Privacy and Data Protection Policy

1. Who we are

The Joy School respects the privacy of families, students and everyone who visits our websites. This policy explains clearly what personal data we collect, why we collect it and how you can exercise your rights, under the Brazilian General Data Protection Law (Law No. 13,709/2018, “LGPD”).

The controller of the data processed on the websites listed below is:

The Joy School is a network of bilingual schools that operates through company-owned and franchised schools. Each franchised school is an independent company and is the controller of the data it processes directly, for example when it handles enquiries, visits and enrollments at that school.

2. Who this policy applies to

This policy applies to everyone who accesses or submits data through the following websites:

It applies to parents and guardians, students, job applicants, prospective franchisees and any visitor. The websites of each franchised school may have additional policies.

3. What data we collect

We collect only the data needed for each purpose. It reaches us in three ways.

Data you give us

• Contact and school visit forms: name, email, phone number and the message you write. When provided, also your child's name, age or intended grade and the school you are interested in.
• Careers: name, contact details, CV and the professional information you send us.
• Franchise enquiries: name, email, phone number, city and available investment range.
• Joy Store: account data (name, email, encrypted password and the other details requested in the sign-up form), the student's school and class, and order history.
• WhatsApp and email: the content of the conversations you start with us.

Data collected automatically

When you browse, we record your IP address, browser and device type, pages visited, where your visit came from (for example, an ad) and interactions with the page. This is done through cookies and similar technologies, described in section 6.

Payment data

Joy Store payments are processed by Rede. We do not store your full card details.

4. How we use your data

Each use of data has a defined purpose and a legal basis under article 7 of the LGPD.

We do not use your data for decisions made solely by automated means that affect your interests.

5. Children's and teenagers' data

Our websites are intended for adults. Data about children and teenagers only reaches us when provided by a parent or guardian, for example when scheduling a visit or registering on the Joy Store.

We always process this data in the best interests of the child and teenager, as required by article 14 of the LGPD. This means that:

• we only ask for the minimum needed, such as name, age, grade and school;
• we do not use children's data for targeted advertising;
• when the legal basis is consent, it is given specifically and prominently by a parent or legal guardian;
• students' images are only published with specific authorization from their parents or guardians.

If you become aware that a child has sent us data without their parents' or guardians' authorization, please contact the Data Protection Officer (section 12) so we can delete it.

6. Cookies and tracking technologies

Cookies are small files stored in your browser. We use essential cookies without asking for consent, because the website does not work without them. The others are only activated if you accept them in the cookie banner, and you can change your choice at any time through the “Cookie preferences” button in the bottom corner of the screen.

You can also block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the websites from working.

7. Who we share data with

We do not sell personal data. We only share what is necessary, with:

• The Joy School schools: if you request contact or a visit, your data goes to the school you chose, which will then assist you.
• Suppliers acting on our behalf: website hosting (HostGator), CRM and marketing automation (RD Station), audience analytics (Google, Microsoft), advertising (Google, Meta), Joy Store payment processor (Rede) and anti-spam tool (CleanTalk). These suppliers may only use the data to provide the contracted service.
• Authorities: when required by law, court order or a request from a competent authority.

Our websites link to social networks and other websites. When you visit them, their own privacy policies apply.

8. International transfers

Some suppliers, such as Google, Meta and Microsoft, may store data on servers outside Brazil, mainly in the United States. These transfers comply with article 33 of the LGPD and ANPD Resolution CD/ANPD No. 19/2024, using standard contractual clauses or other safeguards recognized by the ANPD.

9. How long we keep data

We keep data only for as long as each purpose requires, or for the period required by law.

At the end of the period, data is deleted or anonymized. We may keep it longer only to comply with a legal obligation or defend rights.

10. Security

We take technical and administrative measures to protect your data, including encrypted connections (HTTPS) on all websites, encrypted password storage, access restricted to the people who need the data, regular system updates and backups.

No system is completely immune to incidents. If an incident occurs that may pose a relevant risk or harm to you, we will notify you and the Brazilian National Data Protection Authority (ANPD), as required by law.

11. Your rights

The LGPD gives you the right, at any time and free of charge, to:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or outdated data;
• request the anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
• request the portability of your data to another provider;
• know who we share your data with;
• withdraw your consent and request the deletion of data processed on that basis;
• be informed about the possibility of not giving consent and its consequences;
• object to processing based on another legal basis if it breaches the law;
• request a review of decisions made solely by automated means.

To exercise any of these rights, contact the Data Protection Officer (section 12). We may ask for information to confirm your identity. We respond in simplified form immediately and, if you request a full response, within 15 days. You may also file a complaint with the ANPD.

12. Data Protection Officer and contact

For questions about this policy or to exercise your rights, contact our Data Protection Officer (DPO), appointed under article 41 of the LGPD:

13. Updates to this policy

We may update this policy to reflect changes to the websites or to the law. The date of the last update is always shown at the end of this page, and relevant changes will be highlighted on the websites.

Last updated: November 12, 2026