Privacy Policy

Version 1.0, in force since 15 July 2026, valid for 2 years (review in July 2028)

This Privacy Policy describes how BEX FEIRAS E EVENTOS CULTURAIS LTDA (CNPJ 11.472.564/0001-43), referred to here as "ArtRio", processes the personal data of users of the ArtRio mobile application (the "App"), in accordance with Brazil's General Personal Data Protection Law (Lei nº 13.709/2018, the "LGPD").

By registering and using the App, you agree to the practices described here. Please read it carefully, and if anything is unclear, contact us through the channels listed at the end.

1. Who controls your data

ArtRio is the controller of the personal data processed in the App, meaning it is the organisation that decides how and why your data is used. Technical operation of the App and of the intermediary infrastructure is carried out by Nox (Nox Tecnologia), acting as processor under our instructions. ArtRio's CRM is ArtRio's own system, maintained by its technical team.

Data Protection Officer (DPO) / privacy contact: Jomar Junior, jomarjunior@dreamfactory.com.br.

2. What data we collect

We collect only what is necessary for the App to work and for your participation in ArtRio.

2.1 Data you provide when registering

• Full name
• Email address
• Password (stored encrypted)
• CPF, the Brazilian taxpayer ID (when needed to link invitations and tickets)
• Phone number (optional)
• City and state (optional)
• Declared profile (for example: collector, art market, press, enthusiast)
• Curatorial areas of interest (optional)
• Your consent to the processing of data under this Policy

2.2 Data we collect automatically

• Installation identifier: a code generated on first use that uniquely identifies the installation on your device (it does not identify you directly).
• Push notification token: an identifier provided by Apple/Google operating systems when you allow notifications, used only to deliver fair-related messages.
• Technical device information: operating system, model, App version and language, used to ensure compatibility and diagnose problems.
• Crash reports: when the App fails, technical diagnostic data about the failure is sent to the provider Sentry to monitor App stability. We do not attach your IP address or personal identifiers to these reports.

2.3 Usage data (only with explicit consent)

If you accept the processing of usage data when registering, we record events about how you navigate the App (screens visited, actions taken, reviews submitted). This data is associated with your account (including name and email) and is used to understand usage patterns and improve the product, for internal use only. We do not sell or transfer this data. Without your consent, this data is not collected.

2.4 Invitation and ticket data

• Invitations associated with your CPF, generated and managed by ArtRio.
• Order history for paid tickets, where applicable. Payment data (card, Pix) never passes through the App; it is handled directly by the partner ticketing provider.

2.5 Reviews (NPS)

If you choose to rate your experience via NPS in the App, we record your score (Excellent / Very Good / Could Improve) and the optional comment, associated with your account. We use this solely to understand and improve your experience at the fair.

3. How we use your data

• Create and maintain your account, and display invitations and tickets linked to your profile.
• Send operational communications about the fair (schedule reminders, changes, access instructions).
• Allow entry to the fair by scanning the QR code on your invitation or ticket.
• Personalise the content shown (the day's schedule, interest flags).
• Respond to support requests and handle rights granted by the LGPD.
• Improve the App and the overall ArtRio experience (only with consent, per section 2.3).
• Comply with legal and regulatory obligations.

4. Legal bases for processing

Under article 7 of the LGPD, we process your personal data on the following bases:

• Performance of a contract (art. 7, V): to deliver the App's features after registration.
• Consent (art. 7, I): for push notifications, usage data (section 2.3) and marketing communications.
• Legitimate interest (art. 7, IX): for security, fraud prevention and continuous improvement of the App, always respecting your fundamental rights.
• Compliance with a legal obligation (art. 7, II): when required by law or a competent authority.

You may withdraw consent at any time (see section 9).

5. Who we share your data with

We share your data only with partners essential to operating the App, all contractually bound to comply with the LGPD:

• ArtRio's CRM, ArtRio's own system (hosted at database.artrio.com), maintained by its technical team, holding registration data, invitations and profile.
• Nox, technical operator of the App and the intermediary infrastructure (API proxy, notifications, reviews). Operates servers at artrio-app.com.
• MongoDB Atlas, the database provider used by Nox, with servers in the sa-east-1 region (São Paulo).
• Vercel, hosting provider for the App and the API proxy. May involve servers outside Brazil (see section 6).
• Expo (Expo Application Services), provider of the push notification infrastructure, integrated with Apple Push Notification Service and Firebase Cloud Messaging.
• Apple and Google, which operate the native push notification services on iOS and Android.
• Mixpanel, usage analytics provider, used only if you consent under section 2.3.
• Sentry, crash report provider, used to monitor App stability (section 2.2), without collecting personal identifiers.
• Partner ticketing provider (GO Dream): when you buy tickets in the App you are redirected to the ticketing provider. Payment is processed by them; we receive only the order confirmation.
• The access control company contracted by ArtRio to validate QR codes at the fair entrance.
• Public authorities, upon a court order or to comply with a legal obligation.

We do not sell or rent your data to third parties.

6. International data transfers

Some of the providers above (Vercel, Expo, Mixpanel, Sentry) operate servers outside Brazil, mainly in the United States. Whenever an international transfer occurs, we require contractual safeguards compatible with the LGPD (art. 33), including standard clauses and internationally recognised security certifications.

7. How long we keep your data

• Account data: kept while your account is active and for up to 5 years after closure, to comply with legal and tax obligations.
• Installation and push tokens: kept while the App is installed on the device. Removed on logout or uninstall.
• Usage data (section 2.3): up to 24 months, or until consent is withdrawn.
• NPS reviews: up to 24 months after the end of the edition of the fair they refer to.
• Ticket orders: periods defined by applicable law (up to 5 years, art. 27 of the Consumer Protection Code, for consumer claims).

After these periods, data is anonymised or securely deleted.

8. How we protect your data

We apply technical and organisational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS on all communication between the App and our servers).
• Passwords stored using cryptographic algorithms in the CRM.
• Secure storage of the authentication token on the device via Keychain (iOS) and Keystore (Android).
• Data access restricted to authorised people, with multi-factor authentication where applicable.
• Continuous security monitoring and regular dependency updates.

No system is 100% secure. In the event of an incident, we will notify you and Brazil's National Data Protection Authority (ANPD) as required by the LGPD.

9. Your rights as a data subject

Under article 18 of the LGPD, you may at any time:

• Confirm that ArtRio processes your data.
• Access your data.
• Correct incomplete, inaccurate or outdated data.
• Request anonymisation, blocking or deletion of unnecessary data, or data processed in breach of the LGPD.
• Request portability of your data to another service provider.
• Request deletion of data processed on the basis of consent, subject to legal retention requirements.
• Obtain information about the public and private entities we share your data with.
• Be informed that you may withhold consent, and what the consequences are.
• Withdraw consent at any time.
• File a complaint with the ANPD.

To exercise any of these rights, email jomarjunior@dreamfactory.com.br with your request. We will respond within the legal deadline (generally up to 15 days).

You can also delete your account directly in the App, under Perfil (Profile) › Excluir conta (Delete account).

10. Push notifications

You can turn push notifications on or off at any time in your device settings (iOS: Settings › ArtRio › Notifications; Android: Settings › Apps › ArtRio › Notifications). Turning them off does not prevent you from using the App.

11. Children and adolescents

The App is intended for people aged 13 and over. We do not knowingly collect data from children under 13. If you are responsible for a child who has used the App, contact us so we can remove the data.

12. Changes to this policy

We may update this Policy from time to time. The version in force will always be available at app.artrio-app.com/politica-de-privacidade. Significant changes will be communicated by email or in the App.

13. Contact

BEX FEIRAS E EVENTOS CULTURAIS LTDA
CNPJ 11.472.564/0001-43
Av. Ayrton Senna, nº 2150, sala 304, Bloco 0, Barra da Tijuca, Rio de Janeiro, RJ, CEP 22.775-900
Data Protection Officer (DPO): Jomar Junior
Email: jomarjunior@dreamfactory.com.br

This Policy was written in Brazilian Portuguese and follows the General Personal Data Protection Law (Lei nº 13.709/2018). Where translated versions diverge, the Portuguese version prevails. Read it at app.artrio-app.com/politica-de-privacidade.