Privacy and security policy

The Privacy and Security Policy below forms an integral part of the Terms and Conditions of Use. Identification

This site is owned, maintained and operated by OFICINA DE ARTE E FOGO SOCIEDADE EMPRESÁRIA LTDA, whose trade name is “CRISTALS CÁ D'ORO”, herein referred to as “COMPANY” with headquarters at Rua Assis Figueiredo, 433 – CEP: 37701- 704 in the city of Poços de Caldas – MG.

General information

The COMPANY takes all necessary measures to protect the User's privacy, in compliance with the legislation in force. This document details the ways of collecting, keeping, using, sharing and disclosing your personal data, as well as clearly pointing out the measures taken to ensure the protection of the collected data.

Collection, use and storage of data

Data collect:

Access Account.

In order to create an Access Account on the Site, the User must complete a registration form, which may vary in complexity according to the operations he intends to carry out. In this way, a simple registration consisting of an e-mail address and zip code will be required to send advertising and promotional messages to the User about products, services, promotions and/or news from the COMPANY.

To make Purchases, the User must create a complete Access Account, providing full name, email address, telephone number, CPF, full address (state, city, neighborhood, street, number, complement, extra information) .

The data provided by Users will be stored and used by the COMPANY, by itself or by third parties contracted by it, to provide the products on the Site, carry out commercial transactions, process payments related to them, share data, send emails of offers, products , services and marketing campaigns, store the history of products viewed, promote retargeting campaigns, customize pages on the Site, verify bank details to prevent fraud (data will not be stored) and carry out deliveries and returns.

The data may be shared with third parties contracted by the COMPANY under the terms of this Policy, emphasizing that the creation of each Access Account or any registration on the Site, for which it is necessary to send any personal data of the User, presupposes the express consent regarding the collection, use, storage and processing of personal data.

The user is responsible, in the civil and criminal spheres, for the veracity and updating of the data provided (including personal data) and the COMPANY disclaims any liability for damages arising from the incomplete, inaccurate or inaccurate completion of the registration by the User, under any means. or form, or, still, by the improper use of this registration by any third party not authorized to use such data or, still, by third parties that have, duly or improperly, obtained the User's data for access on the Site, acting as if he was.

Data Collection: Cookies.

In order to offer the best browsing and shopping experience to the User, the COMPANY uses technologies to collect and store information related to the user's visit to the website and this may include sending one or more cookies or anonymous identifiers that collect data related to the browsing preferences and the pages visited by the User.

In this way, the presentation of the Site is personalized and aligned with the User's personal interests. The use of this data is restricted to the indicated purpose and the COMPANY undertakes not to use or allow the use of such data for any other purpose.

In addition, the collection, storage and processing of this data is completely automated, with no possibility of human contact with the data in question.

The User can and will be able, at any time, if he disagrees with the cookies policy above, to use his browser tools that prevent the installation of cookies and also to delete any existing cookies on his internet connection device. In this case, some functionalities of the site may present errors. The COMPANY may also use other technologies to collect Users' browsing data, committing to save, process and use them in accordance with this Policy.

Data collection: Access logs.

The COMPANY will keep in its database all the information related to the User's access to the Site, including, but not limited to, the IP address, the pages accessed, the times and dates of access, and the access device used, under the terms of the current legislation. Such records may be used in internal or public investigations to investigate practices that may cause any damage to the COMPANY, including the commission of crimes in virtual environments.

Data collection: Other ways.

The COMPANY may collect personal data from the User, other than those identified here, that are voluntarily entered by the User and about the User in the process of browsing the Site or when contacting the CAC (COMPANY Call Center). Finally, the COMPANY will be able to access public or private databases to confirm the veracity of the personal data informed by the User, including data related to the payment of the Purchase.

Usage of data: E-mail.

The COMPANY will use the User's e-mail primarily to send information about their Purchases (Purchase confirmation and status updates). The registered e-mail will also be used to recover the Customer's access password, in case of loss or forgetting of the password.

Use of data: Advertising via direct mail, email, MMS or SMS.

When registering their contact details, the User will have the option to accept the sending of advertising messages. In addition, at any time, the User may change his decision, by accessing his Account on the Site or contacting the CAC (COMPANY Call Center) or, even, in the unsubscribe field in the newsletters sent by the COMPANY, being that in this case the unsubscription from the database may take up to 5 (five) days to be effective.

Use of data: Other forms.

In addition to the ways set out above, the COMPANY may, at its sole discretion, use the User's personal data in the following ways:

• Registration update;

• guarantee of the security of the User;

• response to requests from the User;

• information about changes to the Terms and Conditions of Use or Policies;

• preparation of statistics regarding the use of the Site, guaranteeing the User's anonymity, including for the purpose of improving and understanding the Users' profile for the improvement of the Site;

• improvement of interactivity tools between the Site and the User, guaranteeing their anonymity;

• compliance with court orders; It is

• defense of the rights of the COMPANY against the User in judicial or administrative proceedings.

Save the data.

The COMPANY will keep all data collected in its protected and secure databases. Such data will only be accessed by automated computerized processes, authorized professionals and in the cases listed in this Policy.

If the User requests the deletion of their data from the database, reserves the right to keep the data in question in backup copies for up to 6 (six) months, in order to comply with legal obligations of mandatory custody.

Sharing and disclosure of data

The COMPANY has the confidentiality of the User's personal data as a priority in its business. Thus, it undertakes not to disclose, share, give access to, facilitate access to, rent, sell, exchange or in any other way make such information available to third parties, under any pretext, except in cases expressly authorized by the User, including in cases indicated below.

With the sole purpose of allowing the realization of Purchases on the Site, the COMPANY may share Users' personal data with its commercial partners, such as payment processing companies, credit card administrators and carriers.

In this case, only the essential personal data will be shared for the COMPANY's commercial partner to carry out its activity (billing, delivery, etc.). In addition, such commercial partners will be obliged, through confidentiality agreements, not to file, keep on file, compile, copy, reproduce or share such data with anyone.

The other possibility of disclosure of personal data is through a court order. Also in this case, the disclosure will only occur to the extent necessary to comply with the court order, remaining confidential the data not required by the authority in question.

Data transmitted without request from the COMPANY

The COMPANY asks the User not to send the COMPANY any commercial information, personal creations, ideas, photographs, projects, concepts, etc. (Unsolicited Content). Such Unsolicited Content will be summarily discarded, without any reading or incorporation into the COMPANY databases. Under the terms of the Copyright Law, ideas, abstract concepts, projects, plans and schemes are not subject to protection in Brazil.

In this way, the possible use by the COMPANY of any Unsolicited Content will be the result of internal and independent development and may occur freely, with no authorization or compensation being due or required from the user or consumer.

The COMPANY independently develops all its policies and activities, rejecting any accusation or allegation of exploitation of Unsolicited Content.

Security measures

Technological resources.

The COMPANY adopts advanced technological resources to guarantee the security of all personal data collected and stored. Not even COMPANY employees have free access to the Users' database, which is limited only to those people whose functions require contact with personal data. Among the security measures implemented are the use of modern forms of cryptography and the installation of barriers against improper access to the database (firewalls). Such measures can be verified by the User accessing the Site by viewing the “security lock” in their internet browser.

Password secrecy.

The COMPANY recommends that the User keep his password in complete secrecy, avoiding its disclosure to third parties.

The COMPANY will never ask the User to inform his password outside the Site, by telephone, email or by any other means of communication. The User's password must be used exclusively when accessing the User's Account on the Site. If the User suspects that his password has been exposed to third parties, the COMPANY recommends the immediate replacement of the password.

Suspicious emails.

The COMPANY only sends the User emails with advertising messages, disclosing products and services or updating information. The COMPANY does not send messages:

• requesting personal data from the User;

• requesting the User's password or financial data;

• with attached files except PDF documents; or

• with links to download files.

If you receive an e-mail with such characteristics, disregard it and contact the CAC (COMPANY Call Center).

Credit cards.

The COMPANY does not store User financial information in its database, such as credit card information. The payment approval procedure takes place between the User, the banks and the card issuers, without intervention by the COMPANY. Impossibility of accountability.

Despite the COMPANY's greatest efforts, the current state of technology does not allow the creation of an absolutely secure database against attacks.

In this way, the COMPANY disclaims any liability for damages eventually caused by third parties, including invasions of the Site or the database, viruses or information leaks, unless the COMPANY's exclusive fault is proven.

People's rights over collected data

The COMPANY allows the User to make different types of registration, containing more or less information according to their own purpose on the Site. Thus, the User has the possibility to choose the form of registration, having to fill it in with truthful and up-to-date information.

The User declares to be the legitimate holder of his personal data and may, at any time, use the tools of the Site to edit, update or remove them preventively from our database. The COMPANY will keep the preventively removed data confidential for a period of six months, in order to comply with legal obligations of mandatory custody, definitively discarding them after such period.

The COMPANY also provides tools for the User to determine some uses of their personal data, such as authorization to send advertising pieces.

The Site is not directed to minors under 18 (eighteen) years of age. However, access to the Site is not prohibited for minors, as there is no age-restricted content. The forms and questionnaires on the COMPANY website are not intended to obtain data from minors. If such data is entered by minors, their legal representative may contact the CAC (COMPANY Call Center) to rectify, modify or remove such data.