BnkFood Privacy Policy

1. Who We Are and Scope of This Policy

BNK Tecnologia is the developer and distributor of BnkFood, a system made up of an Android mobile app and a desktop hub. This policy describes how personal data related to BnkFood is processed.

The establishment operating BnkFood (canteen, snack bar, restaurant, food truck or similar) is the controller of the operational data it enters into the system. BNK Tecnologia provides the software tool and does not process that operational data: it neither accesses nor hosts it on its servers. BNK Tecnologia is the controller only of the licensing and commercial contact data it receives directly.

2. Local-First Architecture (important)

BnkFood does not create user accounts in the cloud and requires no online registration. The mobile app works on a local network (LAN), paired with the hub installed on the establishment's computer. All operational data is stored on the local hub (SQLite database on the establishment's computer), under the establishment's exclusive control.

Mobile device access to the hub is controlled by device pairing. Revoking a device on the hub removes its access to the system immediately.

3. Data Processed in the Establishment's Environment

As part of BnkFood's local operation, the system processes and stores on the establishment's hub:

• Items and products: menu, prices, categories and stock control.
• Orders and values: orders placed, items requested, service channels (counter, table, take-away, delivery) and payment methods.
• Credit customers: name and contact details entered by the establishment to manage store credit (tab).
• Users and profiles: access credentials (numeric code) of system operators (servers, kitchen, admin).
• Event logs: operation logs, cancellations and end-of-day close history.

This data stays exclusively on the establishment's local hub and is not sent to BNK Tecnologia's servers through the app.

4. Technical Data and Telemetry

The mobile app may send technical logs (errors, diagnostics, communication failures) to the establishment's hub to support system stability and technical assistance. These logs contain no personally identifiable data and are not transmitted to BNK Tecnologia's servers.

5. Data Held by BNK Tecnologia

BNK Tecnologia receives and stores directly only:

• Licensing and commercial management data: licensee identification and contact, hub code (`central_id`), contracted plan and enabled features.
• Voluntary commercial contact data: information provided via the contact form or WhatsApp on bnk.tec.br.

BNK Tecnologia does not access, host or process the operational data stored on the establishment's local hub.

6. App Permissions (Android)

The BnkFood app (Android) may request the following permissions, depending on the features used:

• Local network access: required for communication with the establishment's hub over Wi-Fi.
• Storage: used to save temporary operational files on the device.
• Camera (if applicable): used for photo or code-scanning features, when available in the installed version.

Permissions are requested only when needed for the corresponding feature. Check the permissions declared on the app's Google Play listing for the installed version.

7. Purposes and Legal Basis (LGPD)

Data processing by BNK Tecnologia, under Brazil's General Data Protection Law (LGPD, Law 13.709/2018), maps each purpose to its legal basis:

• Providing the license and technical support: contract performance (art. 7, V).
• Technical diagnostics, security and product improvement: legitimate interest (art. 7, IX), assessed through a proportionality test and limited to the data subject's reasonable expectations.
• Handling commercial contact requests made by the data subject (form or WhatsApp): preliminary procedures for a contract at the data subject's request (art. 7, V) and, where applicable, consent (art. 7, I).
• Compliance with legal or regulatory obligations: art. 7, II.

The data subject may object to processing based on legitimate interest and request information about the assessment carried out, under article 18 of the LGPD.

8. Data Sharing

BNK Tecnologia does not sell or trade personal data. Data may be shared only with:

• Essential service providers: such as the licensing system hosting, under contracts that ensure data protection.
• Competent authorities: when required by law or a court order.

9. International Data Transfer

The licensing and commercial contact data held by BNK Tecnologia is processed on cloud computing servers located outside Brazil, currently in the United States of America, on Amazon Web Services (AWS) infrastructure. This constitutes an international data transfer under article 33 of the LGPD.

This transfer relies on the safeguards provided by the LGPD, through contractual data protection guarantees signed with the infrastructure provider (including data protection clauses) that ensure a level of protection compatible with that required by Brazilian law. BNK Tecnologia does not claim to hold specific certifications beyond these contractual guarantees.

The establishment's operational data (products, orders, customers, events) is not transferred by BNK: it stays on the local hub, at the establishment itself, and does not leave for servers abroad through the tool.

10. Security

BnkFood adopts the following security measures:

• License verification by Ed25519 digital signature, preventing use with invalid or tampered licenses.
• Device-authenticated sessions (device pairing), with revocation controlled by the establishment.
• Encryption of sensitive authorization codes in local storage.
• Communication confined to the establishment's local network, with no exposure to public networks from the app.

In addition to technical measures, BNK Tecnologia adopts administrative and organizational measures to control access to the licensing data it holds.

11. Security Incident Notification

If a security incident occurs involving personal data under BNK Tecnologia's responsibility that may entail relevant risk or harm to data subjects, BNK Tecnologia will report the incident to the National Data Protection Authority (ANPD) and to the affected data subjects within a reasonable period, under article 48 of the LGPD. Operational data on the local hub is the establishment's responsibility, which is in charge of notifying any incidents in that environment.

12. Data Retention

Operational data on the local hub is retained by the establishment according to its own needs and internal policy, and can be deleted at any time by the establishment itself.

Licensing and commercial contact data held by BNK Tecnologia is retained for the duration of the contractual relationship. After it ends, data is deleted or anonymized, except for retention required by law, in particular: commercial and tax records for up to 5 (five) years, due to the applicable limitation periods (Brazilian Consumer Protection Code and tax law); and any other applicable legal periods. Once these periods elapse, data is deleted or anonymized.

13. Data Subject Rights (LGPD)

Under the LGPD, the data subject has the right to: confirm whether data is being processed; access personal data; correct incomplete or inaccurate data; request anonymization, blocking or deletion of unnecessary data; request portability; object to processing based on legitimate interest; withdraw consent; and lodge a complaint with the National Data Protection Authority (ANPD).

For operational data stored on the local hub, requests must be directed to the establishment operating BnkFood, which is the controller of that data. For licensing and commercial contact data held by BNK Tecnologia, requests must be sent to contato@bnk.tec.br. We will respond to requests within 15 days.

14. Account and Data Deletion

For detailed instructions on removing the app, revoking devices and requesting deletion of data from BNK Tecnologia, see our Account and Data Deletion page at bnk.tec.br/en/bnkfood/delete-account. Alternatively, you can write to contato@bnk.tec.br.

15. Data Protection Officer (DPO) and Contact

BNK Tecnologia maintains a channel for exercising the rights provided under the LGPD and for contacting the Data Protection Officer (DPO), under article 41 of the LGPD. The DPO can be reached at contato@bnk.tec.br, which receives and forwards data subject requests and communications from the ANPD.

16. Changes to This Policy

This Privacy Policy may be updated periodically. The current version, with the date of the last modification, is published on this page. We recommend checking it regularly.