Data Deletion & GDPR Policy

1. Your Right to Data Deletion

Under GDPR, LGPD, and other international data protection laws, you have the right to request erasure of your personal data. This is often referred to as the "Right to be Forgotten."

You can request deletion of your personal data at any time, without providing a reason. However, certain data may be retained for legal obligations or legitimate business purposes.

2. What Data Will Be Deleted & Why It's Used

2.1 Data Deleted Within 30 Days (Personal Data)

When you request account deletion, we will permanently delete the following data within 30 days:

2.2 Data Retained for Legal Compliance (Why & How Long)

The following data will be retained for the specified periods, even after deletion, to comply with law and legitimate business interests:

All retained data will be de-identified, encrypted, and segregated from active systems to prevent unauthorized access.

2.3 Data NOT Deleted

The following data will remain on the platform (not linked to your identity):

• Reviews/ratings you received from other users (these belong to other users)
• Feedback about your interactions (if not linked to your account)
• Aggregated, anonymized analytics data

3. How to Request Account & Data Deletion

3.1 Self-Service Deletion (Recommended)

The easiest way to delete your account is through the App:

1. Log in to your Aluga Facil App account
2. Go to Settings → Account → Delete Account
3. Read the confirmation message
4. Click "Delete My Account"
5. Confirm your password or two-factor authentication code
6. Your account will be marked for deletion
7. You'll receive a confirmation email
8. Data deletion will be completed within 30 days

3.2 Manual Deletion Request (Email)

If you cannot access your account or prefer to request deletion via email, contact our Data Protection Officer:

3.3 Response Timeline

We will:

• Acknowledge your deletion request within 3 business days
• Verify your identity to prevent unauthorized deletions
• Complete deletion of all applicable data within 30 days
• Send you confirmation when deletion is complete

4. Identity Verification

To protect against unauthorized account deletion, we may require you to verify your identity by:

• Providing your password
• Confirming your email address via a verification link
• Submitting government-issued ID (for sensitive deletion requests)
• Answering security questions you set up
• Providing two-factor authentication codes

If we cannot verify your identity, we may deny the deletion request for your protection.

5. Exceptions to Deletion

Under certain circumstances, we may not delete your data or may delay deletion:

5.1 Legal Obligations

We may retain data if required by law, court order, or government request (tax laws, anti-money laundering, know-your-customer regulations).

5.2 Active Disputes

If there is an ongoing dispute, complaint, or legal claim involving your account, we may retain necessary data until resolution.

5.3 Contractual Obligations

If you have ongoing rental agreements or unresolved transactions, we may retain related data until completion.

5.4 Abuse Prevention

We may retain limited data to prevent account re-creation if your account was terminated for violations.

5.5 Backup & System Recovery

Data in backup systems may take up to 90 days to fully delete due to technical requirements.

6. GDPR & Other Regional Rights

6.1 GDPR (EU/EEA Users)

If you are in the EU or EEA, you have the following rights under GDPR:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate information
• Right to Erasure: Delete your data (with exceptions noted above)
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive data in portable format
• Right to Object: Opt out of certain processing activities
• Right to Withdraw Consent: Withdraw previously given consent anytime

6.2 LGPD (Brazil Users)

If you are in Brazil, you have similar rights under LGPD including right to access, correction, deletion, portability, and opt-out of data sharing.

6.3 CCPA/CPRA (California Users)

If you are in California, you have rights under CCPA/CPRA including right to know, delete, opt-out of sale, and non-discrimination.

6.4 Other Jurisdictions

Similar rights exist in other jurisdictions (Canada, Australia, UK). Contact us for information specific to your location.

7. Right to Data Portability

You have the right to receive your data in a portable, machine-readable format (CSV, JSON) and transfer it to another service. To request data portability:

1. Email us at dpo@exinndigital.com
2. Subject: "Data Portability Request"
3. Include your account email and any identifying information
4. Specify the data format you prefer (CSV, JSON, XML)
5. We will provide your data within 30 days

8. Complaint & Appeal Rights

8.1 Challenge Our Decision

If we deny your deletion request or disagree with our decision, you have the right to:

• Request written explanation of our reasoning
• Appeal the decision by responding to our notice
• Escalate the complaint to our Data Protection Officer

8.2 Regulatory Complaint

If you believe we are violating your data rights, you can file a complaint with your regional data protection authority:

• EU: European Data Protection Board (EDPB)
• UK: Information Commissioner's Office (ICO)
• Brazil: National Data Protection Authority (ANPD)
• California: California Privacy Protection Agency (CPPA)

9. Deletion Confirmation & Verification

After your data is deleted, we will:

• Send you a confirmation email
• Confirm the deletion was successful
• List the data that was deleted
• Explain any data retained for legal reasons
• Provide the date deletion was completed

You can verify deletion by attempting to log in to your account—it should no longer exist.

10. Data of Minors

If your child (under 18) has an account, you may request deletion of their data at any time. Contact us with:

• Proof of parental relationship (birth certificate, passport)
• The child's account email and ID
• Your contact information

We will delete the child's account and data (subject to legal exceptions) within 30 days.

11. Frequently Asked Questions

12. Contact Us

For data deletion requests, questions about your rights, or to lodge a complaint: