Privacy Policy
How HOWZIT handles personal data, in particular the messages and files that reach the school through WhatsApp.
Last updated
Who is responsible for your data
The party responsible (the controller, in the terms of Brazil's General Data Protection Law, the LGPD, Law No. 13,709/2018) is the school HOWZIT English: Maryke Wijma, sole proprietor (empresária individual), CNPJ 37.097.981/0001-47, with its registered office in São Paulo – SP, Brazil.
This policy applies to anyone who studies or has studied at HOWZIT, who asked for a trial lesson, who teaches at the school, and anyone who writes to the school's WhatsApp or visits this site.
What data we collect
We collect only what the school needs to teach, to bill and to talk to you:
- Students: name, email, phone, timezone, date of birth (to confirm you are an adult and to greet you on your birthday), CPF and address (for billing), sex (only to write to you in the way that suits you), what you tell us about your English and your work and, if you choose, a profile picture.
- The history of your lessons, credits and payments, and the notes teachers write about what was covered in each lesson.
- Anyone who asked for a trial lesson: name, WhatsApp number, email and the answers given in the request (how they heard of the school, level, goals and preferences).
- Teachers: name, email, identity document and payment details, hourly rate and statements, and the professional profile.
- Anyone who writes to the school's WhatsApp: the phone number, the profile name WhatsApp reports, the text of the messages and the images, audio and documents sent, with the date and time of each.
- Recordings of lessons and short videos about them, only with your consent.
- Minimal technical data: sign-in sessions, error records with no personal data, and a count of clicks on the short links in our messages, with no IP address and no cookies.
- This website sets no cookies, uses no analytics tools and does not identify its visitors.
We do not sell personal data, we do not use it for third-party advertising, and we do not collect data about anyone under 18: the school does not teach minors.
WhatsApp messages and media
HOWZIT uses Meta's WhatsApp Business Platform (the Cloud API) to talk to students, prospective students and teachers through the school's number. We keep, on our own servers, the text of the messages received and sent, the images, audio and documents attached, and the delivery record of each message (sent, delivered, read).
The school's number also works in the WhatsApp Business app on the school's phone. What the team types there reaches our system and is kept in the same way.
Who reads them: the school's administrative team. A teacher reads only the conversation with their own students, without seeing the phone number, for as long as they are that student's teacher, and each reading is recorded.
Before a message is stored, we remove from it any password or card number somebody typed by mistake.
Meta also processes the messages in order to deliver them, under the WhatsApp Business Platform's own terms. Copies also remain on your device and on the school's phone, which are not under our control.
To stop receiving automatic messages from the school, write STOP, SAIR or PARAR to the school's WhatsApp.
What we use the data for, and on what legal basis
Each use below rests on a legal basis in the LGPD (Article 7):
Teaching, scheduling and following your progress
Data:Identification, contact, lesson history, teachers' notes
Legal basis:Performance of a contract (Art. 7, V)
Billing the lessons through Asaas
Data:Name, email, phone, CPF, address and payments
Legal basis:Performance of a contract (Art. 7, V) and a legal or tax obligation (Art. 7, II)
Booking and giving the trial lesson, and reminding you of it
Data:Name, WhatsApp, email and the answers in the request
Legal basis:Preliminary steps at the data subject's request (Art. 7, V) and legitimate interest for the reminders (Art. 7, IX)
Answering whoever writes to the school's WhatsApp and keeping the conversation
Data:Number, profile name, messages, images, audio and documents
Legal basis:Performance of a contract for students (Art. 7, V) and legitimate interest for whoever writes first (Art. 7, IX)
Keeping the record to defend the rights of the school and of data subjects in a dispute
Data:Messages, payments and lesson records
Legal basis:Regular exercise of rights (Art. 7, VI)
Telling students and teachers about the school's news and special dates
Data:Name, language and the dates the school already holds
Legal basis:Legitimate interest (Art. 7, IX, and Art. 10), with a right to object at any time
Recording lessons and using short videos to promote the school
Data:Voice and image
Legal basis:Consent (Art. 7, I), which can be withdrawn at any time
Showing teachers, student stories and reviews on this site
Data:First name, photograph and text
Legal basis:Consent (Art. 7, I); for public Google reviews, data made public by whoever wrote it (Art. 7, § 4)
Hiring and paying teachers
Data:Identification, document and payment details
Legal basis:Performance of a contract (Art. 7, V) and a legal obligation (Art. 7, II)
Keeping the platform secure and recording who opens sensitive data
Data:Access and error records
Legal basis:Legitimate interest (Art. 7, IX)
How long we keep it
The term depends on who you are to the school. You can ask for erasure at any time (see “Your rights”).
Students: record, history and WhatsApp messages
5 years after the end of the contract
Anyone who asked for a trial lesson and never became a student
24 months
Numbers never linked to anybody, for example someone who only wrote to the school's WhatsApp
12 months
Teachers
5 years after leaving
Financial records (charges and payments)
The term the law requires, without identifying the person after a request for erasure
A message the sender deleted in WhatsApp
Hidden at once and erased within 30 days
Encrypted backups
Expire within 12 months
After the term, the data is erased or anonymised.
International transfer of data
Meta, Anthropic, Amazon Web Services and Google process data outside Brazil, in particular in the United States. This is an international transfer of data (LGPD, Art. 33).
We make it only to provide the service this policy describes, with each provider's contractual terms as the guarantee of a degree of protection compatible with the LGPD's.
The automated assistant
Some WhatsApp messages are read by an automated assistant, which identifies what the person wants (for example, to move a lesson or to ask a question) and answers or passes the message to the right person at the school.
It does not decide about your contract, your price or your teacher. You can ask for a review of any decision taken solely by automated means that affects your interests (LGPD, Art. 20), and you can talk to a person at any time.
Your rights
Under the LGPD (Art. 18), you can ask HOWZIT, at any time, to:
- Confirm that we process data about you and have access to it, as a copy.
- Correct data that is incomplete, inaccurate or out of date.
- Erase data that is unnecessary, processed against the law, or processed on your consent.
- Receive your data in a format another service can read (portability).
- Object to processing that rests on legitimate interest, such as the messages about news.
- Withdraw a consent, for example the one for recordings, and learn with whom we share the data.
To exercise any of them, write to the school's WhatsApp or to ribas@howzit.com.br. We reply within 15 days. We may ask you to confirm that you are the data subject before handing the data over or erasing it.
You can also complain to Brazil's National Data Protection Authority (ANPD).
How to ask for your data to be deleted
To delete your data, including the WhatsApp messages and files linked to your number, write to the school's WhatsApp with the sentence “I want to delete my data”, or send an email to ribas@howzit.com.br with the subject “Data deletion”.
We confirm that the request is yours, erase your personal data and the WhatsApp messages and files linked to your number, and reply within 15 days to say what was done.
What the law requires us to keep, such as the financial record, stays without identifying you. Encrypted backups expire within 12 months. Meta and your device hold copies of their own, beyond our reach: you delete the messages on your phone in WhatsApp itself.
How we protect the data
Access to the platform is restricted to the team and protected by individual sign-in. Connections use HTTPS, backups are encrypted, and sensitive data such as CPF, documents and payment details is opened only by those who need it, and every opening by anyone other than the data subject is recorded.
If a security incident could cause you significant harm, we will tell you and the ANPD, as the law requires.
Contact
HOWZIT's data protection officer (the “encarregado”): João Machado Ribas, ribas@howzit.com.br. You can also reach us on the school's WhatsApp.
Changes to this policy
If we change this policy, we will publish the new version at this address, with the date of the edition, and we will tell students when the change affects how their data is used.