Privacy Policy

1. General provisions, scope and coverage

Lean Institute Brasil, a legal entity governed by private law, duly registered with the CNPJ (Brazilian corporate taxpayer registry) under no. 02.918.808/0001-88, headquartered at Alameda Rio Negro, n. 503, Sala n. 2.020, Alphaville Centro Industrial e Empresarial/Alphaville, Barueri/SP, Brazil, ZIP code 06454-000, hereby establishes this Privacy and Personal Data Protection Policy, in accordance with applicable regulations, including the LGPD (Brazilian General Data Protection Law, Law no. 13,709/2018).

This Policy applies to:

• Users of the institutional website;
• Students of in-person or distance-learning (e-learning) educational programs;
• Companies that contract corporate training;
• Partners, suppliers and stakeholders;
• Event attendees;
• Subscribers of recurring plans;
• Users of digital platforms maintained by Lean.

2. Identification of the controller

• Controller: Lean Institute Brasil
• CNPJ: 02.918.808/0001-88
• Address: Alameda Rio Negro, n. 503, Sala n. 2.020, Alphaville Centro Industrial e Empresarial/Alphaville, Barueri/SP, Brazil, ZIP code 06454-000

3. Foundations and principles

Data processing fully complies with the LGPD, adopting:

• Privacy by Design
• Privacy by Default
• Accountability
• Proportionality
• Data minimization

4. Categories of data processed

4.1 Identification data: Name, CPF (Brazilian individual taxpayer ID), RG (ID card), email, phone, company, job title, address.

4.2 Corporate data (B2B – business-to-business – environment): Data of legal representatives, employees nominated by the contracting company, and corporate billing data.

4.3 Educational data (e-learning):

• Course history
• Module progress
• Assessments
• Certificates
• Forum participation
• Platform access logs

4.4 Financial data: Information for billing, invoices, recurring subscriptions and refunds.

4.5 Browsing data: Cookies, IP address, device identifiers.

4.6 Sensitive data: Only when strictly necessary, under a specific legal basis.

5. Purposes of processing

5.1 Performance of contracts:

• Management of corporate training
• Administration of corporate classes
• Operation of e-learning platforms
• Management of recurring subscriptions

5.2 B2B business management:

• Corporate reports for contracting companies
• Monitoring of aggregate performance
• Consolidation of anonymized statistical data

5.3 Corporate marketing:

• Sending technical content
• Institutional invitations
• Strategic information
• (Subject to consent and opt-out)

5.4 Security and compliance:

• Fraud prevention
• Audit logs
• Compliance with regulatory obligations

6. Legitimate interest and impact assessment

Where applicable, Lean will carry out:

• Legitimate Interest Assessment (LIA)
• Data Protection Impact Assessment (DPIA)

7. Data sharing

Data may be shared with:

• Technology processors (cloud hosting)
• Payment gateways
• Educational platforms
• Analytics tools (statistical analysis)
• Law firms and auditors
• Public authorities

All contracts contain data protection clauses. We do not sell databases.

8. International transfer

If there is any international transfer, the safeguards set forth in articles 33 to 36 of the LGPD will be adopted, including:

• Standard contractual clauses
• Appropriate safeguards
• Jurisdiction risk assessment

9. Information security

We adopt:

• Encryption at rest
• Encryption in transit
• Role-based access control
• Periodic vulnerability testing
• Incident Response Plan

10. Security incidents

In the event of a relevant incident:

• Notification to the Brazilian National Data Protection Authority (ANPD)
• Notification to the affected data subjects
• Immediate corrective measures

11. Retention

Data will be stored:

• For the contractual term
• For the legal tax/accounting retention period
• For the regular exercise of rights

After that:

• Deletion
• Anonymization
• Access restriction

12. Data subjects' rights

Under article 18 of the LGPD:

• Access
• Correction
• Deletion
• Portability
• Withdrawal of consent
• Information about sharing

Requests may require identity verification.

13. Automated decisions

We do not make decisions based solely on automated processing that produce significant legal effects. Should we start doing so, the right to human review will be guaranteed.

14. Governance and audit

Lean maintains:

• Records of processing activities (article 37 of the LGPD)
• Internal governance program
• Periodic audits
• Ongoing employee training

15. Updates

• Version updated on February 24, 2026.
• Last update: February 24, 2023.