Privacy Policy | Escola Vereda

1. Who we are

Vereda Educação Ltda. (“Vereda”, “we”) operates the Santo André and São Bernardo do Campo units. This Policy transparently describes how we process the personal data collected across our digital channels: the institutional website, visit scheduling, waiting list, work with us and partnerships forms.

2. Which data we collect

• Identification: full name, e-mail, telephone.
• Pedagogical interest and visit: unit, segment, intended school year and date/time of the visit. When scheduling, the guardian may provide the first name of the students who will take part; this data is used only to organize the visit.
• Job applications: position of interest, résumé (PDF/DOCX) and an optional cover letter.
• Partnerships: company name, contact, type of partnership and description of the proposal.
• Browsing data (only after explicit consent via the LGPD banner): measurement cookies (Google Analytics via GTM), performance metrics (Core Web Vitals) and session identifiers for telemetry correlation.
• Consent record: date/time, user agent and truncated IP of each decision to accept or reject the banner, for auditing purposes in line with the accountability principle (Art. 6, X of the LGPD).

3. Legal bases and purposes

The processing of personal data occurs under the following legal bases (Art. 7 of the LGPD):

• Consent (Art. 7, I): analytics and marketing cookies are activated only after you click “Accept” on the privacy banner. Refusal does not prevent browsing the website.
• Performance of preliminary procedures (Art. 7, V): contact, scheduling, waiting list, job application and partnership forms are treated as preliminary procedures toward a possible contract. Scheduling a visit does not imply consent for marketing communications; any opt-in is requested separately.
• Legitimate interest (Art. 7, IX): security logs, fraud prevention (honeypot, rate-limit) and request identifiers for auditing.

4. Data of children and adolescents: LGPD Art. 14 + Digital Child Statute

The processing of the personal data of children (up to 12 years incomplete) and adolescents (12 to 18 years) is governed by Art. 14 of the LGPD and aligned with the Digital Statute of the Child and Adolescent (Law 15,211/2025, regulated by Decree 12,880/2026).

Best-interest principle (Art. 14, caput). Every decision about processing the data of children and adolescents considers, above all, the best interest of the data subject.

Consent model (Art. 14, §1). Before enrollment, the forms mainly collect the guardian’s data and their intention to enroll. During scheduling, the guardian may provide the first name of the students exclusively to organize the visit. This information is not used for profiling or advertising. After enrollment, processing is grounded in the enrollment agreement signed by the legal guardian, which establishes the specific bases for the data necessary to provide educational services.

What we do not do (Art. 14, §3 and §6).

• We do not carry out advertising profiling or targeted processing of children and adolescents;
• We do not condition the guardians’ participation on excessive data collection;
• We do not share minors’ data for marketing purposes;
• We do not use dark patterns when obtaining consent: the LGPD banner offers “Accept” and “Reject” with equal prominence.

Health and sensitive data (Art. 11 of the LGPD). Student health data (allergies, medications, accommodations) is processed under specific legal bases (Art. 11, II, “a”, compliance with a legal obligation, and “f”, protection of life and physical integrity). Access is restricted to the school health team and pedagogical management, with read auditing.

Design commitments (Digital Child Statute). For future surfaces intended for students (educational portal being rewritten, guardians’ app), our design commitments include: restrictive privacy settings by default, a mandatory link to a parental account, no personalized recommendation algorithms for minors, no targeted advertising and a reporting channel for harmful content.

How to exercise rights over the data of children and adolescents. The rights provided for in Art. 18 of the LGPD are exercised by legal guardians. For requests related to a child or adolescent under our educational guardianship, simply send the request to the DPO (Section 9), who will validate the guardianship relationship in the current enrollment record or, if absent, through supporting documentation.

5. Data sharing

Data is shared only with strictly necessary processors:

• Vereda ERP: receives and organizes registrations, interest lists and scheduling. The system is operated by Vereda itself.
• Microsoft Azure: hosting of the website and backend, telemetry, private storage of résumés and delivery of the 360° tours via Blob Storage/CDN. Résumés have a temporary write URL and are revalidated after upload.
• Google Tag Manager, Google Analytics and Google Ads: activated only after consent, for measurement and campaign evaluation.
• Meta: campaign measurement tools activated only after consent.
• Google Maps: the embedded map is loaded only after an explicit action by the visitor. External links for directions follow Google’s policy when opened.

We do not sell, rent or transfer personal data to third parties for independent marketing purposes.

6. Cookies and similar technologies

Cookie	Source	Purpose	Type	Retention	Category
__consent_lgpd_v1	Vereda (1st party)	Records the consent decision (accept/reject)	localStorage	Indefinite (until browser data is cleared)	Necessary
_ga	Google (3rd party)	Distinguishes unique users	Cookie	13 months	Analytics (after consent)
_ga_<id>	Google (3rd party)	GA4 session state	Cookie	13 months	Analytics (after consent)
_gid	Google (3rd party)	Distinguishes sessions within a 24h window	Cookie	24 hours	Analytics (after consent)
_gcl_au and related cookies	Google Ads (3rd party)	Measures campaign conversions	Cookie	Per Google’s configuration	Marketing/measurement (after consent)
_fbp and _fbc	Meta (3rd party)	Measures campaigns and conversions	Cookie	Per Meta’s configuration	Marketing/measurement (after consent)
ai_session	Vereda (1st party, App Insights)	Correlates session performance metrics	Cookie	30 min idle / 24h absolute	Analytics (after consent)
ai_user	Vereda (1st party, App Insights)	Pseudonymous identifier for cohort analysis	Cookie	365 days	Analytics (after consent)

Analytics and marketing cookies remain blocked until the banner is accepted.

You can review or withdraw your choice at any time through the Manage cookies button in the footer. Withdrawal stops future collection and attempts to remove first-party measurement cookies; data already collected remains subject to the retention rules (Section 7) and to the policies of the respective processors.

7. Retention

• Leads and applications: up to 24 months after the last contact, or for the period necessary to comply with legal obligations.
• Résumés sent to the talent pool: up to 12 months, with an automatic lifecycle in Azure Blob storage.
• Security logs: 90 days.
• Consent record and server telemetry: 90 days.
• Enrolled student data: for the duration of the enrollment + 10 years (educational records), with subsequent anonymization.
• Student health data (Art. 11): anonymized at the end of the enrollment.
• Financial records: 10 years (compliance with a tax obligation).

8. Your rights (Art. 18 of the LGPD)

You may, at any time, exercise the data subject rights provided for in Art. 18 of the LGPD: confirmation of processing, access, correction, anonymization, portability, deletion, withdrawal of consent and review of automated decisions. Vereda currently does not carry out automated decisions about data subjects; this right is stated for completeness.

Simply send the request to our data protection officer (DPO):

E-mail: dpo@veredaeducacao.com

We will respond within 15 business days from receipt of the complete request (including identity verification). For requests about the data of children and adolescents, we validate the guardianship relationship as described in Section 4.

9. Security

We apply layers of protection in compliance with Art. 46 of the LGPD: encryption in transit via HTTPS/TLS and at rest in Azure services, role-based access controls (RBAC), a private credential between the website and the ERP, anti-spam via server-side honeypot, rate limiting per IP, request identifiers for auditing and continuous dependency verification (npm audit, CI gate). Résumés are written directly to a private container, without public listing and with signed URLs valid for only 10 minutes.

We operate under an incident response policy aligned with Art. 48 of the LGPD and ANPD Resolution CD/ANPD No. 15/2024: we detect, contain, assess and, when an incident may cause relevant risk or harm, we notify the ANPD and the affected data subjects within 3 business days, except where a specific period is provided by law.

10. Updates to this Policy

This Policy may be updated to reflect regulatory changes, new services or security improvements. The date of the last revision is visible at the top of this page. In the event of a material change, we will communicate by e-mail and/or a banner on the website.

11. Contact

For any questions about this Policy or about the processing of your data, contact the DPO at dpo@veredaeducacao.com or our team through the visit scheduling form.