Privacy Policy

Website Operator

ICF Rio de Janeiro
Rua Lopes Trovão, 233
Icaraí – Niterói – RJ
CEP 24.220-070, Brazil
[email protected]

For the entity’s full identification details (legal name, CNPJ, legal representative), please see our Imprint.

Responsible for Content & Data Processing

ICF Rio de Janeiro
Rua Lopes Trovão, 233
Icaraí – Niterói – RJ
CEP 24.220-070, Brazil
[email protected]

Data Protection Officer (DPO)

Paulo André Carneiro Campos Cordeiro ICF Rio de Janeiro, [email protected]]

Appointing a Data Protection Officer with a publicly disclosed contact is a requirement under art. 41 of Brazil’s LGPD (Law No. 13,709/2018).

What is the ICF Movement?

ICF is a Christian church on a biblical foundation. We grew out of the dream of shaping church to be dynamic, close to real life, and in tune with the times.

Legal Basis

The information about each tool used in this Privacy Policy is processed exclusively to handle your respective request. More information is available in the chapter «Legal Basis for Data Processing».

✅ Transparency

We want you to be able to understand at any time what happens to your data. That’s why we openly describe in this policy which tools we use and why (art. 6, VI, LGPD).

🎯 Purpose Limitation

We collect and use personal data only for the purpose intended – for example, for contact requests, newsletter sign-up, analysis of website use, or processing donations (art. 6, I, LGPD).

➖ Data Minimization

We collect and process only as much data as necessary. Where anonymous or pseudonymous use is possible, we use it (art. 6, III, LGPD).

🔐 Security

Your data is protected with us. We use technical and organizational measures to protect it against loss, misuse, or unauthorized access (art. 6, VII, and art. 46, LGPD).

🕐 Storage Limitation

We store personal data only for as long as it’s needed for the respective purpose, or as long as legal retention obligations exist (art. 15 and 16, LGPD).

🌍 Lawfulness

Our data processing is always based on one of the legal grounds set out in art. 7 of the LGPD: be it your consent, compliance with a legal obligation, or legitimate interest. We do not make decisions based solely on automated processing that produce legal effects without the possibility of review (art. 20, LGPD).

Note: for certain data processing operations with elevated risk (e.g. processing of sensitive data), we prepare, when necessary, a Data Protection Impact Report (RIPD), in accordance with art. 5, XVII, and art. 38 of the LGPD.

📬 Contact & Forms

When you contact us through a contact form or register for an event, we process the data you entered (e.g. name, e-mail, request) to answer your inquiry or provide the requested service.

💌 Newsletter & Communication

If you sign up for our newsletter or stay in touch with us (e.g. through interest in resources or events), we store and use your contact details to send regular e-mails, inspiration, and updates.

You can unsubscribe from the newsletter at any time via the unsubscribe link in every e-mail.

💳 Donations

Donations to ICF Rio de Janeiro can be made by bank transfer/deposit, PIX, credit card, or recurring-giving platforms (see Generosity).

Payment processing may be handled by external providers (e.g. PicPay, PayPal, or contribution-management platforms such as Eklesia Online). Once you choose one of these payment services, you’ll be redirected to their platform. Their own privacy policies apply to any further processing of your data.

The data you provide (e.g. name, e-mail, amount, payment method) is processed to handle your donation and for documentation purposes (e.g. issuing receipts). Donations to religious organizations may, in some cases, allow inferences about your religious belief (a sensitive personal data category under art. 5, II, and art. 11 of the LGPD). This processing only takes place with specific, distinguished consent or where permitted by law (art. 11, I and II, LGPD).

📈 Website Use & Tracking

When you visit our website, certain technical information is automatically processed, such as:

• IP address (shortened/pseudonymized)
• Browser type and version
• Operating system
• Date and time of access
• pages visited / time spent

This data helps us run our website in a technically stable way and continuously improve it (see the section «Cookies & Tracking»).

💻 Server Logs & IT Security

When you access our pages, our hosting automatically processes server logs (e.g. IP address, date/time, requested URL, referrer, user agent). This serves the technical delivery of the site and IT security.

🍪 What are Cookies?

Cookies are small text files that your browser automatically creates and stores on your device. They contain no malicious code, but help us, for example, to:

• operate the website technically (essential cookies)
• generate visitor statistics
• evaluate marketing campaigns

🍪 Consent Management (CookieHub)

Our website uses CookieHub to manage consent for cookies and third-party services. On your visit, the tool displays a consent banner and stores your acceptance or refusal via a technically necessary cookie.

⚙️ Consent-Based Cookies

Not all cookies are necessary. Those used, for example, for statistics or marketing purposes, are only set with your free, informed, and unambiguous consent (art. 7, I, and art. 8, LGPD).

On your first visit to our website, we show you a cookie banner where you can individually decide which cookies to allow. You can change your choice at any time via the cookie banner.

We use the following cookie categories:

• Essential cookies: necessary for technical operation.
• Functional cookies: improve usability.
• Analytics cookies: help us improve the website.
• Marketing cookies: support targeted advertising.

🛠 Management via Google Tag Manager

We use Google Tag Manager to manage certain services efficiently and in an LGPD-compliant way – e.g. Google Analytics, Meta Pixel, or other analytics tools. Tag Manager itself does not store personal data, it only loads configurable scripts.

📈 Analytics and Performance Tools

Google Analytics

We use this to understand how visitors use our website. The collected data (e.g. page views, time spent, device used) is analyzed in anonymized form.

Google Tag Manager

Used to manage tracking tags and cookies. Tag Manager itself does not store personal data.

Meta Pixel

Used to measure marketing campaigns and display relevant content.

Google Ads

Used for campaign tracking and conversion measurement, to assess the effectiveness of our advertising.

Microsoft Clarity

Used to analyze user behavior (e.g. click paths, heatmaps). The data is analyzed in anonymized form.

Gleap

We use Gleap as a support and communication platform. It handles support requests, displays help articles, evaluates user feedback, and shows targeted chat messages, notifications, or banners.

Pulsetic

Monitors the availability and performance of the website. No personal data is stored.

Sentry

Captures error reports (bugs) and technical data to improve stability.

📋 Forms, Newsletter & Communication

MailGun

We use MailGun as an SMTP service to reliably deliver e-mails technically (e.g. confirmations, newsletters).

Google reCAPTCHA

To protect our forms against abuse and spam, we use Google reCAPTCHA (versions 2 & 3). This service checks whether input comes from a human or a bot. It analyzes and transmits to Google, among other things, IP address, time spent on the page, and mouse movements.

Salesforce Account Engagement (Pardot)

Our marketing automation platform, through which we manage newsletters and campaigns. Pardot tracks which content is relevant to you, to send you appropriate information.

🎥 Media Embeds

YouTube & Vimeo

YouTube and Vimeo videos are embedded on our website (e.g. our celebrations streamed at youtube.com/c/ICFRIO). These providers may set cookies and collect usage data (e.g. which videos are watched).

Spotify

Audio files and videos from Spotify are embedded on our website. Spotify may set cookies and collect usage data (e.g. which podcasts are listened to).

ICF Hub

Sermons, offerings, service times, and certain organizational data, such as social media links, address, or contact details, are transmitted to the website from our own internal ICF platform via an API, and are technically necessary for core functionality to work.

⚙️ Other Tools

• Google Maps: for interactive maps on the website (e.g. the church’s location in Icaraí, Niterói)
• Algolia: for the internal search function for events, sermons & locations
• Shortpixel: image optimization
• Zapier: automation (e.g. data transfer between tools)
• WPML (translation): manages multilingual display of content

📋 Right of Confirmation and Access

You can ask at any time whether and which personal data we have stored about you (art. 18, I and II, LGPD).

✏️ Right to Rectification

If something is no longer correct, you can request the correction of your data (art. 18, III, LGPD).

❌ Right to Erasure

You have the right to request that your data be deleted – for example, when it’s no longer needed for its original purpose or you have withdrawn your consent (art. 18, VI, LGPD).

🧯 Right to Anonymization, Blocking or Erasure

You can request the anonymization, blocking, or erasure of unnecessary, excessive, or unlawfully processed data (art. 18, IV, LGPD).

🚫 Right to Object

You can object to data processing carried out on a legal basis that dispenses with your consent, whenever non-compliance with the LGPD is found (art. 18, § 2, LGPD).

📤 Right to Portability

You can request that your data be ported to another service or product provider, upon an express request (art. 18, V, LGPD).

🛑 Right to Withdraw Consent

You can withdraw your consent at any time, free of charge and in a simplified manner (art. 8, § 5, and art. 18, IX, LGPD).

🧑‍⚖️ Right to Lodge a Complaint with the Supervisory Authority

If you believe your data protection concerns haven’t been adequately addressed, you have the right to file a complaint with the competent authority (art. 18, VII, LGPD).

In Brazil, the competent authority is:

• ANPD – Autoridade Nacional de Proteção de Dados (gov.br/anpd)

🤝 Working with Service Providers (Data Processors)

For certain technical, administrative, and communication processes, we work with selected service providers. These”processors”, as defined in art. 5, VII, of the LGPD, act on our behalf and according to our instructions – for example, for:

• Hosting and operation of the website (e.g. DigitalOcean, Xano, Imgix)
• Sending e-mails (e.g. MailGun, Salesforce Account Engagement)
• Analytics and tracking tools (e.g. Google Analytics, Clarity, Sentry)
• Forms (e.g. Gravity Forms)

We have entered into LGPD-compliant agreements with all processors, to ensure your data is protected and not used for their own purposes.

🌍 Transfer to Other Countries

Some of our service providers are based outside Brazil (e.g. in the USA). In such cases, we take care that an adequate level of data protection exists, under art. 33 of the LGPD, for example through:

• an ANPD adequacy decision (art. 33, I, LGPD),
• standard contractual clauses or global corporate rules approved by the ANPD (art. 33, II, LGPD),
• or the data subject’s specific, distinguished consent for the international transfer (art. 33, VIII, LGPD).

[TODO: the ANPD is still finalizing regulation of the LGPD’s international transfer mechanisms (standard clauses, adequacy country list). This section needs legal review before publication.]

🔄 General Principles

• Contact requests are stored for a maximum of 2 years (for follow-up and internal analysis purposes), unless a deletion request is received, a legitimate interest in retention exists, or a legal retention obligation applies.
• Newsletter data is stored until you unsubscribe or withdraw your consent.
• Donor data is subject to bookkeeping retention obligations under Brazilian law (typically between 5 and 10 years, depending on the type of accounting/tax record – [TODO: confirm the exact period with an accountant/lawyer]).
• Tracking data (e.g. via Google Analytics) is stored in anonymized form, to track long-term trends and improve the ICF website.

📌 What This Means for You

We comply with legal deadlines and regularly review which data can be deleted or anonymized.

🌍 What Does This Mean in Practice?

When personal data is transferred to countries that don’t have a level of data protection equivalent to that required by the LGPD, we make sure your data remains properly protected (art. 33, LGPD).

We ensure this, for example, through:

• standard contractual clauses approved by the ANPD
• ANPD adequacy decisions, where they exist

Additional technical/organizational measures, such as encryption or strict access restrictions.

🇺🇸 Example: USA

Some of our service providers (e.g. Google, Meta, MailGun, Vimeo) are headquartered in the United States. The LGPD is still in the process of regulating international transfer mechanisms equivalent to the EU/US Data Privacy Framework.

In the meantime, we seek to contractually ensure, wherever possible, a level of protection equivalent to that required by the LGPD with these providers.

🔐 Technical & Organizational Measures

We employ technical and organizational security measures (art. 46, LGPD) to protect your data against loss, misuse, unauthorized access, or disclosure. This includes, among others:

• careful selection and oversight of service providers
• encryption of connections (SSL/TLS), recognizable by”https://” in the browser’s address bar
• access restrictions to our systems
• regular security and software updates
• secure password policies & two-factor authentication (internal)

🛡️ What You Should Know

No digital system is 100% secure. But we do our best to ensure a high level of protection – and react immediately whenever there is cause for concern. If you notice anything, please reach out to us. We take your reports seriously. Despite careful technical and organizational measures, a residual risk in transmitting data over the internet (e.g. when using third-party services) can never be fully excluded. In the event of a relevant security incident, we will notify the ANPD and affected data subjects, in accordance with art. 48 of the LGPD.

🇧🇷 Brazil

Data processing at ICF Rio de Janeiro is based on the legal grounds set out in the LGPD, in particular:

• Art. 7, I, LGPD – consent of the data subject
• Art. 7, II, LGPD – compliance with a legal or regulatory obligation
• Art. 7, V, LGPD – performance of a contract or preliminary procedures
• Art. 7, IX, LGPD – legitimate interest (e.g. our interest in analyzing usage behavior to improve the website or ensure IT security)
• Art. 11, LGPD – processing of sensitive personal data (e.g. in the context of donations, which may reveal religious belief), only with specific, distinguished consent or another applicable legal basis

The applicable legal basis is indicated, where necessary, in the relevant section of this policy, according to the specific purpose of processing.

Other Jurisdictions

For users accessing our services from other countries – e.g. the European Union (GDPR), Switzerland (FADP), or the United States (CCPA) – additional rights under those laws may apply. If you access our services from another country, we recommend also familiarizing yourself with the local data protection rules that apply.

Contact

ICF Rio de Janeiro
Rua Lopes Trovão, 233
Icaraí – Niterói – RJ
CEP 24.220-070, Brazil
[email protected]

We’ll answer your request as quickly as possible – and in any case within the legally required timeframe (art. 19, § 1, LGPD).