Revised Version — Terminology Aligned to GDPR Vocabulary
Editorial Note
This document presents the revised version of the BaseID Privacy Notice. All amendments are terminological in nature: the governing law remains the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018). Revised terms and passages are indicated in bold. The revision adopts the vocabulary established by Regulation (EU) 2016/679 (GDPR) as an international reference standard, without altering the normative framework or the lawful bases declared in the original text. The objective is to ensure that the document resonates appropriately with international partners and investors familiar with the GDPR ecosystem.
1. INTRODUCTION
BaseID presents this Privacy Notice as a demonstration of its commitment to transparency and respect for the rights of Data Subjects, describing how it collects, uses, shares, and protects information obtained through the platform, in compliance with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais — LGPD, Law No. 13,709/2018) and other applicable regulations, with particular attention to the provisions on the protection of children and adolescents set out in Article 14 of the LGPD and in the guidelines issued by the Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados — ANPD).
BaseID is a digital platform for sports career record-keeping, designed to organise and preserve the trajectory of athletes, especially those in their formative years. Given that its primary audience consists, in a central and deliberate manner, of children and adolescents, BaseID adopts an elevated standard of data protection, implementing specific parental verification mechanisms and express restrictions on the sharing of contact information of minors.
2. ABOUT THE PLATFORM AND ITS FEATURES
BaseID operates as a digital sports record, in which significant events in an athlete's career are recorded in a structured, permanent, and chronologically organised manner. The platform does not constitute a social network and does not offer social interaction features between users, such as content feeds, likes, comments, or direct messaging systems.
The main features offered by the platform are: (i) creation and management of the athlete's individual sports profile; (ii) recording of the athlete's history with clubs, sports institutions, and competitions; (iii) chronological organisation of significant career events; and (iv) making the profile available for consultation by authorised third parties, as described in Section 5 of this Notice.
A fundamental principle of the platform is the independence of the record from any institution: the sports history belongs to the athlete and follows them regardless of changes in club, institution, or sports affiliation, and may not be claimed by third parties.
3. DATA COLLECTED
3.1. Automatically collected data
The BaseID platform automatically collects technical information necessary for its operation, including: browser type, operating system, and device version; IP address and network connection data; access and platform usage logs; and aggregated usage and performance statistics.
3.2. Data provided by the user or Legal Guardian
Data entered directly by the athlete, their Legal Guardians, or authorised representatives falls into two main categories. The first encompasses athlete profile data, including full name, date of birth, nationality, sports position, physical sports characteristics (such as height, weight, dominant foot, and technical profile), profile photo, and any media associated with the athlete's career (images and videos from matches and training sessions). The second encompasses sports history data, comprising clubs and institutions where the athlete has played, periods of activity, participation in competitions and tournaments, and other significant career events.
3.3. Legal Guardian data
For profiles of minor athletes, data from the Legal Guardian is collected for profile management purposes and for the exercise of consent, including full name, email address, and, where applicable, the identification document used to verify the guardianship relationship. This data is kept separate from the athlete's sports profile and constitutes the sole means of contact made available to third parties with access to the platform, as detailed in Section 5.
4. PURPOSES OF PROCESSING
4.1. Applicable lawful bases
The Processing of Personal Data by BaseID is grounded in the following lawful bases under the LGPD: (i) Consent of the Data Subject (Article 7, item I), obtained as a freely given, specific, informed and unambiguous indication of agreement at the time of registration, for the purposes of recording, organising, and sharing the sports history; (ii) specific Consent of the Legal Guardian (Article 14, §1), required on a mandatory basis for the Processing of data of children and adolescents, obtained through the parental verification mechanism described in Section 5; and (iii) legitimate interests of the Controller (Article 7, item IX), for purposes of security, fraud prevention, and platform improvement, provided that such interests do not override the fundamental rights and freedoms of Data Subjects.
4.2. Specific purposes
Personal Data collected by BaseID may be processed for the following purposes: (i) to record, organise, and preserve the athlete's complete sports history, creating a permanent and independent digital record of their career; (ii) to enable consultation of the sports profile by authorised third parties — clubs, scouts, agents, and sports representatives — under the terms and conditions described in Section 5; (iii) to allow clubs and sports institutions to register and confirm the athlete's participation in their structures; (iv) to analyse aggregated sports data patterns for purposes of platform development and grassroots sports promotion, with potential provision of statistical and anonymised data to interested third parties; (v) to authenticate users and control access to the platform; and (vi) to prevent misuse, fraud, and conduct that violates the Terms of Use.
The platform does not process personal data for advertising, direct marketing, or any purpose incompatible with the sports and documentary nature that characterises it.
5. SHARING AND THIRD-PARTY ACCESS
BaseID may share athletes' sports data with third parties in the following circumstances, always subject to the prior freely given, specific, informed and unambiguous Consent of the Data Subject or their Legal Guardian, pursuant to Article 7, item I, and Article 14, §1, both of the LGPD:
(i) Access by clubs and sports institutions, upon entering into a platform access licence agreement, which allows the consultation of athlete profiles using sports filters such as position, age range, physical characteristics, and institutional history. In this case, the only contact data made available is that of the athlete's Legal Guardian, and access to any direct contact information of minor athletes is expressly prohibited;
(ii) Access by scouts, observers, agents, and sports representatives, under the same conditions as above, for the purpose of analysing sports trajectories and career monitoring;
(iii) Provision of anonymised data — processed through aggregation techniques — to third parties with an interest in grassroots sports development, for exclusively statistical and analytical purposes, in which case no identifiable Personal Data is shared or communicated.
In all cases of third-party access under a licence agreement, BaseID requires acceptance of specific Terms of Use that expressly prohibit the use of accessed information for purposes other than those described in this Notice, in particular any attempt to make direct contact with minor athletes. BaseID does not sell Personal Data to third parties and does not share information with companies or individuals outside the sports ecosystem.
The Data Subject or their Legal Guardian may withdraw Consent for data sharing at any time, in which case the athlete's profile will cease to be visible to licensed users, without prejudice to Processing already carried out on the basis of previously granted Consent.
6. PROCESSING OF CHILDREN'S AND ADOLESCENTS' DATA
The Processing of data of individuals under 18 (eighteen) years of age on BaseID strictly observes the provisions of Article 14 of the LGPD and the guidelines of the ANPD, with the protection of the best interests of the child and adolescent constituting the platform's absolute priority.
The registration of minor athletes may be initiated by the minor themselves, who fills in the sports profile data and provides the Legal Guardian's details — full name, phone number, and email address or WhatsApp contact. On the same screen, the minor views the Privacy Notice and accepts Consent to the recording of their sports history and Consent to the sharing of their profile with third parties in the sports ecosystem. This acceptance is logged with date, time, IP address, and a unique session identifier.
Following the minor's acceptance, the profile is activated in a restricted mode — visible and editable only by the minor themselves, with no visibility to third-party licensed users — and the system automatically sends a parental verification invitation to the Legal Guardian via the contact provided during registration, containing a link to the parental verification page.
Parental verification is completed by the Legal Guardian directly on that page, without the need to create an account, where they access the Privacy Notice and the Consent Form, and sign a declaration, under their civil and legal responsibility, confirming that they are the parent or holder of parental responsibility over the registered athlete. Only after the completion of parental verification does the profile become fully active and visible to third-party licensed users.
BaseID reserves the right, at any time and with justification, to request from the Legal Guardian documentary proof of the parental or guardianship relationship — such as a birth certificate, photo identification, or judicial custody order — particularly where there is any indication of fraud or inconsistency in the registered data. Failure to comply with such a request within the specified timeframe may result in suspension of the profile until the issue is resolved.
If the Legal Guardian does not complete parental verification, the system sends an automatic reminder.
7. ACCURACY OF INFORMATION
The information recorded on BaseID is entered by users themselves — athletes, Legal Guardians, or authorised representatives — and is not subject to any curation, official validation, or automatic verification by the platform. BaseID operates as a recording and organisational system, meaning that responsibility for the accuracy, currency, and completeness of the registered information rests solely with the user who entered it.
This condition is communicated clearly and prominently to all third parties who access the platform under a licence agreement, who acknowledge in the specific Terms of Use that the sports data consulted constitutes informational records entered on a voluntary basis, without the value of official certification or institutional validation by federations or sports bodies.
8. STORAGE, SECURITY, AND INTERNATIONAL DATA TRANSFERS
Personal data collected by BaseID is stored in a secure and controlled environment, with the adoption of appropriate technical and organisational measures to protect against unauthorised access, loss, destruction, or improper alteration of information, including encryption of data at rest and in transit, and role-based access controls.
To enable the operation of the platform, Personal Data collected by BaseID is stored and processed on servers located in the United States of America, which constitutes an international data transfer under Article 33 of the LGPD. This transfer is carried out on the basis of Article 33, item II, subparagraph "b" of the LGPD, through the execution of standard contractual clauses in the Controller-to-Processor configuration with infrastructure providers acting as Processors in the United States, by means of which BaseID demonstrates the adoption of sufficient guarantees to ensure compliance with the principles, Data Subject rights, and data protection framework established by Brazilian law. These clauses constitute the binding legal instrument ensuring that Processing carried out abroad meets a standard of protection equivalent to that required by the LGPD, regardless of the location of the servers.
BaseID requires infrastructure providers acting as Processors in the United States to comply with a set of contractual and technical security obligations, including: (i) processing data exclusively under the documented instructions of BaseID, with any use for the Processor's own purposes being prohibited; (ii) maintaining a robust information security programme, with appropriate technical and organisational measures, evidenced by internationally recognised certifications such as ISO/IEC 27001; (iii) ensuring a duty of confidentiality on the part of all staff and subcontractors with access to the data; (iv) notifying BaseID without undue delay in the event of a Personal Data Breach; (v) using sub-processors transparently, with prior written notice and a reasonable period for the Controller to object before any new sub-processor commences processing; and (vi) adopting policies for the secure and irreversible erasure of data upon termination of the contractual relationship.
Given that the transfer involves data of children and adolescents, BaseID applies a heightened standard of due diligence in the selection and monitoring of international Processors, contractually requiring them to observe a level of protection equivalent to that established by the LGPD for the Processing of data of vulnerable Data Subjects.
9. RETENTION PERIOD
Personal data will be stored for as long as necessary to fulfil the purposes for which it was collected. Athlete sports profile data is retained for as long as the profile remains active on the platform. Upon a request for account deletion, data is erased within a period of up to 90 (ninety) days, except where retention is required to comply with a legal obligation, to exercise or defend legal claims in judicial or administrative proceedings, or to respond to requests from competent authorities.
10. DATA SUBJECT RIGHTS
In accordance with Articles 17 to 22 of the LGPD, Data Subjects — and, in the case of minors, their Legal Guardians — may exercise the following rights: (i) confirmation of the existence of Processing; (ii) access to their data; (iii) rectification of incomplete, inaccurate, or outdated data; (iv) anonymisation, restriction, or erasure of data that is unnecessary or processed in non-compliance with the LGPD; (v) data portability — the right to receive Personal Data in a structured, commonly used and machine-readable format and to transmit it to another service provider; (vi) erasure of Personal Data processed on the basis of Consent; (vii) information about the public and private entities with which BaseID engages in shared data use; (viii) withdrawal of Consent at any time; and (ix) objection to Processing carried out on the basis of other lawful bases, where there is non-compliance with the LGPD.
Requests may be submitted to: lgpd@email.baseid.com.br
11. DATA PROTECTION OFFICER
The Data Protection Officer (DPO) of BaseID, responsible for acting as the communication channel between the company, Data Subjects, and the ANPD (Autoridade Nacional de Proteção de Dados — Brazilian National Data Protection Authority), may be contacted at: lgpd@email.baseid.com.br
12. UPDATES TO THIS NOTICE
This Privacy Notice may be updated periodically to reflect changes in legislation, data Processing practices, or platform features. Where changes broaden the scope of Processing or modify the purposes for which Consent was granted, BaseID will notify Data Subjects — and, in the case of minors, their Legal Guardians — with reasonable prior notice via the registered email address, and Consent will be renewed where required by the LGPD.
