1. INTRODUCTION
ArcelorMittal Brazil adopts a global Data Protection procedure, applied to the whole group, which guarantees a protection standard for the personal data processed by it, in compliance with the General Personal Data Protection Law (Law nº 13,709/2018).
The purpose of this Policy is to show how ArcelorMittal Brazil collects and uses users' personal data.
Other digital platforms or applications made available by ArcelorMittal Brazil will have specific Terms of Use and Privacy to process personal data carried out on them, and they are complementary to this Policy.
2. ABOUT THE DATA WE COLLECT
2.1. How we collect data. Data, including Personal Data, may be collected when you submit them or when you interact with our environments and services.
In general, you are not required to disclose your personal data as a condition to use ArcelorMittal Brazil’s website or applications.
However, in its interactions, ArcelorMittal Brazil will ask you to provide your personal data, such as name, email address, phone number and address, which are considered necessary personal information. If you choose not to provide some of this Data, we may be unable to provide you with all or part of our services.
2.2. Update and Veracity of Data. You are responsible for providing complete and true personal data. Thus, in order for ArcelorMittal Brazil to keep the veracity and accuracy of your data, we provide the Service Channel indicated in item 7.4 below so that you can request the correction and updating of your data in case they are incomplete, inaccurate or out of date.
Likewise, we are not obliged to process or handle any of your Data if there is reason to believe that such processing or handling could impute to us any violation of any applicable law, or if you are using our environments for any illegal or unlawful purposes or contrary to our Culture of Integrity.
2.3. Database. The database resulting from Data collection is our property and is under our responsibility; its use, access and sharing, when necessary, will be made within the business limits and purposes described in this Policy.
2.4. Cookies and similar technologies. Cookies are small text files that are placed on your computer by the websites you visit. They are widely used to make websites work and to work more efficiently, in addition to providing your information to ArcelorMittal Brazil. Moreover, we use cookies to store your preferences.
You will be able to control the data collected by cookies through your internet browser. Learn more about our Cookies Policy available.
2.4.1 Other tracking mechanisms. In addition to the use of cookies for session-based tracking to identify individuals on the ArcelorMittal Brazil website(s), several other tracking mechanisms are available. That includes cache-based tracking mechanisms, which use client-based storage that used storages to identify browser instances and to determine websites visited previously by using multiple caches:
(i) Web cache
(ii) DNS cache
(iii) Operational cache
Furthermore, a 'Unique Identifier' can be used to monitor activities on the website. Such unique identifier may consist of one or more values that can be read by the web service when the user navigates the website. Thus, the user can be tracked on several different websites, belonging to different entities, which is not directly possible with cookies. The traceable information includes:
(i) Network and location;
(ii) Device;
(iii) Operating system instance;
(iv) Browser version.
You can block the data collection of these tracking mechanisms through your internet browser using the "Private or Anonymous Browsing" functionality, if available. Otherwise, use a web browser that has such feature.
IMPORTANT: If you use "Private or Anonymous Browsing", ArcelorMittal Brazil can neither guarantee its correct functioning nor whether your browser will block all of the tracking mechanisms mentioned above. ArcelorMittal Brazil is not responsible for any damage caused to the Data Holder due to the incorrect functioning of the "Private or Anonymous Browsing" function.
2.4.2. All technologies used will always respect the current legislation and the terms of this Policy.
2.5. If ArcelorMittal Brazil uses only automated decisions, we will provide, upon request, clear information regarding the criteria and procedures used, taking into account the commercial and industrial secrets.
3. HOW WE SHARE DATA AND INFORMATION
3.1. Data sharing hypotheses. Data collected and recorded activities can be shared:
(i) Among ArcelorMittal's subsidiaries worldwide;
(ii) With competent judicial, administrative or governmental authorities, whenever there is a legal determination, request, requisition or court order; and
(iii) Automatically, in case of corporate moves, such as mergers, acquisitions and incorporations.
4. HOW WE PROTECT YOUR DATA AND HOW YOU CAN ALSO PROTECT THEM
4.1. Sharing passwords. You are also responsible for the confidentiality of your Personal Data. You should always be aware that sharing passwords and access data violates this Policy and may compromise the security of your Data and of our environments.
4.2. Information security. The security of all personal data processed is extremely important to us. ArcelorMittal Brazil adopts possible technical and administrative measures to ensure the security of information in its systems, through protocols, controls, policies, procedures and guidelines to keep such measures.
4.3. Access to Personal Data, proportionality and relevance. Internally, the Personal Data collected is accessed only by duly authorized professionals, respecting the principles of proportionality, need and relevance to the objectives of our business, in addition to the commitment to confidentiality and preservation of your privacy under the terms of this Policy.
4.4. External Links. When you use our Environments, you can be taken, via link, to other portals or platforms, which can collect your information and have their own Data Handling Policy.
4.4.1 It is up to you to read the Privacy and Data Treatment Policies of such portals or platforms outside of our Environment, and it is your responsibility to accept or reject them. We are not responsible for the Privacy and Data Treatment Policies of third parties or for the content of any websites, content or services linked to environments other than ours.
2.5. Processing by third parties under our guideline. If outsourced companies carry out on our behalf the Handling of any Personal Data that we collect, they will mandatorily respect the conditions stipulated herein and the information security standards.
5. HOW WE STORE YOUR PERSONAL DATA AND ACTIVITY LOG
5.1. The Personal Data collected and the activity records are stored in a safe and controlled environment, being kept only for the necessary period. ArcelorMittal Brazil has specific Policies and Procedures for retention and management, and personal data will be maintained according to the following criteria:
(i) As long as the relationship between you and ArcelorMittal Brazil lasts;
(II) For the period required to fulfil our global legal and contractual obligations.
5.2. Longer storage times. For the purposes of auditing, security, fraud control, credit protection and preservation of rights, we may keep the history of registering your Data for a longer period of time in the event that the law or regulatory rule so establishes or for the preservation of rights.
5.3. The Data collected will be stored on our servers in Brazil, as well as in an environment of use of resources or cloud computing, which may demand transferring and/or processing this Data outside of Brazil.
6. WHAT ARE YOUR RIGHTS AND HOW TO YOU EXERCISE THEM
6.1. Your basic Rights. You will be able to ask ArcelorMittal Brazil to confirm the existence of Personal Data treatment, in addition to display or rectify your Personal Data, through the Contact Us, available on the corporate website, where there is a specific service channel on data protection.
6.2. Limitation, opposition and exclusion of data. Through the Contact Us you can also request:
(i) To limit the use of your Personal Data;
(ii) Express opposition and/or revoke consent regarding the use of your Personal Data; or
(iii) Request the deletion of your Personal Data collected by us.
6.2.1. If you withdraw your consent for fundamental purposes for the regular functioning of our environments and services, such environments and services may become unavailable to you.
6.2.2. If you request the deletion of your Personal Data, the Data may need to be kept for a period longer than the exclusion request, under the terms of article 16 of the General Personal Data Protection Law, in order to (i) comply with legal or regulatory obligations, (ii) study by a research agency, and (iii) transfer to a third party (subject to the data processing requirements set forth in the same Law). In all cases by anonymizing Personal Data, as long as possible.
6.2.3. Once the period for maintenance and legal need is over, Personal Data will be deleted using safe disposal methods, or used anonymously for statistical purposes.
7. INFORMATION ON THIS POLICY
7.1. Content change and update. You acknowledge our right to change the content of this Policy at any time, and without prior notification to you, depending on the purpose or need, such as for legal suitability and compliance with the provision of a law or norm that has equivalent legal force, and you are responsible to check it whenever you access our environments or use our services. The date of the last updated version will always appear at the end of this Policy.
7.1.1 In the event of updates to this document that demand a new consent, you will be notified through the contact channels you inform.
7.2. Inapplicability. If any item of this Policy is considered unenforceable by the Data Authority or the judicial authority, the other conditions will remain in full force and effect.
7.3. Electronic Communication. You acknowledge that all communication via e-mail, SMS, instant communication applications or any other digital, virtual and digital form, according to data informed in your registration, are also valid, effective and sufficient for the disclosure of any matter that refers to the services we provide, to your Data, and to the conditions of its provision, or any other matter addressed therein, with the only exception of what this Policy provides as such.
7.4. Customer Service. Should you need any clarification regarding the provisions of this Privacy and Data Processing Policy, you can reach ArcelorMittal Brazil’s ‘Contact Us’ on https://brasil.arcelormittal.com/contato.
7.5. Applicable law and forum. This Policy will be interpreted in accordance with the Brazilian law, in the Portuguese language, and the jurisdiction of its domicile is defined to settle any dispute involving this document, unless specific proviso of personal, territorial or functional competence by the applicable legislation.
7.5.1 In case you do not have a domicile in Brazil, and due to the services offered by the Company only in the country, you are submitted to Brazilian law, agreeing therefore, that in the event of a dispute to be resolved, the action must be filed at the District Court of Belo Horizonte/MG.
8. GLOSSARY
8.1. For the purposes of this Policy and in order to be better understood, the following definitions and descriptions should apply:
(i) Data: Any information entered, processed or conveyed through Our Environments.
(ii) Personal Data: Data related to an identified or identifiable natural person.
(iii) Anonymization: Use of reasonable and available technical means at the time of Handling, whereby data loses the possibility of being associated, either directly or indirectly, to an individual.
(iv) Cloud Computing: It is the service virtualization technology built from the interconnection of more than one server through a common information network (e.g., the Internet), aiming to reduce costs and increase the availability of sustained services.
(v) Our Environments: Digital Platforms and Applications owned by ArcelorMittal Brazil.
(vi) Access Account: Credential required to use or access the exclusive features of Our Environments.
(vii) Cookies: Small files sent by Our Environments, saved on your devices, that store preferences and a few other information, in order to personalize your navigation according to your profile.
(viii) Uniquely automated decisions: These are decisions that affect a user and that have been programmed to work automatically, without human operation, based on automated treatment of personal data.
(ix) Handling: Any operation performed with Personal Data, such as those referring to the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, elimination, evaluation or control of information, modification, communication, transfer, diffusion or extraction.
Updated on: June 10, 2020.