regardless of consent or a deletion request, the LGPD allows the Company to retain personal data of customers, service providers and the general public in the following situations:
- Compliance with legal or regulatory obligations, such as keeping tax documents for five years.
- Transfer to a third party, respecting your rights and the provisions of data protection and privacy laws.
- Exclusive use, with access by third parties prohibited, provided the data is anonymized.
9. Storage of personal data
Z-API Omni ensures that all information and personal data provided will be handled according to the highest security standards so that none of it is subject to destruction, loss, alteration or improper disclosure. To this end, Z-API Omni adopts several information security measures:
- Encryption in transit: all data transmitted between the customer and Z-API Omni servers is protected by encryption protocols such as TLS (Transport Layer Security), ensuring that information is encoded and secure against interception.
- Encryption at rest: data stored on Z-API Omni servers is encrypted using techniques such as AES (Advanced Encryption Standard), ensuring that, even in the event of improper access, the data remains unreadable without the appropriate keys.
- Protection against unauthorized access: Z-API Omni implements strict access controls to its systems and internal directories, with granular permissions. Only authorized staff have access to the information needed to perform their duties, following the principles of least privilege and segregation of duties. Two-factor authentication (2FA) is also used.
- Intrusion protection: firewalls filter network traffic and prevent unauthorized access, along with intrusion detection and prevention systems (IDS/IPS) that monitor and respond to malicious activity.
- Environment isolation: Z-API Omni uses containers and/or virtual machines to isolate different services, preventing failures or attacks on one part of the infrastructure from affecting others.
- Backups and disaster recovery: Z-API Omni performs regular backups, enabling fast data restoration and service recovery in the event of disasters or critical failures.
- Awareness programs: educational programs are provided to customers and staff covering the risks of phishing and other forms of social engineering.
- LGPD compliance: Z-API Omni requires partner companies, service providers and suppliers that process personal data to comply with the LGPD, ensuring the absolute confidentiality of the information and personal data they have access to.
10. Your rights over your personal data
In accordance with applicable regulations on the processing of personal data, the User may, at any time, request the following rights from the Data Protection Officer:
- Confirm the existence of processing.
- Access their personal data.
- Correct incomplete, inaccurate or outdated personal data.
- Request the anonymization, blocking or deletion of unnecessary or excessive personal data, or data processed in breach of the LGPD.
- Request the portability of personal data to another service or product provider, upon express request, in accordance with the regulations of the national authority, observing commercial and industrial secrets.
- Delete or anonymize personal data processed based on their consent, except where the law allows such data to be retained on another basis.
- Obtain information about the public and private entities with which the controller has shared data.
- Obtain information about the possibility of not providing consent and the consequences of refusal.
- Revoke their consent, as applicable.
11. Contact our Data Protection Officer
If you need to contact us for any reason or wish to exercise any of your rights regarding the processing of your personal data, please contact our Data Protection Officer:
Data Protection Officer: Wagner Mendes Voltz
Email: [email protected]
If you prefer to contact us by letter or other physical means, please send your correspondence to: Av. João Paulino Vieira Filho, 672, 1º Andar, Zona 01, CEP 87020-015, Maringá/PR, Brazil.