Privacy policy

1. Who processes the data

Pactaris is a product of Firmaris Group, which operates the platform. This Policy applies to senders (who create requests), participants (who sign) and visitors to this website.

Firmaris Group's role (controller or processor) depends on the case. In general, for account and website data we act as controller; for the data of participants and documents entered by the organization that uses the platform, the role will be defined in the contractual relationship with that organization.

2. Data we process

We process, as applicable:

• Senders: name, e-mail, access credentials and second authentication factor; session data (IP address and browser); requests created, titles and messages to participants.
• Participants: name and e-mail provided by the sender; on access, IP address, browser (user agent), date and time and the process events (link opened, code requested and verified, document displayed, acceptance or refusal, with the reason when provided); declared name, chosen mode and signature image (drawing or typed name, without speed, pressure or trajectory), with its hash; the acceptance text and its version.
• Documents: the content of the uploaded PDF and the files generated from it (evidence report, event log, manifest, final package), plus the hashes. The document may contain personal data of any person, depending on what the sender uploads.
• Messages: the invitation and code e-mails sent to participants and the correspondence you send us through the contact e-mail.
• Website visitors: technical web server access records (such as IP address, date and time, page and browser), used for security and operation.

3. What we do not collect

We do not collect biometrics, nor participants' CPF or other identity documents, and this website does not use advertising cookies, third-party analytics tools or trackers.

4. Why we use it and on which legal basis

• Providing the service: creating and conducting requests, sending invitations and codes, recording acceptance and generating the sealed package. Bases: performance of a contract or of preliminary procedures (LGPD, art. 7, V) and, for participants, legitimate interest in producing and preserving evidence of the act (art. 7, IX).
• Security and fraud prevention: authentication, attempt limits, access records and integrity checks. Basis: legitimate interest (art. 7, IX).
• Keeping evidence: preserving proof of the signing process for the possible regular exercise of rights (art. 7, VI) and to comply with legal obligations, where they exist (art. 7, II).
• Handling requests and messages sent to the contact e-mail. Basis: legitimate interest and, where applicable, performance of preliminary procedures.
• Improving the service in aggregate form and without identifying people, where possible.

The bases may vary according to the contractual relationship with each organization and will be confirmed in the final version of this Policy.

5. Who we share it with

We do not sell personal data nor use it for advertising. We share only what is necessary with:

• Infrastructure processors acting under our instructions: server hosting, database, file storage, backups and e-mail delivery. The list of these suppliers can be provided on request.
• The sender and participants of the same request: the evidence report and the final package include participants' name, e-mail, IP address and browser, and may be made available to those who take part in the request.
• Public authorities, when there is a legal obligation or a valid order.
• The public verification portal, which shows only the status, the organization, the number of signatures and the seal key; it does not show content or e-mails, and the file uploaded for checking is not stored.

6. International transfer

Part of the infrastructure, including file storage, is located outside Brazil (Frankfurt region, Germany). In these cases the transfer follows the hypotheses and safeguards of art. 33 of the LGPD, and the details will be handled in the contract with each organization.

7. How long we keep it

The retention period has not been defined yet. Until then, nothing is deleted automatically. Documents and evidence are kept for as long as the purpose of the request lasts, and the period per document type will be defined by contract with each organization, considering the applicable legal obligations and limitation periods.

Deletion is carried out on a request authorized by an administrator of the organization, with a record of the request (who authorized it, reference, reason and technical identifiers, without content, e-mails or titles). It removes the data from the database and the files from storage and is followed by handling of the backups, which follow their own short cycle.

Some limits must be clear: copies kept by the sender or participants (such as the downloaded package and the e-mails received) are beyond our reach; copies kept by the cloud provider may persist for a window defined in its plan; and, since the seal and the public key remain published, copies of the package remain verifiable outside Pactaris even after deletion. After deletion, the verification code is no longer recognized in the portal.

8. Security

We adopt proportionate technical and organizational measures, including: encrypted connections (HTTPS), password and second factor for the sender dashboard, individual links and one-time codes with attempt limits, private file storage, separation of credentials by function, digital seal and event chaining, backups and periodic integrity checks. No system is entirely immune to failures; in case of an incident with relevant risk, we will act as required by law.

9. Your rights

Under art. 18 of the LGPD, you may request: confirmation that processing exists; access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary data or data processed in non-compliance; portability; information about sharing; information about the possibility of not consenting and its consequences; and withdrawal of consent, when that is the basis. You may also object to processing carried out under a consent-exempt hypothesis if the law is breached.

To exercise your rights, write to contato@firmaris.com.br. We may ask for information to confirm your identity. When data is processed on behalf of an organization, we may forward the request to it. Some requests may be limited when retention is necessary to comply with a legal obligation or to exercise rights, and we will explain why.

10. Storage in your browser

This website stores in your browser only your preferences: the theme (light, dark or automatic) and the language, in local storage, and the language also in a preference cookie, so the right version opens. We do not use tracking cookies. The Pactaris app uses a session cookie required for sign-in.

11. Children and teenagers

Pactaris is not directed at children and teenagers.

12. Changes to this Policy

We may update this Policy, especially on the move from the pilot to general availability. The version and update date appear at the top of this page.

13. Contact

Questions, requests and complaints about privacy: contato@firmaris.com.br. You may also contact Brazil's National Data Protection Authority (ANPD).