1. Mandatory legitimacy review
No data is provided before the request is reviewed. We verify whether the authority is identified and competent for the request, whether it arrived through an official channel, whether there is an explicit legal basis and a court order where the law requires one, and whether the scope is determined, indicating which data and which data subjects are involved.
Requests that do not meet these requirements are not fulfilled immediately: we ask for clarification in writing before providing any response.
2. Challenging unlawful requests
Requests without a legal basis, overly broad or generic requests, requests outside the authority's competence, or requests that would breach confidentiality without the required court order are refused or challenged through the appropriate means, with legal support. The refusal and its reasoning are recorded.
3. Data minimization
When a request is legitimate, we provide only the minimum necessary to fulfill it: only the fields, the period and the data subjects indicated. We do not perform full exports of databases.
- Third-party data that appears alongside the requested content is removed before sending.
- Credentials are never shared, including Meta integration access tokens, API keys and passwords.
- The response is sent through the same official channel as the request, describing exactly what was provided.
4. Record-keeping of requests
Every request is recorded, including those that are refused, with the date of receipt and of the response, the authority and originating proceeding, the channel of entry, the scope requested, the legitimacy review and its conclusion, the decision taken, the data actually provided and the people involved in the decision and its execution.
5. Notice to the user
We inform the data subject about the existence of the request whenever the law allows, except where confidentiality is imposed by the authority or where there is an express legal prohibition.
6. How to submit a request
Public authorities should send requests to contato@sistemalume.com.br, attaching the official document supporting the request, the identification of the authority and of the proceeding, a precise description of the data and data subjects, and the deadline for the response.
LUME is operated by 69.327.004 MANOELA BICA GOMES, a company registered in Brazil under CNPJ number 69.327.004/0001-85. The person responsible for the decisions described on this page is Manoela Bica Gomes.