Courtesy translation. In case of any discrepancy, the Portuguese version prevails.
Privacy Policy
This policy explains how personal data is handled on the invitation and attendance confirmation website for the Brazilian national basketball team games: which data, where it comes from, what it is used for, who it is shared with, how long it is kept and how you can exercise your rights.
1. Who is responsible for the data
The controller of the data processed on this website is Confederação Brasileira de Basketball - CBB, located at Av. Salvador Allende, 6555, Pavilhão 1, Térreo, sala 7, Barra da Tijuca, Rio de Janeiro - RJ, CEP 22783-127.
Contact for privacy matters and data subject requests: alyson.gama@basquetebrasil.org.br.
2. Scope of this policy
It applies to this website, which has two parts:
- Public page, where guests enter their personal invitation code and confirm attendance for the authorized games;
- Administration panel, with restricted access, used by the organization's staff to register invitations, follow confirmations and record ticket delivery.
It does not apply to other websites (such as the institutional website linked in the footer), to the sale or issuing of tickets by third parties, or to entry control at the arena, which follow their own rules.
3. What data we process and where it comes from
| Category | Data | Source |
|---|---|---|
| Invitation | Guest's full name; email and phone, when the organization already has them; authorized games; whether the invitation allows a companion for each game; validity; internal staff note (not shown on the public page). | Registered by the organization to issue the invitation. This data is not collected directly from you at this stage. |
| Invitation code | Personal code generated by the system. It is stored in protected form, never appears in page addresses and is not shown in lists. | Generated by the system and given to you by the organization. |
| Attendance confirmation | Email and phone (when the invitation does not have them), selected games, whether you will bring a companion, date and time of confirmation, version of the Terms of Use accepted and version of this policy displayed. | Provided by you in the form. |
| Companion | Companion's full name, per game (only when the invitation allows it). | Provided by the invitation holder (see section 10). |
| Ticket handling | Status of the confirmation (awaiting ticket, ticket sent or cancelled), ticket link for the holder and the companion (stored encrypted), date and staff member who recorded the delivery, change history and justifications. | Recorded by the organization's staff. |
| Website session | Browser session identifier and temporary link to the validated invitation (ended after 20 minutes of inactivity or 2 hours at most). | Generated by the system during use. |
| Security | IP address, used in transformed form (cryptographic digest) to limit repeated attempts; data sent to Google reCAPTCHA when the code is validated (see section 6). | Generated by your access. |
| Organization staff (panel) | Name, email, access profile, password (stored only as a cryptographic digest), two-step verification data (encrypted), recovery codes (as a digest), sessions, last access, IP address and browser in security events, and a record of actions taken (audit log). | Registered by the organization and generated by use of the panel. |
| Internal alerts and reports | Alerts to staff about new confirmations (with a reference to the confirmation and the game); CSV or PDF reports generated on demand by authorized staff with invitation or confirmation data. | Generated by the system from the data above. |
| Technical records | Application operation records (date and time, event type and internal identifiers, without email or phone). The hosting provider may also keep its own access records. | Generated by the operation of the website. |
The website does not ask for date of birth, identity documents, address, payment data or sensitive data. Being a guest is not used to infer opinions, affiliations or other personal characteristics.
4. What we use the data for and on which legal basis
| Purpose | Legal basis (Brazilian Law 13,709/2018 — LGPD) |
|---|---|
| Issue and manage personal invitations (prior registration by the organization, validity, revocation and new code). | Legitimate interest of the organization in inviting and organizing the event audience (art. 7, IX). |
| Record the attendance confirmation you request and organize ticket delivery. | Procedures related to the service requested by the data subject (art. 7, V). |
| Record the companion's name to arrange their ticket. | Legitimate interest of the organization and of the invitation holder (art. 7, IX), with the information in section 10. |
| Protect the website against abuse and automated access (reCAPTCHA, attempt limits, sessions). | Legitimate interest in the security of the service and of data subjects (art. 7, IX). |
| Keep audit and security records of the panel (who did what and when). | Legitimate interest in security and accountability (art. 7, IX) and, where applicable, compliance with a legal obligation (art. 7, II) and regular exercise of rights (art. 7, VI). |
| Manage the accounts of the staff who use the panel. | Performance of the relationship between the organization and the staff (art. 7, V) or legitimate interest (art. 7, IX), depending on the relationship. |
| Respond to requests from data subjects and authorities. | Compliance with a legal or regulatory obligation (art. 7, II). |
Consent is not used as a general justification. The acceptance of the Terms of Use requested in the form records your agreement with the rules of the service; it is not consent to the processing of data. The website does not send promotional messages and does not ask for permission to do so.
5. Required data and what happens if you do not provide it
- Invitation code and security check (reCAPTCHA): required to access the form. Without them, attendance cannot be confirmed.
- Email and phone, when the invitation does not have them: required so the organization can contact you about the ticket. Without them, the confirmation is not recorded.
- Game selection and companion answer (when the invitation allows it): required to record the confirmation for each game. The companion's name is only requested if you answer that you will bring someone.
- Acceptance of the Terms of Use: required to use the confirmation service.
6. Who the data is shared with
- Authorized staff of the organization, with individual access, two-step verification and profile-based permissions.
- Website hosting (Hostinger): the data is stored on the servers contracted by the organization. Location informed: Brasil (Campinas/SP), em servidor da Hostinger.
- Google (reCAPTCHA): when you start typing the invitation code, the website loads Google's verification. Google receives technical data about your access (such as IP address, browser and device information, interactions with the verification and its own cookies) to assess whether the access is automated. This processing follows Google's Privacy Policy and Terms of Service.
- Email service configured by the organization: used only for panel messages to staff (registration and password reset). Guests do not receive automatic emails from this website.
- Authorities, when there is a legal obligation or a valid order.
The data is not sold and is not used for advertising. The website does not use audience measurement tools or advertising pixels.
The ticket is sent by the organization's staff through the contact channels provided. This website does not send the ticket automatically.
7. International transfer
Google may process reCAPTCHA data on servers located outside Brazil, as stated in its policy.
8. How long the data is kept
- Invitations and codes: Até 3 meses após a realização do último jogo do evento. Depois desse prazo, os dados são eliminados ou anonimizados.
- Confirmations, companions, links and delivery records: Até 3 meses após a realização do último jogo do evento. Depois desse prazo, os dados são eliminados ou anonimizados.
- Audit and security records of the panel: Até 3 meses após a realização do último jogo do evento. Depois desse prazo, os dados são eliminados ou anonimizados.
- Staff accounts: Até 3 meses após a realização do último jogo do evento. Depois desse prazo, os dados são eliminados ou anonimizados.
- Server technical records: Até 3 meses após a realização do último jogo do evento. Depois desse prazo, os dados são eliminados ou anonimizados.
Some temporary data is discarded automatically: the browser's link to the invitation expires within 2 hours; records used to limit attempts are deleted after about one day; the IP address and browser kept in panel security events are removed after the configured period, while the event is kept. When staff delete a record in the panel, it no longer appears in lists and is kept for history and audit for the period indicated above.
9. How the data is protected
We use technical and administrative measures appropriate to the service, including: panel access restricted to authorized people, with two-step verification and profile-based permissions; invitation codes and passwords stored only in protected form; encrypted ticket links and secrets; audit logging of staff actions; attempt limits and verification against automated access; reports generated on demand, with no public files on the server. No measure eliminates all risks; in the event of a relevant security incident, the organization will take the measures required by law.
10. Companions
When the invitation allows a companion, the invitation holder provides the full name of the person who will go with them to each game. This name is used only to arrange the companion's ticket and access to that game, is visible to authorized staff and follows the periods in section 8.
The holder's indication is not consent on behalf of the companion. We ask the holder to share this policy with the companion. The companion may exercise the same rights described in section 11 through the privacy channel.
11. Your rights and how to exercise them
Under the LGPD (art. 18), you may request: confirmation that we process your data; access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the law; portability, as regulated; information about who the data has been shared with; and objection to processing you consider irregular. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).
How to request: send your request to alyson.gama@basquetebrasil.org.br, stating your name and the request. To protect your data, we may ask you to confirm information already in the invitation (for example, the registered email or phone). Additional documents will only be requested if they are truly necessary to confirm your identity.
Corrections to email, phone or the companion's name can also be requested through the support channel: alyson.gama@basquetebrasil.org.br. Responses follow the deadlines set by the applicable law and regulations.
Limits to deletion: some data may be kept even after a deletion request when it is necessary, for example, to comply with a legal obligation, for the regular exercise of rights or to keep security and audit records (LGPD, art. 16). In such cases, we will inform you of the reason.
12. Children and adolescents
The website does not collect the date of birth or age of guests or companions.
13. Cookies
The website uses only the cookies and technologies needed for it to work and to protect itself. We do not use analytics or advertising cookies. The details, including those of Google reCAPTCHA, are in the Cookie Notice.
14. Updates to this policy
This policy may be updated when the service or the rules change. The version and effective date are at the top of the page, and each confirmation records the version of the policy displayed at the time.