CowSynch Smart Management of Cattle Reproduction Get the app
EN

Legal document

Privacy policy

Version 4.0 Published on September 8, 2026 Supersedes all previous versions in full

This translation is provided for convenience. If there is any discrepancy, the Portuguese version prevails.

This policy describes the processing of personal data carried out within the CowSynch platform by ORDINUM INOVAÇÃO E TECNOLOGIA LTDA and CENTRAL DE TREINAMENTOS PROCRIARE LTDA and forms an inseparable part of the terms and conditions of use.

The document is drafted in compliance with article 9 of Law 13.709 of August 14, 2018, the Brazilian General Data Protection Law, with article 7, items VI, VIII and IX, of Law 12.965 of April 23, 2014, the Brazilian Internet Civil Framework, and with article 5, items X, XII and LXXIX, of the Brazilian Constitution.

Notice of prior reading

Particular attention is due to clause 4, which establishes the roles of ORDINUM, PROCRIARE and the User in each processing activity, clause 9, on international transfer, and clause 14, which describes how the Data Subject exercises their rights.

1.1. CowSynch involves ORDINUM INOVAÇÃO E TECNOLOGIA LTDA, registered with the Brazilian corporate taxpayer registry, CNPJ, under nº 37.303.239/0001-40, with its registered office at Avenida João Pinheiro, nº 2.705, Uberlândia, State of Minas Gerais, Brazil, ZIP 38.400-714, hereinafter ORDINUM, and CENTRAL DE TREINAMENTOS PROCRIARE LTDA, registered with the CNPJ under nº 51.231.706/0001-03, with its registered office at Avenida Uirapuru, nº 1.491, Suite 5, Cidade Jardim, Uberlândia, State of Minas Gerais, Brazil, ZIP 38.412-166, hereinafter PROCRIARE.

1.2. ORDINUM performs technical, administrative and financial functions. PROCRIARE performs commercial and customer service functions. Whether either party acts as controller, joint controller, processor or subprocessor depends on the decisions and activities actually carried out in each processing activity under clause 4.

1.3. Data Subjects may exercise their rights or ask questions at contato@ordinum.com.br, by telephone at +55 34 2512 0606 or through the support page. Each request will be received and routed to the responsible agent without requiring the Data Subject to identify the controller in advance.

1.4. The particulars stated in item 1.1 are provided in compliance with article 9, items III and IV, of Law 13.709 of August 14, 2018, and article 2, items I and II, of Decree 7.962 of March 15, 2013.

2.1. The definitions of the terms of use apply to this policy and, in addition, the following.

3.1. This policy describes which personal data is processed on the Platform, for what purpose, under which lawful basis, with whom it is shared, for how long it is retained and how the Data Subject exercises their rights.

3.2. It applies to the application for the Android and iOS systems, the website cowsynch.com.br, the web interface and the server services supporting them.

3.3. It does not apply to third-party sites, applications or services the User may reach from the Platform, which have their own policies.

4.1. The roles in items VI and VII of article 5 of Law 13.709 of August 14, 2018 are assigned according to the purposes, essential means and activities actually carried out in each processing activity. Joint participation in CowSynch does not create indiscriminate joint liability for data protection.

4.2. For the User's registration, access and billing data, ORDINUM acts as controller when it determines the purposes and essential means. The same rule applies to security, invoicing and technical support data under its administration.

Clause assigning responsibility

4.3. As to data of farmers, field staff, farm employees and other third parties the User registers on the Platform, decisions regarding the processing rest with the User, who assumes the position of controller. ORDINUM acts as processor, handling that data exclusively in accordance with the User's instructions, as expressed through the User's use of the features.

4.4. As controller of the data referred to in item 4.3, it is incumbent on the User, and not on ORDINUM:

4.5. Where ORDINUM receives a data subject request concerning data under the User's control, ORDINUM will forward it to the controller and inform the Data Subject of the referral under paragraph 4 of article 18 of the same Law.

4.6. PROCRIARE acts as controller of data it collects or accesses in prospecting, marketing, commercial relations, training and customer service when it determines the respective purposes and essential means.

4.7. ORDINUM and PROCRIARE are joint controllers only for processing activities in which they jointly determine the purposes and essential means. In those cases, they will document responsibilities, maintain an accessible channel and disclose the shared use.

4.8. Each agent is responsible for the processing, decisions and controls it actually manages. The liability, joint liability and exclusion rules in articles 42 and 43 of Law 13.709 of August 14, 2018 apply, without prejudice to consumer law when legally applicable.

5.1. The Platform processes the personal data listed below, collected exclusively from the origins indicated.

Data Origin Purpose
Electronic address and password Registration and authentication Identification of the account and protection of access. The password is stored exclusively as a cryptographic hash, never in legible text.
Name, CRMV professional licence, company, CNPJ, address, city, state and WhatsApp My profile screen Professional identification of the User in reports and share images.
Name, company, telephone number, electronic address and customer service records Direct contact from the Data Subject, prospecting or customer relations Customer service, training, commercial relations and subscription support according to the roles in clause 4.
Tax identification of the payer Subscription purchase on the Android platform Requirement of the payment processor to issue the recurring charge.
Credit card details Subscription purchase on the Android platform Transmitted once to the payment processor to constitute the recurring charge. ORDINUM does not store the card number or its security code.
Farmer clients, farms, lots, services and field records Use of the Platform by the User Operation of the product: schedule, protocols, reminders and reports. Subject to the regime of item 4.3.
Handling photographs and logo Camera or gallery, upon the User's authorization Photographic record of the executions and visual identification of the documents generated.
Device notification identifier Notification authorization by the User Sending reminders for the day's handling.
Application access logs Use of the Platform Compliance with article 15 of Law 12.965 of April 23, 2014, and security of the service.

5.2. The Platform does not request sensitive personal data within the meaning of article 5, item II, of Law 13.709 of August 14, 2018. ORDINUM and PROCRIARE will not process such data without a demonstrated need, an adequate lawful basis and specific transparency.

5.3. Data relating to animals, herds, protocols and handling does not constitute personal data, except where associated with an identified or identifiable natural person, in which case it is fully subject to this policy.

6.1. All processing carried out by ORDINUM or PROCRIARE rests on one of the grounds of article 7 of Law 13.709 of August 14, 2018 according to the purpose and role of the respective agent.

Purpose Lawful basis Provision
Create and maintain the account, provide the features and charge the subscription Performance of the contract to which the Data Subject is a party Art. 7, item V
Provide customer service and training and maintain commercial relations with the User Performance of the contract and legitimate interest according to the activity performed Art. 7, items V and IX, together with art. 10
Retain tax, accounting and billing records Compliance with legal and regulatory obligations Art. 7, item II
Retain application access logs Compliance with a legal obligation Art. 7, item II, together with art. 15 of Law 12.965 of 2014
Maintain the security of the service and prevent fraud and abuse Legitimate interest Art. 7, item IX, together with art. 10
Exercise rights in judicial, administrative or arbitration proceedings Regular exercise of rights Art. 7, item VI
Send reminder notifications and access the device camera and gallery Consent, revocable at any time in the system settings Art. 7, item I, together with art. 8

6.2. Data is not processed for purposes other than those declared in item 6.1, nor in a manner incompatible with them. Where the purpose changes, the Data Subject will be informed in advance, under article 9, paragraph 2, of the same Law.

6.3. Revoking the consent referred to in the last row of item 6.1 does not affect the lawfulness of processing carried out while it was in force and may render the corresponding feature unavailable.

7.1. Processing observes the principles of article 6 of Law 13.709 of August 14, 2018, notably:

  1. purpose, adequacy and necessity, processing only data that is pertinent and proportionate to the declared purposes;
  2. free access, through facilitated and free consultation on the form and duration of processing;
  3. data quality, assuring the Data Subject accuracy, clarity and currency;
  4. transparency, with clear, precise and readily accessible information;
  5. security and prevention, through the measures described in clause 11;
  6. non-discrimination, processing for unlawful or abusive discriminatory purposes being prohibited;
  7. accountability.

8.1. Personal data is shared only to the extent necessary for the purposes of this Policy and according to the roles described in clause 4.

Agent Data received Purpose and location
Central de Treinamentos Procriare LTDA Identification, contact and content strictly necessary for the request submitted Customer service, training and commercial relations according to the applicable role. Processing in Brazil.
Amazon Web Services Database, files and transactional messages of the product Server infrastructure, storage and message delivery. The servers are located in the United States of America.
Asaas Name, electronic address, tax identification and card details Processing of the subscription on the Android platform, by Pix or credit card.
Apple Data of the purchase itself Subscription contracted on the iPhone platform, charged through the App Store. Apple informs ORDINUM only of the validity of the subscription.
Google Firebase Device notification identifier Delivery of reminder notifications, where the feature is active.

8.2. Amazon Web Services, Asaas, Apple and Google Firebase process data according to their contracts and the roles applicable to each activity. When acting as ORDINUM's processors, they follow its instructions and the purposes indicated in item 8.1.

8.3. PROCRIARE's access is limited to what is necessary for the commercial and customer service activities actually performed. Access does not automatically make it a processor or joint controller and does not authorize incompatible use for its own purposes.

8.4. ORDINUM and PROCRIARE do not sell personal data, transfer it to data brokers or share it for third-party advertising.

8.5. Sharing may also occur under a court order or a request from a competent authority demonstrating express legal competence and stating its grounds, in which case delivery is limited to what is strictly required, under article 10, paragraph 3, of Law 12.965 of April 23, 2014, and article 11 of Decree 8.771 of May 11, 2016.

8.6. Share images and reports the User transmits to farmers and third parties are the User's own act and do not constitute sharing by the Suppliers, as set out in clause 10 of the terms of use.

9.1. The infrastructure supporting the Platform is hosted on servers located in the United States of America, which constitutes an international transfer of personal data within the meaning of article 33 of Law 13.709 of August 14, 2018.

Information required by article 9 of the LGPD

9.2. As to the data for which ORDINUM is controller under item 4.2, the transfer rests on article 33, item V, of Law 13.709 of August 14, 2018, being necessary for the performance of the contract to which the Data Subject is a party, entered into at their own request upon adherence to the terms of use.

9.3. As to the data for which the User is controller under item 4.3, the transfer is carried out by ORDINUM as processor, on the User's instructions, verification of the applicable authorizing ground resting with the User.

9.4. The United States of America is not, as of this date, the subject of an adequacy decision by the ANPD under article 33, item I, of the same Law and of the Regulation approved by CD/ANPD Resolution nº 19 of August 23, 2024. The transfer therefore rests exclusively on the ground declared in item 9.2.

10.1. The Platform performs no advertising tracking. It embeds no advertising software development kit, does not use the device advertising identifier and does not build behavioural profiles of the User for advertising purposes.

10.2. The Suppliers take no decision based solely on automated processing of personal data affecting the interests of the Data Subject, within the meaning of article 20 of Law 13.709 of August 14, 2018. The calendar calculations performed by the Platform operate on parameters chosen by the User and produce no legal effect on the Data Subject, as set out in clause 9 of the terms of use.

11.1. ORDINUM applies technical and administrative measures apt to protect personal data from unauthorized access and from accidental or unlawful destruction, loss, alteration, communication or dissemination, under article 46 of Law 13.709 of August 14, 2018, and article 13 of Decree 8.771 of May 11, 2016.

11.2. Those measures comprise:

  1. encryption of all traffic between the Platform and the server, through the HTTPS protocol;
  2. storage of the password exclusively as a cryptographic hash, never in legible text;
  3. storage of photographs, attachments and logos in private storage, reachable only through a temporary address signed by the server;
  4. per-account isolation applied at the server layer, so that no User accesses another's data;
  5. strict control of administrative access, with logging of operations;
  6. availability of biometric unlocking, as an additional layer on the User's device.

11.3. Disclosing the security standards in this clause meets article 16 of Decree 8.771 of May 11, 2016, subject to confidentiality of trade secrets.

11.4. No security measure is entirely infallible. It is incumbent on the User to keep their credentials confidential, not to share the account and to notify ORDINUM immediately of any suspicion of unauthorized access.

11.5. PROCRIARE applies appropriate technical and administrative measures to data processed in its commercial and customer service environments. Each agent limits access, keeps records proportionate to risk and notifies the other of any event that may affect CowSynch or its Data Subjects.

12.1. If a security incident may cause relevant risk or harm to Data Subjects, the processing agent responsible will provide the notices required by article 48 of Law 13.709 of August 14, 2018.

12.2. The notification will observe a period of three business days, counted from knowledge of the incident and that it affected personal data, under articles 6 and 9 of the Regulation approved by CD/ANPD Resolution nº 15 of April 24, 2024, and will contain the minimum information required there.

12.3. Each agent will keep records of incidents under its responsibility, including those not notified, for at least five years under article 10 of the same Regulation.

12.4. ORDINUM and PROCRIARE will cooperate in investigation, containment, preservation of evidence and communications with the ANPD and Data Subjects. If the incident affects data under the User's control under item 4.3, ORDINUM will notify the User so that the User may discharge their own notification duties.

13.1. Personal data is retained for as long as the User's account subsists and the purpose authorizing the processing remains.

13.2. Once processing ends, data is erased, retention being authorized only for the purposes of article 16 of Law 13.709 of August 14, 2018, notably compliance with legal, tax, accounting and regulatory obligations and the regular exercise of rights.

13.3. Application access logs are retained for 6 months, as set out in clause 17.

13.4. Billing records and tax documents are retained for the periods required by applicable tax and accounting legislation.

13.5. When the partnership between the Suppliers ends, data will be erased, anonymized, blocked, returned, exported, migrated or retained according to the lawful basis, existing contracts and legal duties. PROCRIARE's ownership of CowSynch does not make personal data an object of property or authorize automatic transfer. Migration to PROCRIARE or a new processor will occur only when consistent with the actual processing roles, disclosed purposes and the LGPD.

14.1. The Data Subject is assured, upon request, the rights set out in article 18 of Law 13.709 of August 14, 2018:

  1. confirmation of the existence of processing;
  2. access to the data;
  3. correction of incomplete, inaccurate or outdated data, which the User carries out directly on the My profile screen;
  4. anonymization, blocking or erasure of unnecessary or excessive data, or data processed in breach of the Law;
  5. portability to another provider, subject to ANPD regulation and to trade and industrial secrets;
  6. erasure of data processed on the basis of consent, save for the cases of article 16;
  7. information on the entities with which data has been shared, as set out in clause 8;
  8. information on the possibility of withholding consent and on the consequences of doing so;
  9. revocation of consent.
How and within what time the right is exercised

14.2. The request is addressed to the channel indicated in item 1.3 and answered at no cost to the Data Subject, under article 18, paragraph 5, of the same Law.

14.3. Confirmation of existence and access are provided in simplified format immediately, or by way of a clear and complete statement within up to 15 days counted from the request, under article 19, items I and II.

14.4. The responsible agent may request elements evidencing the identity of the requester, in order to avoid delivering personal data to someone who is not its subject or representative.

14.5. The Data Subject is assured the right to petition the ANPD directly and to turn to consumer protection bodies, under paragraphs 1 and 8 of article 18.

14.6. A request received by either Supplier will be logged and routed to the responsible agent. ORDINUM and PROCRIARE will cooperate so that their internal allocation of roles does not hinder the exercise of Data Subject rights.

15.1. Account deletion is carried out by the User, inside the application, without depending on a message or on support, under Dashboard, then Settings, then Delete my account.

15.2. The account is marked for deletion immediately, all sessions are ended and personal data enters the erasure process described in clause 13, which meets article 7, item X, of Law 12.965 of April 23, 2014.

15.3. The deletion request path is also available outside the application, on the account deletion page.

Warning about subscriptions purchased on the App Store

15.4. Deleting the account does not cancel a subscription contracted through the App Store. Where the User subscribed on the iPhone platform, it is indispensable to cancel likewise in the device Settings, under Subscriptions, because only Apple ends that billing, as set out in item 17.5 of the terms of use.

16.1. The Platform is intended for veterinarians in the exercise of the profession, over 18 years of age, and is not directed at children or adolescents.

16.2. The Suppliers do not knowingly collect personal data of persons under 18. Were such collection found to have occurred involuntarily, the data will be erased as soon as the occurrence is verified.

17.1. As an internet application provider constituted as a legal entity, carrying out that activity in an organized and professional manner and for economic purposes, ORDINUM retains application access logs under confidentiality, in a controlled and secure environment, for 6 months, under article 15 of Law 12.965 of April 23, 2014.

17.2. Such logs are disclosed to third parties solely under a court order, or in the other cases expressly provided by law.

17.3. This clause provides the information required by article 7, item VI, of the same Law, and mirrors clause 23 of the terms of use.

18.1. Material amendments to this Policy are jointly approved by ORDINUM and PROCRIARE and operationally published by ORDINUM to reflect changes to the Product, legislation or regulation. The new version is published on this page with a version number and date, and earlier versions remain identified by their dates.

18.2. An amendment entailing a change of purpose incompatible with the original purposes is notified to the Data Subject in advance, who is assured the right to revoke consent, under article 9, paragraph 2, of Law 13.709 of August 14, 2018.

18.3. A material amendment is notified at least 30 days in advance, through the Platform and by the registered electronic address, in the same manner set out in clause 27 of the terms of use.

19.1. This policy is governed by Brazilian law, notably Law 13.709 of August 14, 2018, Law 12.965 of April 23, 2014, and Decree 8.771 of May 11, 2016, Law 8.078 of September 11, 1990 applying subsidiarily.

19.2. The choice of forum and the reservation in favor of the User are set out in clause 29 of the terms of use and apply equally to this policy.

Contact

Communications relating to this Policy, including the exercise of rights under clause 14, may be submitted to either Supplier through the unified electronic address contato@ordinum.com.br or the support page and will be routed internally to the responsible agent.

Return to the top of the document