PERSONAL DATA PROTECTION POLICY
APRIL 2025

 INDEX.

1. INDICATION AND COMMUNICATION CHANNEL WITH THE PERSONAL DATA CONTROLLER (DPO).
2. OF THE ECONOMIC GROUP.
3. ABOUT TM TECHNOLOGY.
4. TM  TECHNOLOGY , CONSULTING AND SYSTEMS AS CONTROLLER OF PERSONAL DATA.
5. TM TECHNOLOGY, CONSULTING AND SYSTEMS AS PERSONAL DATA OPERATOR.
6. TM TECNOLOGIA, CONSULTORIA E SISTEMAS LTDA TRANSFERS YOUR PERSONAL DATA.
7. CAN TM TECNOLOGIA, CONSULTORIA E SISTEMAS LTDA DELETE YOUR PERSONAL DATA?
8. THE RIGHTS OF THE HOLDER OF PERSONAL DATA
9. GLOSSARY

1. INDICATION AND COMMUNICATION CHANNEL WITH THE PERSONAL DATA CONTROLLER (DPO).

We present our Personal Data Officer, Manfredo Abate.  

The communication channel is via email  encarregadodedados@tminformatica.com.br , by telephone at (55 11) 98282 6513 or through the reporting channel on our Website.

2. OF THE ECONOMIC GROUP.

The companies TM TECNOLOGIA, CONSULTORIA E SISTEMAS LTDA, GESLAB SISTEMAS LTDA and DELTA CONSULTORIA E SISTEMAS LTDA form an economic group with the trade name TM Tecnologia.

TM Tecnologia shares personal data with companies in the economic group, both as operator and as controller.

3. ABOUT TM TECHNOLOGY.

TM Tecnologia has been in the market for over 25 years and we have a personal data protection policy in accordance with Law No. 13,709/18 – General Personal Data Protection Law.

Our Information Technology team has more than 70 professionals working hard to protect your personal data.

Personal data is anonymized by encryption.

Our employees receive ongoing training on the General Data Protection Law.

With us your data is protected.

4. TM TECNOLOGIA AS CONTROLLER OF PERSONAL DATA.

TM Tecnologia treats personal data with strict security standards at all stages.

• CANDIDATES FOR OUR JOB VACANCIES.

After accepting our data protection policy, candidates can submit their resumes through our website. Our HR department automatically deletes the data contained in the resume six months after receipt, as does the data from physical submissions.

Resumes may be deleted before the six-month period, for which the request must be sent via email to: rh@tminformatica.com.br

• CONTRIBUTORS .

The personal data of our employees is collected at the time of hiring, for the specific purposes of the contract and fulfillment of obligations ancillary to the contract.

Data of children and adolescents is processed with the consent of their parents or legal guardians.

For other purposes we collect specific consent.

5. TM TECNOLOGIA AS AN OPERATOR OF PERSONAL DATA.

TM Tecnologia does not collect your personal data.

Your personal data is collected in hospitals and laboratories. These hospitals and laboratories are the controllers of your personal data.

According to the General Data Protection Law, TM Tecnologia is the data operator, which means that, under a contract signed with the controllers, it processes your personal data for the specific purpose and in accordance with your consent.

We receive your personal data through  software  and equipment installed in hospitals and laboratories. Our  software  and equipment calculates test results and forwards them to the institution that collected the personal data.

This is how you get your medical test results.

TM TECNOLOGIA is honored to participate in your health care.

6. DOES TM TECNOLOGIA TRANSFER YOUR PERSONAL DATA?

Yes, TM Tecnologia transfers your personal data in encrypted form. We are obsessed with information security. To ensure we successfully protect your personal data, we have a highly qualified and trained team, in addition to working with Oracle, an internationally recognized provider of data hosting security.

7. CAN TM TECNOLOGIA RECTIFY OR DELETE YOUR PERSONAL DATA?

Under a contract with hospitals and laboratories, TM Tecnologia processes your personal data for the specific purpose of delivering the results of your medical exams.

Law 13,787, of December 27, 2018, determines that medical records in paper format and digitized formats must be stored for a minimum period of 20 years from the last record.

Therefore, TM TECNOLOGIA cannot rectify or delete your personal data without an order from the controller.

We suggest that you contact the hospital or laboratory where your personal data was collected and make your request.

8. DATA SUBJECT RIGHTS.

The LGPD provides for a wide range of rights for data subjects, among which the following can be highlighted:

The holder has the right to easy access to information about the processing of their data, which must be made available in a clear, appropriate and visible manner regarding, among other characteristics provided for in regulations to comply with the principle of free access:

I – Specific purpose of processing;

II – Form and duration of treatment, observing commercial and industrial secrets;

III – Identification of the controller;

IV – Controller’s contact information;

V – Information about the shared use of data by the controller and the purpose;

VI – Responsibilities of the agents who will carry out the processing; and

VII – Rights of the holder, with explicit mention of the rights contained in art. 18 of this Law.

Every natural person is assured ownership of their personal data and is guaranteed the fundamental rights of freedom, intimacy and privacy, under the terms of this Law.

The holder of personal data has the right to obtain from the controller, in relation to the data of the holder processed by him, at any time and upon request:

I – Confirmation of the existence of treatment;

II – Access to data;

III – Correction of incomplete, inaccurate or outdated data;

IV – Anonymization, blocking or deletion of unnecessary, excessive data or data processed in non-compliance with the provisions of this Law;

V – Portability of data to another service or product provider, upon express request, in accordance with the regulations of the national authority, observing commercial and industrial secrets;  

VI – Deletion of personal data processed with the consent of the holder, except in the cases provided for in art. 16 of this Law;

VII – Information on public and private entities with which the controller shared data;

VIII – Information on the possibility of not providing consent and on the consequences of refusal;

IX- Revocation of consent, under the terms of § 5 of art. 8 of this Law.

The data subject has the right to request a review of decisions taken solely based on automated processing of personal data that affect their interests, including decisions intended to define their personal, professional, consumer and credit profile or aspects of their personality.

9. GLOSSARY.

PERSONAL DATA : information related to an identified or identifiable natural person;

SENSITIVE PERSONAL DATA : personal data about racial or ethnic origin, religious belief, political opinion, membership of a trade union or organization of a religious, philosophical or political nature, data relating to health or sexual life, genetic or biometric data, when linked to a natural person;

ANONYMOUS DATA : data relating to a data subject that cannot be identified, considering the use of reasonable and available technical means at the time of processing;

DATABASE : structured set of personal data, established in one or more locations, in electronic or physical support;

HOLDER : natural person to whom the personal data being processed refer;

CONTROLLER : natural or legal person, under public or private law, responsible for decisions regarding the processing of personal data;

OPERATOR : a natural or legal person, under public or private law, who processes personal data on behalf of the controller;

RESPONSIBLE : person appointed by the controller and operator to act as a communication channel between the controller, data subjects and the National Data Protection Authority (ANPD)

PROCESSING OF PERSONAL DATA : any operation carried out with personal data, such as those relating to collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation or control of information, modification, communication, transfer, dissemination or extraction;

ANONYMIZATION:  anonymization: use of reasonable and available technical means at the time of processing, through which data loses the possibility of association, directly or indirectly, with an individual;

CONSENT:  free, informed and unequivocal expression by which the holder agrees to the processing of his/her personal data for a specific purpose;

NATIONAL AUTHORITY : public administration body responsible for overseeing, implementing and monitoring compliance with this Law throughout the national territory.