Privacy Policy

Brazil-US International Academic Relations
Effective date: [date of go-live]
Last updated: [date of go-live]

This policy is an initial institutional draft. It is subject to review by qualified legal counsel prior to formal enforcement. By using this website you acknowledge that this document describes the program's current data protection practices in good faith and in alignment with applicable law.

1. Introduction

This Privacy Policy describes how the Brazil-US International Academic Relations program ("the Program", "we", "our", or "us") collects, uses, stores, protects, and shares personal data of visitors to usbracademic.org (the "Site") and of institutional representatives who submit expressions of interest through the Site.

The Program is an institutional initiative connecting academic institutions in Brazil and the United States. It is not a commercial operation, does not sell products or services to individuals, and does not engage in commercial marketing. All data practices described in this policy reflect that institutional nature.

This policy is issued under the responsibility of Joe Douglas, in his capacity as Founder and Strategic Director of the Program, who serves as the data controller for the purposes of the Brazilian General Data Protection Law (LGPD — Law No. 13.709/2018).

2. Data Controller

• Controller: Joe Douglas, on behalf of the Brazil-US International Academic Relations program
• Contact for privacy matters: joe@usbracademic.org
• Jurisdiction: Federative Republic of Brazil
• Applicable framework: LGPD (Brazil). Good-faith alignment with GDPR principles is maintained where applicable.

Requests concerning personal data may be sent to the email address above. We endeavor to respond within fifteen (15) days, consistent with the timelines established by the LGPD.

3. Personal Data We Collect

The Program collects personal data in two contexts: when you voluntarily submit an Expression of Interest through the Site, and when you navigate the Site or interact with emails we send.

3.1 Data you provide through the Expression of Interest form

When you submit the Expression of Interest form, we collect the following data:

• Full name
• Academic institution
• Role or position within the institution
• Institutional email address
• Message content provided by you
• Timestamp of submission
• Express consent to the processing of your personal data

This data is provided voluntarily and with your explicit, informed consent. The consent checkbox on the form is not pre-ticked and must be affirmatively selected.

3.2 Technical data collected automatically

When you access the Site, certain technical information is collected automatically for operational, security, and institutional analytics purposes:

• IP address
• User-agent string (browser and operating system)
• Referring URL
• Pages visited within the Site
• Time spent on each page
• Scroll depth within pages
• Language preference selected
• Date and time of each interaction
• Country and approximate city derived from IP address

3.3 Data related to email correspondence

If we send you an institutional email and you interact with it, we may record:

• Whether the email was opened (via a standard tracking pixel)
• Whether links within the email were clicked, and which ones
• The time of such interactions
• The IP address and user-agent from which the interaction occurred

3.4 Data we do not collect

The Program does not collect, and has no mechanism to collect, the following categories of data:

• Data relating to minors under the age of eighteen
• Financial data, income information, or banking details
• Health, medical, or biometric data
• Racial or ethnic origin
• Religious, philosophical, or political beliefs
• Sexual orientation or life
• Genetic data
• Any category defined as "sensitive personal data" under the LGPD (Article 5, II)

If any such data is inadvertently submitted through the message field of the Expression of Interest form, the Program will delete it upon identification and notify the sender.

4. Purposes of Processing

Personal data is processed exclusively for the following purposes:

• To review and respond to institutional expressions of interest submitted through the Site
• To facilitate potential bilateral academic partnerships between the Program and accredited academic institutions
• To send institutional correspondence directly relevant to an active expression of interest
• To measure engagement with the Program's public communications for institutional planning purposes
• To ensure the technical operation, security, and integrity of the Site
• To comply with legal obligations applicable to the controller
• To protect the rights of the Program, its leadership, and the institutions involved

The Program does not use personal data for commercial marketing, resale, targeted advertising, remarketing, or any purpose outside the institutional scope described above.

5. Legal Basis for Processing

Under the LGPD, processing of personal data must rest on one of the legal bases set out in Articles 7 and 11. The Program relies on the following bases:

• Consent (LGPD Article 7, I) for processing the data provided through the Expression of Interest form.
• Legitimate interest (LGPD Article 7, IX) for operational analytics strictly related to understanding institutional engagement with the Program, where such interest does not override the fundamental rights and freedoms of data subjects.
• Compliance with legal or regulatory obligations (LGPD Article 7, II) where applicable.
• Protection of life or physical safety and exercise of rights in judicial, administrative, or arbitral proceedings, where relevant.

6. How We Share Personal Data

The Program does not sell, rent, or trade personal data. Sharing of personal data occurs only in the following limited situations:

• With academic partner institutions, only when strictly necessary to advance a specific bilateral partnership and only after explicit written authorization from the data subject.
• With qualified legal counsel, when necessary for legal advice or in the context of legal proceedings.
• With technical service providers that support the operation of the Site (for example, the email delivery provider) and only under contractual obligations consistent with this policy.
• With public authorities, when required by law or by judicial order.

No personal data is transferred to third parties for commercial or marketing purposes.

7. International Data Transfers

Given the bilateral nature of the Program, personal data may be processed across the border between Brazil and the United States. Where such transfers occur, they are carried out in accordance with the provisions of the LGPD governing international data transfers (Articles 33 through 36), including the requirement of adequate data protection standards, specific and informed consent, or other legally recognized mechanisms.

The Program takes reasonable technical and organizational measures to ensure that personal data transferred internationally remains protected at a level substantially equivalent to that required under Brazilian law.

8. Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes described in this policy, or as required by applicable law.

• Expression of Interest submissions: retained indefinitely as valid institutional contacts, subject to request for deletion by the data subject at any time.
• Raw IP addresses in analytics records: retained for ninety (90) days, after which they are automatically anonymized and preserved only at the country and city level.
• Web server access logs: retained for thirty (30) days on a rolling basis.
• Detailed navigation events (scroll, time on page): retained in detail for one hundred eighty (180) days, after which they are aggregated and detail-level records are discarded.
• Email interaction records: retained for the duration of the institutional relationship or until requested for deletion.

9. Rights of the Data Subject

Under the LGPD, you have the following rights with respect to your personal data (Article 18):

• Right of confirmation of the existence of processing
• Right of access to the data we hold about you
• Right of correction of incomplete, inaccurate, or outdated data
• Right of anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in non-compliance with the LGPD
• Right of portability of the data to another service or product provider
• Right of deletion of personal data processed on the basis of consent, subject to legal exceptions
• Right to information about the public and private entities with which the controller has shared data
• Right to be informed of the possibility of not providing consent and the consequences of refusal
• Right of revocation of consent

To exercise any of these rights, please write to joe@usbracademic.org with the subject line "LGPD Request". We will respond within fifteen (15) days. Where identity verification is required, we may request reasonable information to confirm you are the data subject before acting on the request.

If you are not satisfied with our response, you may file a complaint with the National Data Protection Authority of Brazil (ANPD — Autoridade Nacional de Proteção de Dados).

10. Security Measures

The Program implements technical and organizational measures designed to protect personal data against unauthorized access, accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or any form of unlawful processing.

These measures include, without limitation:

• Encrypted transport (TLS 1.3) across all public endpoints
• Strong password hashing using bcrypt with no fewer than twelve rounds
• Rate limiting on the Expression of Interest form and on administrative endpoints
• Logs sanitized to exclude personal data in plain text where reasonably possible
• Periodic review of access credentials
• Isolated server environment with strict access controls
• Regular backups with integrity verification

No method of transmission or storage is perfectly secure, and the Program cannot guarantee absolute security. In the event of a personal data breach likely to result in significant risk to the rights and freedoms of data subjects, the Program will notify the ANPD and affected individuals within the timelines established by law.

11. Cookies and Tracking Technologies

The Site uses a limited set of cookies and equivalent local technologies that are strictly necessary for its operation and for understanding institutional engagement with the Program.

The Site does not use Google Analytics, Facebook Pixel, LinkedIn Insights, or any third-party advertising or remarketing technology. All analytics are operated locally by the Program itself.

A cookie banner is presented on first visit, allowing visitors to accept or decline non-essential cookies. Essential cookies strictly necessary for the security and operation of the Site remain active regardless of this choice.

A query parameter of ?notrack=1 may be appended to any URL on the Site to opt out of behavioral analytics for that session.

12. Children's Privacy

This Site is directed to institutional representatives of academic institutions, not to children. The Program does not knowingly collect personal data from individuals under the age of eighteen. If we become aware that personal data of a minor has been collected through the Site, we will delete that data without delay.

13. Changes to This Policy

This Privacy Policy may be updated from time to time to reflect changes in the Program's practices, in applicable law, or in the technical environment. Material changes will be announced on the Site, and the "Last updated" date at the top of this policy will be revised accordingly. We encourage you to review this policy periodically.

14. Contact

For any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact:

Joe Douglas
Founder and Strategic Director
Brazil-US International Academic Relations
Email: joe@usbracademic.org
Phone: +1 321 331 2531
Web: usbracademic.org

This document is issued in good faith as a preliminary institutional privacy policy. It should be read alongside the Terms of Use. Both documents are subject to formal legal review prior to definitive enforcement.