Assessment privacy

The data controller is POWER SOLUTIONS BRASIL LTDA. For questions about personal data, use the channel indicated in the POWER Privacy Policy.

Participation uses a protected technical cookie, opaque identifiers, the version of the accepted rules, start and end times, attempt status, total correct answers, and a cryptographic digest of the submission. The database will keep the set and order of the questions delivered in order to validate the answers.

The network address will be hashed with a server secret to limit abuse. These identifiers are pseudonymous and may constitute personal data: they are not advertised as irreversible anonymization.

The session cookie is HttpOnly, Secure, and SameSite=Lax on the published site, accessible to the server, and lasts up to seven days. Its purpose is to keep a single active attempt and prevent reuse across sessions. Participation must take place directly on the site’s page, outside of third-party embeds.

Provisional answers are kept in the tab’s sessionStorage, without name or address. This storage allows resuming after a refresh in the same tab; it does not guarantee answer synchronization across tabs. Local answers are removed after submission or once expiration is confirmed.

The records are used to manage the time limit, grade the assessment, present the result, and protect the integrity of the service. Hosting and database providers used by the site may process the technical records under security measures. The assessment does not require named registration. Only after a perfect score of 10 can the participant request a shirt by providing name, email, WhatsApp / mobile number, size, and full address. No CPF, RG, or card details are requested. Order data is sent to the POWER team via Resend, using the configuration already used by the site, and may be shared with those responsible for delivery only to the extent necessary. This is an operational notification, not a marketing sign-up.

Optional events follow the site’s cookie preferences. Challenge metrics do not include question text, answers, internal identifiers, address, or the exact individual score: when applicable, performance is classified into ranges. Participating does not authorize sending marketing communications.

Records for each attempt remain available for seven days from its start. After that period, the application no longer retrieves the attempt or its result. A daily routine removes expired records from the operational database, usually by the following daily run, with a possible variation of up to one hour in scheduling; operational failures may delay execution. Security counters expire at the end of their window and are removed by the same routine.

Contact and address data, size, and the content of each order’s notification are kept in the operational database for 90 days from the request, even after the technical attempt is discarded. In the following daily routine, this data and its association with the session are removed. A minimal redemption control remains in place — including the order identifier, a cryptographic digest of the email with a server secret, and dates — while the challenge is active, to enforce the one-shirt-per-email limit. This digest is pseudonymous, not anonymous, and is not used for marketing.

Discarding the database does not erase the email already received by the team nor the email provider’s records. These copies follow the support, delivery, and retention management of their respective owners; deletion requests can be sent to POWER.

Infrastructure backups and logs follow the providers’ cycles and policies; operational discarding does not mean immediate removal of all backup copies. The tab’s provisional answers are cleared once submission, expiration, or unavailability of the attempt is confirmed by the server.

Processing strictly necessary for the assessment requested by the participant is based on the performance of the participation conditions (art. 7, V, of the LGPD). Proportional security and abuse-prevention controls serve the legitimate interest of protecting the service and its participants (art. 7, IX), without using the records for advertising or named identification.

Optional metrics depend on the consent managed in the cookie preferences. Use of delivery data is limited to fulfilling the voluntary shirt request and the conditions stated in the form. Confirmation of these conditions is recorded together with the notice version. There is no automatic authorization for marketing campaigns.

You may request information, access, correction, and deletion, when applicable, through POWER’s channels. The team may request only the information necessary to verify the legitimacy of the request. Do not share session tokens or answer keys through the support channel.