Privacy policy

Data collected

• Correspondence. Email address, name if given, and the content of any message sent to the support address.
• Purchase data. For orders placed directly, the email address, the items ordered, the transaction reference and the country declared for tax purposes. Card numbers are never received or stored here; payment details are handled entirely by the payment processor.
• Technical data. Server and edge logs recording IP address, user agent, requested page, referrer and timestamp, generated automatically when a page is served.
• Measurement data. Where advertising measurement is in use, aggregated event data about page views and purchases, as described under cookies below.

No special categories of data are requested, and none should be sent by email. Daywork does not knowingly collect data from anyone under 18.

Purposes and legal bases

• Answering messages and providing support — performance of a contract or preliminary procedures at the request of the data subject (LGPD art. 7, V; GDPR art. 6(1)(b)).
• Processing orders, delivering purchased material and handling refunds — performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
• Keeping tax and accounting records of transactions — compliance with a legal obligation (LGPD art. 7, II; GDPR art. 6(1)(c)).
• Security, fraud prevention and service integrity through server logs — legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• Advertising measurement and non-essential cookies — consent (LGPD art. 7, I; GDPR art. 6(1)(a)), withdrawable at any time.

Retention

• Support correspondence: up to 24 months after the exchange closes.
• Order and transaction records: for the period required by Brazilian tax and commercial law, at least five years.
• Server and edge logs: up to 90 days, except where a log is preserved for an open security investigation.
• Measurement data: retained by the relevant provider under its own schedule, and not kept separately by Daywork.

Data are deleted or irreversibly anonymised at the end of the applicable period.

Sharing

Personal data are never sold, rented or traded. Data are shared only with providers acting as operators or processors on documented instructions: the hosting and content delivery provider that serves this site, the email provider, the payment processor, and the accounting service that keeps the tax records. Data may also be disclosed where required by law or by a competent authority.

International transfers

Hosting, email and payment infrastructure are located outside Brazil, principally in the United States and the European Union, so serving this site and answering a message involves transferring data internationally. Transfers rely on the mechanisms available under LGPD arts. 33 to 36 and, for data subjects in the European Economic Area and the United Kingdom, on standard contractual clauses or an adequacy decision as applicable. A copy of the mechanism relied on for a given provider can be requested at the support address.

Cookies

This site sets no cookies of its own for analytics or personalisation. Where an advertising measurement tag is active, it is loaded only after consent is given through the notice shown on first visit, and consent can be withdrawn by clearing site data in the browser or by writing to the support address. Strictly necessary cookies used for security and load balancing by the content delivery provider may be set without consent, as permitted for essential operation.

Browsers can be configured to refuse cookies generally. Refusing them does not restrict access to any article on this site.

Rights of the data subject

Under LGPD art. 18 and GDPR arts. 15 to 22, a data subject may request confirmation of processing, access to the data, correction of incomplete or inaccurate data, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about entities with which data have been shared, information about the consequences of refusing consent, withdrawal of consent, objection to processing based on legitimate interests, and restriction of processing.

Requests go to support@daywork.pro from the address on record and are answered within 15 days under the LGPD and within one month under the GDPR, extendable where the law allows. Identity may need to be confirmed before a request is carried out.

Complaints

A data subject in Brazil may complain to the Autoridade Nacional de Proteção de Dados (ANPD). A data subject in the European Economic Area or the United Kingdom may complain to the supervisory authority of their country of residence. Raising a concern at the support address first is welcome but not required.

Security and changes

Access to personal data is restricted to those who need it, transport is encrypted, and administrative accounts require multi-factor authentication. No system is perfectly secure, and no assurance of absolute security is offered. Material changes to this policy are published on this page with a revised date at the top.