Privacy Policy
Last updated: 05/11/2023
This policy explains what personal data we collect through this website and our engineer portal, why we collect it, who we share it with and the rights you have under the EU General Data Protection Regulation (GDPR) and Brazilian data protection law.
Who we are
The data controller is KavaShellCorp KavaShell Corp, a company registered in Brazil with its head office at EDISEN, Rua Henrique Valadares, 28 - Rio de Janeiro - RJ, 20231-030 Rio de Janeiro, Brazil.
- Registered address: Rua Henrique Valadares, 28 - Rio de Janeiro - RJ, 20231-030, Brazil
- Privacy contact: info@kavashellcorp.com
What data we collect
We collect only the data we need for the purposes below. Most of it you give us directly.
- Enquiries and quote requests: your name, company, email address, phone number, the details of your project and anything else you write in the form.
- Job applications: your name, contact details, CV, the role you apply for, your discipline, experience, location and availability, and the certificates you share with us.
- Engineer accounts: your login email and password (stored only as a secure hash), your profile, your profile photo (uploaded by our team, not by you), your contracts with us and their time frames, and your applications.
- Newsletter: your email address and whether you chose news for engineers or for clients.
- Technical data: your IP address, browser type and the pages you request, recorded in server logs to keep the site secure and working.
Some roles require medical fitness certificates. We process these only where employment or health and safety law requires it for the role, under Article 9(2)(b) GDPR, and we limit who can see them.
We do not take payments on this website and do not collect any payment card or bank details through it.
Why we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| Answering enquiries and preparing quotes and proposals | Steps taken at your request before entering a contract (Art. 6(1)(b)); our legitimate interest in replying to business enquiries (Art. 6(1)(f)) |
| Assessing job applications and checking qualifications | Steps taken at your request before entering a contract (Art. 6(1)(b)) |
| Keeping your CV to match you to future roles | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Running engineer accounts and managing contracts | Performance of a contract (Art. 6(1)(b)); compliance with employment, tax and accounting law (Art. 6(1)(c)) |
| Sending our newsletter | Your consent (Art. 6(1)(a)) |
| Keeping the website and accounts secure | Our legitimate interest in protecting our systems and users (Art. 6(1)(f)) |
We do not use your data for automated decision-making that has legal or similarly significant effects on you, and we do not sell your data.
Who we share your data with
We share data only with providers that help us run the website and our business, under contracts that require them to protect it and use it only on our instructions:
- Map display: OpenStreetMap shows our office map on the About and Contact pages and receives your IP address when the map loads
- Live chat: Smartsupp runs the chat on our public pages and stores the messages you send, any contact details you give, and technical data such as your IP address, browser and the pages you view
When you apply for a role or we propose you for a project, we share your profile and relevant certificates with the client you would work for. We may also disclose data where the law requires it, for example to public authorities.
Transfers outside the European Economic Area
Some of our providers store or process data outside the European Economic Area, including in the United States. Our database is currently hosted in the United States.
Where data leaves the EEA, we rely on an adequacy decision of the European Commission or on Standard Contractual Clauses with additional safeguards, as required by Chapter V GDPR. You can ask us for a copy of the relevant safeguards.
How long we keep your data
| Data | How long we keep it |
|---|---|
| Enquiries and quote requests | After our last contact, unless they lead to a contract |
| Job applications that do not lead to a role | After the role closes, or longer if you consent to stay in our talent pool |
| Engineer accounts and contracts | For the length of our working relationship, then as long as Brazilian employment, tax and accounting law required |
| Newsletter subscriptions | Until you unsubscribe |
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and get a copy of it
- Have inaccurate data corrected
- Have your data erased, where we no longer need it or have no legal basis to keep it
- Restrict how we use your data
- Receive your data in a portable format
- Object to processing based on our legitimate interests
- Withdraw your consent at any time, without affecting processing that took place before
To use any of these rights, email info@kavashellcorp.com. We reply within one month, which we may extend by two further months for complex requests, telling you why.
How we protect your data
We use encrypted connections, store passwords only as secure hashes, limit access to personal data to the staff who need it for their role, and keep a record of changes to engineer profiles and contracts.
Complaints
If you are unhappy with how we handle your data, please contact us first at info@kavashellcorp.com. You also have the right to complain to the Brazilian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), at dataprotection.ro, or to the authority in the EU country where you live or work.
Changes to this policy
We will update this policy when the way we use personal data changes. The date at the top shows when it last changed. Where a change is significant, we will tell engineers with an account by email.