LGPD — your rights.

This page gathers, in plain language, the rights that the Brazilian General Data Protection Law (LGPD, Law No. 13.709/2018) grants you and how to exercise them with Aston. It complements our Privacy Policy.

1. What the LGPD is

The LGPD sets out how companies and public bodies may collect, use, store and share personal data in Brazil. It applies to any information that identifies or can identify a person — from an e-mail address to an energy consumption history linked to a data subject.

In practice it requires three things from us: a legitimate reason for every piece of data we process, transparency about it, and giving control back to you whenever you ask.

2. Your rights

Right	What it means
Confirmation and access	To know whether we process your data and obtain a copy of it.
Correction	To correct incomplete, inaccurate or outdated data.
Anonymisation or blocking	To request anonymisation, blocking or deletion of unnecessary or excessive data, or data processed outside the law.
Portability	To receive your data in a structured format to take to another provider.
Deletion	To request deletion of data processed on the basis of your consent.
Information about sharing	To know which entities we have shared your data with.
Withdrawal of consent	To withdraw, at any time, consent previously given.
Objection	To object to processing based on legitimate interest.
Review of automated decisions	To request review of a decision made solely by an automated system that affects your interests.

3. How to exercise them

Send a request to our Data Protection Officer, [email protected], with the subject “LGPD — data subject request”, stating:

1. Your full name and the e-mail or phone number used in your contact with Aston;
2. Which right you wish to exercise (list above);
3. Details that help us locate your data, such as case number, consumer unit or company.

To protect you, we may request additional information confirming your identity before fulfilling the request. Exercising your rights is free of charge.

4. Deadlines and replies

• Acknowledgement of receipt — within 2 business days.
• Simplified reply — immediately, when the request can be met right away.
• Full reply — within 15 days, under art. 19 of the LGPD.

If we cannot fulfil the request, we will explain the factual or legal reason.

5. Data Protection Officer

The Data Protection Officer (DPO) is the person responsible for receiving requests from data subjects and from the Brazilian data protection authority, under art. 41 of the LGPD.

6. Children and teenagers

Our services are aimed at companies, public bodies and adults responsible for consumer units. We do not knowingly collect data from people under 18. If we identify such a record, the data will be deleted unless a legal obligation requires otherwise.

7. Security incidents

Should a security incident pose relevant risk or harm to data subjects, we will notify those affected and the ANPD within a reasonable period, describing the nature of the data involved, the risks and the measures taken — under art. 48 of the LGPD.

8. Complaints to the ANPD

If you believe your request was not properly handled, you may file a complaint with the Brazilian National Data Protection Authority (ANPD) through its official channels. We would rather resolve it directly with you, though — our ombudsman channel answers every message.