CNPJ Data

    LGPD - Brazilian General Data Protection Law

    How CNPJ Data meets the requirements of Law No. 13,709/2018.

    What is the LGPD?

    The Brazilian General Data Protection Law (Law No. 13,709/2018) regulates the processing of personal data, including on digital platforms like CNPJ Data.

    The LGPD protects the rights of freedom, privacy, and personal development, establishing rules for the collection, use, storage, and sharing of personal data.

    CNPJ Data and the LGPD

    CNPJ Data handles two groups of information differently: public business data, which is organized and made available in searches and spreadsheets, and personal data provided by users for registration, authentication, payment, and support.

    Nature of the data processed

    Our platform obtains public business data from official sources, especially the database of the National Registry of Legal Entities (CNPJ — Brazilian company registry ID), of the Ministry of Finance, through Receita Federal (Brazil's Federal Revenue Service). We process and structure this information to make searches and B2B prospecting easier. The partner list is available in API queries: partner identification data is masked in the public lookup, while the paid API returns the data available to authenticated access.

    Legal bases for processing

    Processing may rely on the following legal bases, depending on the purpose:

    • Contract performance: To create and manage accounts, authenticate users, and provide searches, spreadsheets, credits, and support;
    • Compliance with a legal obligation: To meet tax, accounting, and regulatory requirements;
    • Legitimate interest: For security, fraud prevention, operational improvement, and the recording of technical and commercial funnel events, while respecting data subjects' rights;
    • Consent: When a specific purpose requires prior authorization, such as certain third-party technologies or communications.

    Users' registration data

    In addition to the public business data made available, we process user data to:

    • Allow access to the platform;
    • Process payments;
    • Send service-related communications, when applicable;
    • Provide technical support.

    Security Measures

    We implement a range of technical and organizational measures to ensure data security:

    • Passwords stored as bcrypt hashes, never kept in plain text;
    • Use of a JWT token valid for 7 days for the authenticated session;
    • Use of HTTPS for all communications with the API;
    • Access to data limited according to account features and permissions;
    • Technical measures compatible with the operation to reduce the risk of unauthorized access.

    Guaranteed Rights

    In accordance with the LGPD, we guarantee data subjects:

    • Confirmation of the existence of processing;
    • Access to the data;
    • Correction of incomplete, inaccurate, or outdated data;
    • Anonymization, blocking, or deletion of unnecessary or excessive data;
    • Data portability;
    • Deletion of data processed on the basis of consent;
    • Information about data sharing;
    • Withdrawal of consent.

    Frequently Asked Questions about the LGPD

    What is the difference between personal data and public business data?

    Personal data is information related to an identified or identifiable natural person. The business data made available by CNPJ Data is of public origin and refers mainly to legal entities. The partner list is available in API queries: partner identification data is masked in the public lookup, while the paid API returns the data available to authenticated access. Some business contacts may allow indirect association with an individual and are therefore handled with the applicable protective measures.

    How can I request the deletion of my data from the platform?

    Registered users can request the deletion of their registration data via contato@cnpjdata.com.br. Please note that the business data made available comes from official public sources, and we follow current legislation regarding its availability.

    Does CNPJ Data have a Data Protection Officer (DPO)?

    Currently, there is no formally appointed Data Protection Officer. Requests and questions about the processing of personal data can be sent to contato@cnpjdata.com.br.

    How is data handled in the event of a breach?

    If a security incident is identified that may pose a relevant risk or damage, we will assess the necessary measures and the communications required by applicable law, including to the National Data Protection Authority (ANPD) and to data subjects, where appropriate.