Privacy notice

1. Who is responsible for your data

Golocker operates Golocker, a smart locker platform for parcel delivery, collection and rental. For the data described in this notice, Golocker is the data controller unless stated otherwise.

When you live or work at a building or site that uses our lockers, the site manager (for example a condominium administration or property manager) usually decides who is registered and provides your details to us. For that data the site manager is the controller and Golocker processes it on their behalf, as a processor under Article 28 GDPR.

You can contact us about anything in this notice at dpo@golocker.com.br.

2. The personal data we process

Depending on how you use our services, we process the following categories of data:

• Residents and registered users: name, mobile and WhatsApp number, email address, unit and site, contact preferences, access card number and registration status.
• Facial photo: if you register for facial access at a site that offers it, the photo you send us so that the access control system can recognise you.
• Parcels: recipient, description, reference code, collection PIN, delivery and collection times, and photos taken by the locker of the parcel and, at deposit and collection, of the person using the locker.
• Customers who order or rent: name, email, mobile number, country, tax identification number (such as CPF) where required by the payment method, order and payment details. Card details are entered directly with our payment provider and are never stored by us.
• App users: account identifier, device notification token and app preferences.
• Couriers: identification and receipt details you enter at the locker, and your login and delivery activity.
• Business customers and staff users: name, email, mobile number, company name, registration number, address, login credentials, language and time zone.
• Messages: the content of messages you exchange with our WhatsApp assistant and the delivery status of notifications we send you.
• Technical data: IP address, browser user agent, session identifiers and an audit trail of changes made to records.

3. Why we use your data and our legal basis

• Delivering and collecting parcels, including notifying you by WhatsApp, SMS, email or push notification and showing your deliveries on a status page. Legal basis: performance of a contract (Article 6(1)(b)) or, where the site manager registered you, their and our legitimate interest in providing the delivery service at the site (Article 6(1)(f)).
• Registering you through WhatsApp and working out which unit or section you mean from the text you send. Legal basis: performance of a contract (Article 6(1)(b)).
• Facial access: checking that your photo contains a single, clear face and sharing it with the site's access control system. Because a facial image used to identify you is a special category of data, we rely on your explicit consent (Articles 6(1)(a) and 9(2)(a)). You can withdraw it at any time without affecting other services.
• Processing orders, rentals and payments, sending confirmations and handling refunds. Legal basis: performance of a contract (Article 6(1)(b)).
• Invoicing, accounting and tax. Legal basis: legal obligation (Article 6(1)(c)).
• Security, fraud prevention, troubleshooting and audit, including keeping locker photos and an audit trail as evidence of who deposited or collected an item. Legal basis: legitimate interests (Article 6(1)(f)) in protecting users, items and our systems.
• Signing in to the app or admin panel and verifying mobile numbers. Legal basis: performance of a contract (Article 6(1)(b)).

4. Automated processing

We use automated tools to check the quality of facial photos and to read the unit or section from registration messages. These tools only support registration; they do not make decisions that produce legal or similarly significant effects on you within the meaning of Article 22 GDPR. If a check fails, you can try again or contact the site manager or us.

5. Who we share your data with

We do not sell your personal data. We share it only as needed for the purposes above with:

• The site manager of the building or site where you use the lockers, and the access control or building management systems they connect to our platform.
• Messaging providers that deliver WhatsApp, SMS, email and push notifications (such as Twilio, Meta and Google Firebase).
• Payment providers that process card and Pix payments (such as Stripe, Safe2Pay and Cora).
• Hosting and infrastructure providers that store our data and photos and provide face detection (Amazon Web Services).
• AI service providers that interpret registration messages on our behalf.
• Error monitoring and email delivery providers that help us keep the service reliable.
• Authorities, courts or advisers where the law requires it or to establish, exercise or defend legal claims.

Our service providers act as processors under written agreements and may only use your data on our instructions.

6. International transfers

Some of our providers process data outside the European Economic Area, including in the United States. Where a country has not been recognised by the European Commission as providing an adequate level of protection, we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the Standard Contractual Clauses approved by the European Commission, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

7. How long we keep your data

• Parcels not linked to an order and their photos: up to 12 months after delivery.
• Orders, rentals and related parcels: up to 3 years, or longer where tax and accounting law requires it.
• Facial photos: until you withdraw your consent, leave the site or the site manager removes your registration.
• Resident and account details: for as long as you are registered or have an account, and then deleted or anonymised.
• Integration and server logs: up to 1 month.
• Audit trail: a limited history of recent changes to each record.
• Session cookies: until you close your browser, and at most 4 hours.
• Records of privacy requests and how we answered them: 3 years, to show that we complied.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict how we process your data;
• receive the data you provided in a structured, machine-readable format (portability);
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting processing carried out before you withdrew it;
• lodge a complaint with a data protection supervisory authority, in particular in the EU Member State where you live or work.

To ask for your data to be erased, use the form below: we send a one-time code to your email address or mobile number to confirm it is yours. For any other right, email dpo@golocker.com.br. If you have a mobile app account you can also delete it from the app. Where a site manager is the controller of your data, we will pass your request on to them and help them respond. We answer within one month and may ask you to confirm your identity.

9. Cookies

Our web pages only use cookies that are strictly necessary for them to work: a session cookie and a security token that protects forms against cross-site request forgery. We do not use analytics, advertising or tracking cookies. Some pages load fonts and scripts from content delivery networks, which receive your IP address in order to deliver them.

10. Security

We protect your data with technical and organisational measures appropriate to the risk, including encrypted connections, access controls based on roles, time-limited links to photos and payment pages, and records of who changed what.

11. Children

Our services are not directed at children. Children should only be registered at a site by a parent or guardian.

12. Changes to this notice

We may update this notice from time to time. The date at the top shows when it last changed. If we make significant changes we will let you know through the service.