Website Privacy, Security and Use Policy

The 4rest4all Association, registered in Brazil under CNPJ No. 66.464.130/0001-93, respects the privacy of everyone who visits 4rest4all.org and processes personal data in accordance with Brazil’s Federal Law No. 13,709/2018 — the General Data Protection Law (LGPD) — and other applicable legislation.

We act as the data controller for the personal data processed through this website. The legal bases we rely on to process personal data include the consent of the data subject, the execution of a contract or pre-contractual procedure, the fulfillment of legal or regulatory obligations, the exercise of regular rights in judicial or administrative proceedings, and, where applicable, our legitimate interests as a non-profit organization, always balanced against the rights and freedoms of the data subjects.

We may collect information voluntarily provided by users, such as name, email address, telephone number, organization and message content, as well as data required for communications, partnerships, registrations and donations. The website may also collect basic technical information, including IP address, browser, device, pages visited and cookies, depending on the tools that are active.

This information may be used to respond to requests, manage institutional relationships, process donations, send authorized communications, improve the website, prevent fraud, protect our systems and comply with legal obligations. 4rest4all does not sell personal data. Information will only be shared when necessary with technology, hosting, payment, communication or accounting providers; partners directly involved in specific activities; or legally competent authorities.

Personal data will be retained only for as long as necessary to fulfil the stated purposes, provide accountability, comply with legal obligations or protect rights. After this period, data will be deleted, anonymized or restricted in accordance with applicable law. When personal data is processed by third-party providers, we seek to ensure, through contracts and technical measures, that they adopt appropriate safeguards.

International data transfers, when they occur, are carried out in compliance with the requirements established by the LGPD and the guidance of the Brazilian National Data Protection Authority (ANPD), including the use of standard contractual clauses or other adequate transfer mechanisms.

We adopt administrative and technical measures proportionate to the risks involved to protect information against unauthorized access, loss, alteration, disclosure or improper destruction. These measures include access controls, authentication, encryption where appropriate, monitoring of systems, backups, and periodic review of our practices.

Our team and service providers are expected to handle personal and institutional data with confidentiality and only access it when strictly necessary for legitimate activities. We work to maintain an environment of continuous awareness regarding information security and the protection of the communities we serve.

Despite our efforts, no system connected to the internet is completely risk-free. In the event of a relevant security incident, we will act to contain the impact, restore normal operations, document what happened and assess the need to communicate the event to the competent authorities and the affected data subjects.

If a security incident involving personal data occurs, 4rest4all will assess the risks, adopt containment measures and notify the Brazilian National Data Protection Authority and affected individuals when required, in accordance with ANPD Resolution No. 15/2024 and other applicable regulations. Reports of suspected vulnerabilities may be sent responsibly to contact@4rest4all.org, without accessing, copying, modifying or disclosing third-party data.

Information concerning Indigenous Peoples, communities, villages, territories, leaders, routes, conflicts and field operations receives enhanced protection. Precise coordinates, sensitive locations, the identities of vulnerable individuals and operational details capable of creating risks will not be published merely because they were shared with 4rest4all.

We recognize that Indigenous Peoples have the right to self-determination over their data, images, knowledge and narratives, in line with the principles of Free, Prior and Informed Consent and the United Nations Declaration on the Rights of Indigenous Peoples. Any collection, use or sharing of data related to communities is guided by dialogue, respect for local governance and the decisions of legitimate representatives.

Geolocation data, satellite connectivity records, photographs of sensitive locations and any information that could expose communities to risk are treated as restricted and are not disclosed publicly. When field information is shared for institutional or fundraising purposes, it is reviewed to remove or generalize details that could compromise the safety, autonomy or privacy of the people involved.

We do not use Indigenous data for surveillance, militarization, commercial exploitation or the training of artificial intelligence systems without specific assessment and authorization. Requests for access to or correction of data related to communities may be directed to contact@4rest4all.org and will be assessed in dialogue with the legitimate representatives of the people concerned.

Images, testimonies, maps, knowledge and Indigenous cultural expressions will be used with respect for the decisions, governance, protocols and context of the communities involved. Such information will not be sold, commercially exploited, used for surveillance or employed to train artificial intelligence systems without specific assessment and authorization.

We seek to portray Indigenous Peoples as protagonists of their own stories, avoiding stereotypes, exoticization and representations that reduce communities to vulnerability or passivity. Whenever possible, we prioritize content produced by the communities themselves or created in direct collaboration with them.

Consent for the use of images and testimonies is sought in an accessible and informed manner, indicating the purpose, scope and duration of use. Participants may withdraw consent and request the removal of content, and we will act to honor that request within the limits of what is technically and legally feasible.

Cultural expressions, symbols, traditional knowledge and narratives remain connected to their respective peoples and knowledge holders. Their reproduction, adaptation or commercial use requires appropriate authorization and, where applicable, fair benefit-sharing arrangements in accordance with Brazilian law and international standards.

The website may use cookies that are necessary for its operation, security, accessibility and user preferences. These cookies allow basic functionalities such as language selection and session continuity and, as a rule, do not require prior consent, as they are essential to the service.

Analytics, media or marketing cookies, if used, must respect the user’s choices and the guidance issued by Brazil’s National Data Protection Authority. When non-essential cookies are present, we seek to provide clear information about their purpose and the possibility of refusal, without compromising access to the content of the website.

Cookies are small text files stored on the user’s device. They do not, by themselves, identify a specific person, but may be associated with browsing data. Users can manage or delete cookies at any time through their browser settings, although this may affect some features of the website.

Third-party services embedded on the website, such as video players, maps, payment tools and translation services, may set their own cookies. We recommend that users review the privacy policies of these services to understand how their data is processed.

Users may change their preferences at any time through the cookie settings available on the website or directly in their browser. Refusing non-essential cookies does not prevent access to the main content of the site.

Under the LGPD, data subjects may request confirmation of processing, access to their data, correction, anonymization, restriction or deletion when applicable, information about data sharing, data portability under applicable regulations, withdrawal of consent or objection to unlawful processing. Requests may be made in writing and will be handled within the deadlines established by law.

To ensure the security of personal data, we may verify the requester’s identity before responding. In some situations, we may not be able to fully meet a request, for example when the data must be retained to comply with a legal obligation, protect the rights of third parties or fulfill the legitimate purposes of the Association.

Privacy, data protection and security requests may be sent to contact@4rest4all.org. We are committed to responding clearly and within a reasonable time, informing the measures taken or the reasons why a request cannot be fully met.

The content published on this website is provided for institutional and informational purposes. Texts, photographs, videos, trademarks and reports belong to 4rest4all, their respective authors or licensors. Reproduction, distribution or public communication of the content is permitted for non-commercial purposes, provided the source is cited, except where otherwise indicated.

Indigenous knowledge, symbols, narratives and cultural expressions remain connected to their respective peoples, communities and knowledge holders and may not be reproduced or exploited without appropriate authorization. The use of content that identifies communities, leaders or sensitive locations is subject to the restrictions set out in our Indigenous Data and Image & Storytelling policies.

Users must not attempt to access systems without authorization, interfere with the operation of the website, introduce malicious code, collect data abusively, use territorial information for exploitation or harmful purposes, or falsely represent themselves as acting on behalf of 4rest4all. Suspected vulnerabilities may be reported responsibly, without accessing, copying, modifying or disclosing third-party data.

The website may contain links to third-party sites. 4rest4all is not responsible for the content, practices or policies of these sites and recommends that users review their terms and privacy policies.

This policy may be updated to reflect legal, technological or operational changes. The current version and its latest revision date will remain available on this website. Continued use of the website after changes are published implies acceptance of the updated terms.

Donations are received and administered by the 4rest4all Association, a Brazilian non-profit civil association registered under CNPJ No. 66.464.130/0001-93. No donation is routed to a personal account. All funds are intended for the institutional purposes of the Association.

Donations support the mission and programs of 4rest4all — including Indigenous connectivity, territorial protection, communication, education and community-led development — and are generally final. Whenever possible, we report on the use of resources through institutional channels, respecting the privacy and security of the communities served.

Requests involving errors, duplicate payments, fraud or unauthorized transactions will be reviewed under applicable law and the rules of the payment provider. Refunds, when applicable, will be processed through the same channel used for the original payment and within the deadlines established by the provider.

The Association may refuse or return funds that are incompatible with its mission, independence, integrity, security or legal obligations. Donations made with the intention of conditioning the activities of the Association, influencing its governance or compromising its autonomy may be declined.

For questions about donations, receipts or institutional partnerships, please contact contact@4rest4all.org. We are committed to transparency and to maintaining a relationship of trust with our donors and partner communities.