1. Brazilian responsible entity
CICCLO TECNOLOGIA LTDA, CNPJ 23.436.294/0001-02, is the Brazilian operating company. The contract, registration and actual purpose identify its controller or processor role. Contact: contato@cicclo.com. Processing within Brazilian law's scope is subject to the LGPD (Law 13,709/2018), regardless of this page's language.
2. Purpose and people covered
This Privacy Policy describes personal data processing on the Cicclo website, the Cicclo Lavanderia app, and the platforms, connected equipment, support and integrations provided by the company identified in this document. It covers visitors, business prospects, customers, their authorised personnel and end users of operations such as laundries and residential buildings.
The availability of a feature does not mean that all the listed data are collected from everyone. Each operation must limit collection to what is necessary. Reading this policy provides information; it does not constitute blanket consent or acceptance of a penalty.
3. Who determines how data are used
Cicclo acts as a controller when it determines the purposes and essential means of processing for its business relationships, incoming enquiries, newsletter, and the administration and security of its own accounts and services.
When processing resident, laundry customer or personnel data under documented customer instructions, Cicclo may act as a processor. The establishment, building or network then determines the processing under its responsibility, and Cicclo assists with rights requests. Different roles must be documented in the contract and data processing agreement; Cicclo must not be assumed to control every operation.
4. Data categories and sources
Depending on the service: name, email, telephone/WhatsApp, account and operation identifiers; access roles and authentication records; orders, bookings, cycles, bonuses, credits and RFID identifiers; payment references, amounts and transaction status; equipment events, IP, browser, device and access logs; and support messages, attachments and history.
Data may be supplied by the person, generated during use or received from the customer, payment systems and authorised integrations. The website contact form collects name, email, telephone without a national mask, prospect profile, requested solutions, comments and a communication preference. It prepares an email in the visitor's email application; it does not confirm delivery through a contact server. The newsletter receives the email address and subscription source.
5. Purposes and necessity
Data support user registration and identification, delivery of the contracted solution, bookings and permissions, connecting payments to services, equipment monitoring and support. Data may also be needed for billing, legal obligations, dispute resolution, and preventing fraud and unauthorised access.
Operational reporting must limit identifiable data to what is necessary. Where the purpose allows, analysis should use aggregated or genuinely anonymised data. Pseudonymised data remain personal data. An incompatible new purpose requires a new assessment and information to the individual.
6. Grounds for processing
The legal ground must be identified for each purpose, considering the relationship with the person and applicable law. Services requested by the individual may rely on contract performance; legally required records on legal obligations; proportionate security and improvement on assessed legitimate interests; and optional communications and features requiring it on specific consent.
A contract between Cicclo and a business does not automatically make all of that business's customer data necessary for a contract with the individual. The customer must justify the processing it determines. Refusing optional processing must not prevent independent functions. Special rules for sensitive data take precedence over general grounds.
7. Biometrics and sensitive data
Access solutions may include facial recognition when this module is part of the project. Images or templates used for biometric identification require a specific necessity assessment, appropriate legal ground, prominent notice, restricted access and a defined retention period. Advertising the module does not authorise its activation for any person.
The operation's controller must define who manages these data and available access alternatives, such as scanning a wall QR code through the app. Do not send identity documents, health information or other sensitive data in free-text contact fields unless necessary. This policy does not state that the institutional website collects biometrics.
8. App permissions
Camera, location, notifications and other device features should only be requested when needed for the explained function, with contextual information and operating system controls. For example, QR scanning requires the camera when selected. The actual permission list depends on the app version and platform.
Users may review permissions in device settings. Refusal may limit the directly dependent function, without justifying additional access to contacts, photographs or continuous location. This policy does not authorise tracking or disclosure to AI tools.
9. Recipients and third-party services
Sharing must be limited to authorised customers and necessary infrastructure, payment, support, communication and integration providers, according to their roles and contracts. The website configuration includes Microsoft Azure, Intercom, Google Tag Manager and RD Station services; availability depends on environment and configuration. This does not mean that each receives every data category.
Local/Dev does not automatically start production marketing and support integrations; the specialist button may open Intercom at the visitor's request. WhatsApp, app stores and other external links also apply their own policies. Disclosure to authorities requires a legal obligation or ground. Additional commercial use needs its own purpose, notice and ground; this policy does not authorise it.
10. Cookies, preferences and communications
The site uses technical storage and preferences, including language. In Dev and production, Google Analytics measurement requires consent; in production, marketing tools may also use identifiers and cookies after that choice. Visitors can decline or change their preference in the footer. Form entries are not sent to Analytics. Strictly necessary cookies are separated from non-essential cookies, with information on purpose and duration.
For operations subject to European rules, non-essential analytics and advertising cookies require prior consent, with meaningful refusal and withdrawal. Deleting browser cookies does not replace that control. Newsletter subscriptions and communication preferences are voluntary; individuals may request cessation at contato@cicclo.com. Service messages are distinct from campaigns.
The website uses GeoJS to estimate the country from the IP address and select the Portuguese option displayed. This external lookup does not request precise location, credentials or form data. For this preference, Cicclo stores only the country code and lookup time in browser session storage for up to six hours. The provider receives the IP through the connection; see its policy at https://www.geojs.io/privacy/.
11. International processing and transfers
Infrastructure, remote support, partners and the relationship between the Brazilian and Portuguese companies may involve access or storage abroad. Each flow must identify recipient, location, purpose and applicable legal mechanism; group membership does not waive that assessment.
The mutual Brazil–EU adequacy recognised in 2026 may support transfers within the scope of the current decisions. Other destinations or flows outside that scope require another valid mechanism, such as applicable standard contractual clauses and supplementary safeguards. No assumption is made that every supplier benefits from adequacy. Information about flows and safeguards can be requested through the privacy contact.
12. Retention, erasure and backups
Accounts and operational data must be kept during service delivery and for any additional period genuinely needed for justified purposes. Billing documents, legal obligations, disputes, fraud prevention and incident records may have specific periods. There is no authorisation to retain all history indefinitely.
Once the purpose ends, data must be erased or anonymised unless a specific retention ground applies. Data retained after account deletion must be restricted to that ground and must not continue to serve an active account. Backups follow replacement cycles and controls to avoid restoring erased data into active use. Individuals may request the criteria and periods applicable to their case.
13. Security and incidents
Processing must use technical and organisational measures proportionate to risk, such as access controls, confidentiality, communication protection, permission management and response procedures. Actual measures depend on the service and must be documented; this policy does not claim certifications, audits or immunity from attacks.
Credentials are individual and must not be shared. Suspected unauthorised access should be reported immediately, with password changes and session review using available features. User obligations do not exclude Cicclo's responsibility for its own security. Personal data incidents must be assessed and notified under the jurisdictional rule below.
14. Delete an app account and associated data
To request deletion of your Cicclo/Cicclo Lavanderia account through the web, email contato@cicclo.com, preferably from your registered email. Identify the app or platform and relevant account. Do not send a password, authentication code or identity document unless necessary and specifically instructed. The button on this page opens an email draft; the request is transmitted only when you send it.
Identity checks must be proportionate. Once the request is confirmed, the account and associated data must be erased or anonymised, except records with legitimate retention grounds, which must be explained. Uninstalling the app or temporarily deactivating the account is not account deletion. Erasure does not automatically cancel services or subscriptions billed by third parties; those may require cancellation through their channels, without improperly blocking a deletion request.
Request account deletion by email15. Contact and exercising rights
Cicclo's currently stated privacy contact is contato@cicclo.com. Identify the company, service and right you wish to exercise. For processing determined by an establishment or building, Cicclo must guide the request to the controller and cooperate within its role.
Requests must not require passwords and must use proportionate identity checks. Any refusal or partial retention requires reasons and information on challenge routes. The named privacy officer/DPO and their specific contact details have not been confirmed for this edition; the general contact is not presented as a DPO appointment.
16. Children and adolescents
Business management platforms are intended for people authorised to represent an operation. Possible use by minors requires a separate assessment: the customer and Cicclo must consider best interests, age-appropriate information, legal grounds and applicable authorisations. App use alone is not evidence of parental consent.
Brazilian child and adolescent protection rules apply, including relevant digital requirements. In European operations, consent for digital services offered directly to children depends on local rules; Portugal sets a threshold of 13 for this case, without overriding civil capacity or other safeguards.
17. Automation and significant decisions
Bookings, usage limits, dynamic pricing and equipment release may follow rules configured by the operator. Automating a routine does not itself mean making a decision with legal or similarly significant effects on an individual.
Where a solely automated decision has effects covered by applicable law, relevant operation, consequences and challenge or review routes must be explained. Cicclo does not state here that it performs credit profiling, employment decisions or comparable assessments. This policy introduces no new AI purposes.
18. Versions and relationship to use terms
Significant changes to purposes, recipients or processing practices must be appropriately communicated, with fresh consent where required. A published edition does not retrospectively change permissions or remove existing rights.
Terms of Use cover licensing, accounts, credentials, responsibilities and contracting. They are separate: privacy information is not contractual acceptance. This edition is under legal and operational review and does not replace signed agreements.
19. Rights under the LGPD
Subject to legal conditions, individuals may obtain confirmation and access, correct data, request anonymisation, blocking or erasure of unnecessary or unlawfully processed data, learn about disclosures, withdraw consent, request portability and review of automated decisions, and challenge processing.
Confirmation and access may receive an immediate simplified response; the complete statement under Article 19 must be provided within 15 days. Other requests follow applicable legal deadlines. Individuals may approach Brazil's Agência Nacional de Proteção de Dados (ANPD) without waiving administrative or judicial remedies.
20. Brazilian incident rule
Incidents that may cause relevant risk or harm require controller notification to ANPD and affected individuals within three working days, subject to specific applicable rules. Assessment must consider context and the incident regulation's criteria. Processors must inform controllers in time to fulfil those duties.
21. Brazilian transfer rules
Transfers within the current EU adequacy recognised by Resolution CD/ANPD 32/2026 follow its scope and validity. Other flows require a mechanism permitted by LGPD and Resolution 19/2024, according to the transfer. This policy does not itself incorporate standard clauses into supplier contracts.
1. Portugal and European operations
CICCLO TECHNOLOGY LDA, NIF 517907780, is the stated company for operations based in Portugal. The contract and actual activity define its controller or processor role. Contact: contato@cicclo.com. Regulation (EU) 2016/679 (GDPR), Portuguese Law 58/2019 and relevant local rules apply.
Contracting with this company outside the EU does not override mandatory law in the user's country or make GDPR the only worldwide law. Language and a visitor's temporary location do not automatically change the contracted entity.
2. Purpose and people covered
This Privacy Policy describes personal data processing on the Cicclo website, the Cicclo Lavanderia app, and the platforms, connected equipment, support and integrations provided by the company identified in this document. It covers visitors, business prospects, customers, their authorised personnel and end users of operations such as laundries and residential buildings.
The availability of a feature does not mean that all the listed data are collected from everyone. Each operation must limit collection to what is necessary. Reading this policy provides information; it does not constitute blanket consent or acceptance of a penalty.
3. Who determines how data are used
Cicclo acts as a controller when it determines the purposes and essential means of processing for its business relationships, incoming enquiries, newsletter, and the administration and security of its own accounts and services.
When processing resident, laundry customer or personnel data under documented customer instructions, Cicclo may act as a processor. The establishment, building or network then determines the processing under its responsibility, and Cicclo assists with rights requests. Different roles must be documented in the contract and data processing agreement; Cicclo must not be assumed to control every operation.
4. Data categories and sources
Depending on the service: name, email, telephone/WhatsApp, account and operation identifiers; access roles and authentication records; orders, bookings, cycles, bonuses, credits and RFID identifiers; payment references, amounts and transaction status; equipment events, IP, browser, device and access logs; and support messages, attachments and history.
Data may be supplied by the person, generated during use or received from the customer, payment systems and authorised integrations. The website contact form collects name, email, telephone without a national mask, prospect profile, requested solutions, comments and a communication preference. It prepares an email in the visitor's email application; it does not confirm delivery through a contact server. The newsletter receives the email address and subscription source.
5. Purposes and necessity
Data support user registration and identification, delivery of the contracted solution, bookings and permissions, connecting payments to services, equipment monitoring and support. Data may also be needed for billing, legal obligations, dispute resolution, and preventing fraud and unauthorised access.
Operational reporting must limit identifiable data to what is necessary. Where the purpose allows, analysis should use aggregated or genuinely anonymised data. Pseudonymised data remain personal data. An incompatible new purpose requires a new assessment and information to the individual.
6. Grounds for processing
The legal ground must be identified for each purpose, considering the relationship with the person and applicable law. Services requested by the individual may rely on contract performance; legally required records on legal obligations; proportionate security and improvement on assessed legitimate interests; and optional communications and features requiring it on specific consent.
A contract between Cicclo and a business does not automatically make all of that business's customer data necessary for a contract with the individual. The customer must justify the processing it determines. Refusing optional processing must not prevent independent functions. Special rules for sensitive data take precedence over general grounds.
7. Biometrics and sensitive data
Access solutions may include facial recognition when this module is part of the project. Images or templates used for biometric identification require a specific necessity assessment, appropriate legal ground, prominent notice, restricted access and a defined retention period. Advertising the module does not authorise its activation for any person.
The operation's controller must define who manages these data and available access alternatives, such as scanning a wall QR code through the app. Do not send identity documents, health information or other sensitive data in free-text contact fields unless necessary. This policy does not state that the institutional website collects biometrics.
8. App permissions
Camera, location, notifications and other device features should only be requested when needed for the explained function, with contextual information and operating system controls. For example, QR scanning requires the camera when selected. The actual permission list depends on the app version and platform.
Users may review permissions in device settings. Refusal may limit the directly dependent function, without justifying additional access to contacts, photographs or continuous location. This policy does not authorise tracking or disclosure to AI tools.
9. Recipients and third-party services
Sharing must be limited to authorised customers and necessary infrastructure, payment, support, communication and integration providers, according to their roles and contracts. The website configuration includes Microsoft Azure, Intercom, Google Tag Manager and RD Station services; availability depends on environment and configuration. This does not mean that each receives every data category.
Local/Dev does not automatically start production marketing and support integrations; the specialist button may open Intercom at the visitor's request. WhatsApp, app stores and other external links also apply their own policies. Disclosure to authorities requires a legal obligation or ground. Additional commercial use needs its own purpose, notice and ground; this policy does not authorise it.
10. Cookies, preferences and communications
The site uses technical storage and preferences, including language. In Dev and production, Google Analytics measurement requires consent; in production, marketing tools may also use identifiers and cookies after that choice. Visitors can decline or change their preference in the footer. Form entries are not sent to Analytics. Strictly necessary cookies are separated from non-essential cookies, with information on purpose and duration.
For operations subject to European rules, non-essential analytics and advertising cookies require prior consent, with meaningful refusal and withdrawal. Deleting browser cookies does not replace that control. Newsletter subscriptions and communication preferences are voluntary; individuals may request cessation at contato@cicclo.com. Service messages are distinct from campaigns.
The website uses GeoJS to estimate the country from the IP address and select the Portuguese option displayed. This external lookup does not request precise location, credentials or form data. For this preference, Cicclo stores only the country code and lookup time in browser session storage for up to six hours. The provider receives the IP through the connection; see its policy at https://www.geojs.io/privacy/.
11. International processing and transfers
Infrastructure, remote support, partners and the relationship between the Brazilian and Portuguese companies may involve access or storage abroad. Each flow must identify recipient, location, purpose and applicable legal mechanism; group membership does not waive that assessment.
The mutual Brazil–EU adequacy recognised in 2026 may support transfers within the scope of the current decisions. Other destinations or flows outside that scope require another valid mechanism, such as applicable standard contractual clauses and supplementary safeguards. No assumption is made that every supplier benefits from adequacy. Information about flows and safeguards can be requested through the privacy contact.
12. Retention, erasure and backups
Accounts and operational data must be kept during service delivery and for any additional period genuinely needed for justified purposes. Billing documents, legal obligations, disputes, fraud prevention and incident records may have specific periods. There is no authorisation to retain all history indefinitely.
Once the purpose ends, data must be erased or anonymised unless a specific retention ground applies. Data retained after account deletion must be restricted to that ground and must not continue to serve an active account. Backups follow replacement cycles and controls to avoid restoring erased data into active use. Individuals may request the criteria and periods applicable to their case.
13. Security and incidents
Processing must use technical and organisational measures proportionate to risk, such as access controls, confidentiality, communication protection, permission management and response procedures. Actual measures depend on the service and must be documented; this policy does not claim certifications, audits or immunity from attacks.
Credentials are individual and must not be shared. Suspected unauthorised access should be reported immediately, with password changes and session review using available features. User obligations do not exclude Cicclo's responsibility for its own security. Personal data incidents must be assessed and notified under the jurisdictional rule below.
14. Delete an app account and associated data
To request deletion of your Cicclo/Cicclo Lavanderia account through the web, email contato@cicclo.com, preferably from your registered email. Identify the app or platform and relevant account. Do not send a password, authentication code or identity document unless necessary and specifically instructed. The button on this page opens an email draft; the request is transmitted only when you send it.
Identity checks must be proportionate. Once the request is confirmed, the account and associated data must be erased or anonymised, except records with legitimate retention grounds, which must be explained. Uninstalling the app or temporarily deactivating the account is not account deletion. Erasure does not automatically cancel services or subscriptions billed by third parties; those may require cancellation through their channels, without improperly blocking a deletion request.
Request account deletion by email15. Contact and exercising rights
Cicclo's currently stated privacy contact is contato@cicclo.com. Identify the company, service and right you wish to exercise. For processing determined by an establishment or building, Cicclo must guide the request to the controller and cooperate within its role.
Requests must not require passwords and must use proportionate identity checks. Any refusal or partial retention requires reasons and information on challenge routes. The named privacy officer/DPO and their specific contact details have not been confirmed for this edition; the general contact is not presented as a DPO appointment.
16. Children and adolescents
Business management platforms are intended for people authorised to represent an operation. Possible use by minors requires a separate assessment: the customer and Cicclo must consider best interests, age-appropriate information, legal grounds and applicable authorisations. App use alone is not evidence of parental consent.
Brazilian child and adolescent protection rules apply, including relevant digital requirements. In European operations, consent for digital services offered directly to children depends on local rules; Portugal sets a threshold of 13 for this case, without overriding civil capacity or other safeguards.
17. Automation and significant decisions
Bookings, usage limits, dynamic pricing and equipment release may follow rules configured by the operator. Automating a routine does not itself mean making a decision with legal or similarly significant effects on an individual.
Where a solely automated decision has effects covered by applicable law, relevant operation, consequences and challenge or review routes must be explained. Cicclo does not state here that it performs credit profiling, employment decisions or comparable assessments. This policy introduces no new AI purposes.
18. Versions and relationship to use terms
Significant changes to purposes, recipients or processing practices must be appropriately communicated, with fresh consent where required. A published edition does not retrospectively change permissions or remove existing rights.
Terms of Use cover licensing, accounts, credentials, responsibilities and contracting. They are separate: privacy information is not contractual acceptance. This edition is under legal and operational review and does not replace signed agreements.
19. Rights under the GDPR
Individuals may request access, rectification, erasure, restriction and, subject to legal conditions, portability and objection; they may withdraw consent and challenge solely automated decisions covered by law. Objections to direct marketing must be respected.
A response is due within one month; a further two-month extension is permitted where necessary, with notice and reasons during the first month. Individuals may complain to CNPD or the competent supervisory authority where they habitually reside, work or an alleged infringement occurred, and pursue available judicial remedies.
20. European data breach rule
Breaches must be documented. Where there is risk to rights and freedoms, the controller must notify the competent authority without undue delay and, where feasible, within 72 hours of awareness. High-risk breaches require informing individuals without undue delay, subject to legal exceptions. Processors inform controllers without undue delay.
21. European transfer rules
Transfers outside the European Economic Area must respect GDPR Chapter V. The European Commission's 2026 Brazil adequacy decision may be used within its scope; adequacy does not remove other processing duties. Where adequacy is unavailable, appropriate safeguards, standard clauses and supplementary measures must be assessed, without claiming unverified supplier certifications.
Do not send passwords or authentication codes. This is Cicclo’s existing contact; opening an email draft does not automatically submit a request.