Privacy Notice

Gricco Soluções Integradas ("Gricco") is the controller of the personal data processed on this platform under Law No. 13,709/2018 (Brazil's General Data Protection Law, LGPD). This notice explains what data is processed, why, and your rights.

1. What data

• Registration: name, email address, CPF, company (contracting company), job role, employee number at the contracting company, 3×4 photo (for the training ID card), language.
• Training: enrolments, access records, answers and exam attempts, grades, attendance, completion, electronic signature (image, date, time, network address), certificates issued and downloaded, refresher training history.
• Technical data: network address, browser and access times in the platform's logs.
• Usage analytics: screens accessed, interactions, technical characteristics of the device and, after sign-in, the user's internal identifier and platform role. We use Umami for this analysis. The absence of analytics cookies does not mean that no data is collected or that it is anonymous.
• Session replays and heatmaps, when enabled: clicks, scrolling, screen changes and information displayed in the interface. Input masking and exclusion of sensitive elements are configured; these measures reduce exposure but do not make every recording anonymous. This is not a recording of the camera or microphone.

2. Purposes and legal bases

• Delivering, recording and certifying training and demonstrating compliance with the Regulatory Standards (NR-01, NR-05, NR-35 and others): compliance with a legal obligation and performance of the contract with the contracting company.
• Issuing certificates and training ID cards with the information required by NR-01 (name, CPF, content, training hours, instructor, responsible technical professional).
• Sharing with the contracting company the progress and certificates of people linked to it (see the Consent to Image Use and Sharing).
• Security and auditing: access and usage records to protect the platform and provide evidence of training.
• Platform diagnostics and improvement: usage analytics, session replays and heatmaps to understand access difficulties, identify faults and improve screens and learning paths.

Session cookies maintain access; other browser features may remember the user, dismissal of notices and accessibility preferences. The cookie notice available on the sign-in screen details these features. Dismissing an informational message does not record individual agreement to this policy or change the analytics features in operation.

3. With whom we share data

• Your contracting company (the company that enrolled you): progress, results, attendance and certificates, within what labour law requires and what you consent to.
• Technology processors that host the platform and account directory, under contract and confidentiality obligations, without using the data for their own purposes.
• Usage analytics infrastructure, through the Umami service configured at umami.griccon.com, for the diagnostic and improvement purposes described in this notice.
• Authorities and regulatory bodies, when required by law.

We do not sell personal data or use it for advertising.

4. How long we keep data

Training records are kept for the period required by the Regulatory Standards and labour law (at least the validity period of the next training, and the periods set out in Annex II of NR-01 and social security legislation). Inactive accounts may be suspended; data that no longer needs to be retained is anonymised or deleted.

Analytics data and session replays follow the analytics service's retention settings and procedures. The maximum duration of a recorded segment is not its storage period.

5. Your rights

Confirmation of processing, access, correction, anonymisation, portability, information about sharing, withdrawal of consent (where consent is the legal basis) and the right to complain to the ANPD. Submit requests through the channels provided in the training; Gricco responds within the statutory period. Some data cannot be deleted while there is a legal obligation to retain it (as is the case with training records).

6. Security

Access through a personal account, encrypted transmission, encrypted backups, access logs and role-based permissions. Representatives of a contracting company can only see people linked to it.

7. Changes

This notice may change. The new version will be presented the next time you access the platform.