Legal
Privacy Policy
Processing of Personal Data · LGPD (Law No. 13,709/2018) · Version 2.0
Courtesy translation
This English text is a courtesy translation. The Portuguese version is the binding one and prevails if the two differ. Acceptance on this site records the Portuguese version. Read the Portuguese original
This Privacy Policy describes how SGA — Star Grading Authenticator collects, uses, shares, stores and protects your personal data, in accordance with the LGPD, the Brazilian General Data Protection Law (Law No. 13,709/2018), the Brazilian Internet Civil Framework (Law No. 12,965/2014) and the resolutions of the Brazilian National Data Protection Authority (ANPD). By using the portal or any SGA service, you declare that you are aware of the practices described in this document.
1. Who the controller is and how to reach us
SGA Importação e Graduação Ltda, CNPJ (Brazilian tax ID) 68.174.971/0001-91, with its registered office at Travessa Dom Romualdo de Seixas, nº 1476, Sala nº 2107, Ed. Evolution — Umarizal, Belém/PA, CEP 66.055-200, responsible for the portal stargrading.com.br and for the services of authentication, grading, encapsulation and certification of collectible cards, acts as the controller of the personal data processed in these activities.
For questions, requests related to the LGPD or to exercise your rights, use the email contato@stargrading.com.br, with the subject "Privacidade/LGPD", or the form available on the portal.
SGA will keep a channel accessible to data subjects. If a Data Protection Officer is formally appointed, their identity and contact details will be published in this Policy and on the portal, as required by the applicable law.
2. Who this Policy applies to
This Policy applies to visitors to the portal, participants in the pre-registration and in campaigns, registered users, clients, representatives of legal entities, senders and recipients of items, people who contact support and other data subjects whose data is processed by SGA.
3. What personal data we may process
3.1. Pre-registration, campaigns and communications
- Name, email, phone and/or WhatsApp, when provided.
- Communication preferences, origin of the registration, related campaign and records of consent, unsubscription or objection.
3.2. Account and authentication
- Name, email, phone and access credentials.
- Password hash, authentication identifiers, login records, date, time, IP address, origin of the access and version of the documents accepted.
- When social login is used, identifiers provided by the authentication provider, such as Google, according to the choice of the user.
3.3. Contracting, payment and logistics
- CPF or CNPJ (Brazilian tax IDs), when necessary for contracting, invoicing or tax obligations.
- Billing and delivery address, contact details, shipping instructions and tracking information.
- Transaction data, amount, payment method, status and identifiers of the payment processor. SGA does not need to store the full card number when the payment is processed by a specialized provider.
3.4. Items submitted, grading and certificate
- Description of the item, game, set, edition, year, number, language, declared value and notes provided by the user.
- Operational photographs and videos of the receipt, the opening of the package, and the front, back, edges, corners and surface of the item.
- Technical report, subgrades, final grade, authentication result, certificate number, images of the item and processing history.
3.5. Service and support
- Content of messages, requests, complaints, documents sent and service history.
- Metadata necessary for security, for authenticating the requester and for proving that the request was handled.
3.6. Technical and browsing data
- IP address, date and time of access, browser, operating system, type of device, pages accessed and security events.
- Cookies, identifiers and usage data, as described in Section 11 of this Policy.
Sensitive data
SGA does not intentionally request sensitive personal data for the normal provision of its services. If any exceptional processing becomes necessary, there will be a specific assessment, minimization and adequate information to the data subject.
4. Where we get the data from
- Directly from the data subject, during pre-registration, registration, contracting, submission, support or the exercise of rights.
- From representatives, senders or recipients authorized by the data subject.
- From authentication, payment, logistics and technology providers, within the purposes necessary for the service.
- Automatically, through technical records and cookies, respecting the applicable preferences.
5. Purposes and legal bases
| Processing | Purpose | Main legal basis |
|---|---|---|
| Pre-registration and marketing | Managing the sign-up and sending news, invitations and campaigns. | Consent, when required. The data subject may withdraw it or unsubscribe at any time. |
| Account and authentication | Creating and protecting the account, authenticating access and keeping records of acceptance. | Preliminary procedures and performance of a contract; legitimate interest for security, when applicable. |
| Orders and logistics | Processing submissions and receiving, storing, grading, encapsulating and returning items. | Performance of a contract and preliminary procedures. |
| Payment and tax obligations | Processing payments, issuing tax documents, preventing fraud and keeping mandatory records. | Performance of a contract, legal obligation and legitimate interest for fraud prevention. |
| Service communications | Informing about status, deadlines, pending matters, delivery and account security. | Performance of a contract. These messages are not marketing. |
| Grading and certificate | Producing the report, the grade, the technical images and a verifiable certificate. | Performance of a contract. |
| Minimal public certificate | Allowing the authenticity and integrity of the certificate to be verified. | Performance of a contract, with minimization and separation from the account data. |
| Support and rights | Answering requests, complaints and requests from data subjects. | Performance of a contract, legal obligation and regular exercise of rights. |
| Security and fraud | Detecting improper access, abuse, fraud and incidents. | Legitimate interest, subject to a necessity test, balancing and safeguards. |
| Non-essential analytics | Measuring performance and improving the portal through identifiers that are not necessary. | Consent, when applicable. |
6. Certificate, QR code and Pop Report
The public lookup of a certificate must contain only what is necessary to verify the item and the grading. SGA must not publish the name of the client, email, phone, address, order number, payment data, tracking, declared value, support conversations or internal account identifiers.
The public record may show:
- A certificate identifier that is not predictable and resists simple enumeration.
- Technical description of the item, set, edition, year, language and numbering.
- Authentication result, grade, subgrades and the strictly necessary dates.
- Images of the item without unnecessary metadata, such as location or EXIF data.
The existence of a public certificate does not prove who the current owner of the item is. Account and order data will be kept separate from the public record.
7. Who we share data with
| Category | Recipient | Data and purpose |
|---|---|---|
| Social authentication | Provider chosen by the user, such as Google. | Identifier, name and email necessary for the login. |
| Infrastructure and database | Hosting, authentication, database, storage and monitoring providers. | Account and order data, technical records and content necessary for the operation. |
| Payment | Institution or gateway shown at checkout. | Identification, amount, status of the transaction and data required by the payment method. |
| Logistics | The Brazilian post office, carriers, freight integrators and insurers selected. | Name, address, contact, declared value and shipping data. |
| Communications and support | Email, messaging and customer service providers. | Contact details and content necessary for the communication. |
| Accounting, legal and audit | Service providers bound by confidentiality. | Data strictly necessary for obligations and the defense of rights. |
| Authorities | Public bodies, regulators and the courts. | Only when there is a legal obligation, a valid order or the need to exercise rights. |
SGA does not sell personal data. Suppliers must receive only the necessary data and be bound by contractual obligations of confidentiality, security, cooperation, disposal and incident reporting.
8. International data transfers
Some technology, authentication, storage, communication or support suppliers may process data outside Brazil. Before making these transfers, SGA must map the countries and sub-processors involved and adopt a valid mechanism provided for in the LGPD and in the ANPD's Regulation on International Data Transfers.
- An adequacy decision recognized by the ANPD, when one exists.
- The ANPD's standard contractual clauses incorporated into the applicable contracts.
- Another mechanism provided for in Articles 33 to 36 of the LGPD and regulated by the ANPD.
Information about categories of suppliers, countries or regions of processing and the mechanism used may be requested through the privacy channel, subject to trade and industrial secrets.
9. How long we keep the data
| Category | Retention criterion |
|---|---|
| Pre-registration and marketing | Until consent is withdrawn or 24 months without interaction. A minimal record of the unsubscription may be kept for up to 5 years to avoid sending again by mistake. |
| Account and records of acceptance | While the account is active and, as a rule, for up to 5 years after it is closed or after the last contractual relationship, unless an obligation or a longer period applies. |
| Orders, billing, tax and logistics | For the time necessary for performance and for the applicable legal and limitation periods, normally up to 5 years, without prejudice to specific periods. |
| Photos of opening and receipt | As a rule, for 180 days after delivery to the client is confirmed, extendable while there is a complaint, an investigation or a dispute. |
| Technical images and grading report | As a rule, for up to 5 years after completion; then deletion or anonymization, unless there is a justified and documented need. |
| Minimal public record of the certificate | While the certificate remains valid, with periodic review of the need and with no public link to the client or to the order. |
| Service and support | As a rule, for up to 5 years after the request is closed, as needed for evidence and the exercise of rights. |
| Application access logs | For the applicable legal period, as a rule 6 months, subject to preservation orders and duly justified security needs. |
The periods may be shortened when the data is no longer necessary, or extended when there is a legal obligation, an order from an authority, fraud prevention, an incident or the regular exercise of rights. Data in backups is subject to the technical overwrite cycle and must not be reused for incompatible purposes.
10. Security and incidents
SGA adopts technical and administrative measures proportionate to the risks and to the nature of the data processed. These measures may include encryption in transit, access control, multi-factor authentication for administrative access, segregation of duties, credential management, audit records, backups, system updates and incident response procedures.
No system is absolutely secure. In the event of an incident that may cause relevant risk or harm to data subjects, SGA will assess it, record it and notify the ANPD and the affected data subjects within the applicable regulatory period, currently 3 business days, subject to specific legislation.
11. Cookies and similar technologies
Necessary cookies may be used for essential functions, such as security, authentication, keeping the session and indispensable preferences. Analytics cookies, non-essential functional cookies, advertising cookies and third-party cookies will stay disabled by default when they depend on consent.
- The banner must offer "Accept", "Reject non-necessary" and "Manage preferences" with equal prominence.
- The user will be able to choose by category and reopen their preferences at any time.
- The updated list must state the name, provider, category, purpose, duration and any international transfer of each cookie.
Refusing non-necessary cookies does not prevent the use of the essential functions of the portal.
12. Rights of data subjects
- Confirmation that processing exists and access to the data.
- Correction of incomplete, inaccurate or outdated data.
- Anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law.
- Portability, in accordance with the regulations and subject to trade and industrial secrets.
- Information about the public and private entities with which data was shared.
- Information about the possibility of not consenting and the consequences of refusing.
- Withdrawal of consent and deletion of the data processed on that basis, except in the cases where the law requires it to be kept.
- Objection to processing carried out without consent, in the event of a breach of the LGPD.
- Review of decisions taken solely on the basis of automated processing that affect their interests, when applicable.
Requests are free of charge and may require reasonable verification of identity. Confirmation and access in a simplified format will be provided immediately when possible; the complete declaration of access will be provided within 15 days. For the other rights, SGA will act without undue delay or will state the reasons of fact or of law that prevent the request from being met immediately.
The request must be sent to contato@stargrading.com.br, with the subject "Privacidade/LGPD". Answers that contain personal data will be delivered through a secure channel.
13. Marketing and promotional use of images
Sending marketing and the promotional use of images of the items are optional purposes and are not a condition for contracting the service.
- Marketing: depends on specific consent when that is the applicable basis, with an easy way to unsubscribe in each message.
- Images for performing the service and for the certificate: may be processed because they are necessary for the contract.
- Images for social media, advertising, portfolio or campaigns: depend on a separate, granular and revocable authorization.
Withdrawal does not affect earlier processing carried out validly, but it stops new promotional uses within a reasonable operational time.
14. Children and adolescents
Registration, contracting and the submission of items are intended for people aged 18 or over. Parents or guardians who wish to contract for the benefit of a minor must create the account and contract in their own name.
SGA does not intend to carry out profiling, behavioral advertising or the processing of data of children and adolescents for direct contracting. If we identify an account created by a minor without adequate representation, we may suspend access and delete the data, subject to legal obligations and the protection of the best interests of the minor.
15. Changes, versions and effective date
Each version of this Policy will be identified by a number, the date of the update and the date it takes effect. Relevant changes will be communicated in an adequate way. Changes that depend on consent will give rise to a new request, and material contractual changes may require a new acceptance of the Terms of Use.
Earlier versions must be archived for transparency and evidence.
16. Contact and petition to the ANPD
Privacy channel: contato@stargrading.com.br, with the subject "Privacidade/LGPD". Portal: stargrading.com.br.
If a data subject considers that their request was not adequately resolved, they may petition the Brazilian National Data Protection Authority, through the channels and under the requirements defined by the ANPD.
Legal and regulatory references
- Law No. 13,709/2018 — Brazilian General Data Protection Law (LGPD).
- Law No. 12,965/2014 — Brazilian Internet Civil Framework.
- Resolution CD/ANPD No. 15/2024 — Communication of Security Incidents.
- Resolution CD/ANPD No. 18/2024 — Role of the Data Protection Officer.
- Resolution CD/ANPD No. 19/2024 — International Data Transfers.
- ANPD guides on cookies, legitimate interest and the rights of data subjects.
- Law No. 15,211/2025 — Digital Statute of Children and Adolescents, when applicable.
SGA — Star Grading Authenticator · stargrading.com.br. Document subject to legal review before it takes effect.