Effective date: November 8, 2026. Last updated: November 8, 2026.
This Policy explains how the band Antidemon handles the personal data of people who visit antidemonband.com, donate, buy products or contact us to book the band. It follows Brazil’s General Data Protection Law (Law 13,709/2018, LGPD), the Brazilian Internet Civil Framework (Law 12,965/2014) and the Consumer Protection Code (Law 8,078/1990). For visitors and donors outside Brazil, it also follows the EU General Data Protection Regulation (GDPR) and, where applicable, US laws such as the California CCPA/CPRA.
1. Who is the controller
The data controller is Antonio Carlos Batista do Nascimento, responsible for the band Antidemon and the website antidemonband.com.
Data protection officer and contact channel: Antonio Carlos Batista do Nascimento, at [email protected]. Use this channel for any request or question about your data.
2. What data we collect
Data you give us:
- Donations and purchases: name, e-mail, phone, tax ID (CPF, required by Brazilian payment providers) or equivalent, billing address and, for products, shipping address; amount, currency, date, campaign supported and payment method.
- Donor account (My account): e-mail, password (stored encrypted), donation and order history.
- Contact, press and show booking: name, e-mail, phone, organization, city and country, dates, event details, subject, message and any files you attach.
Data collected automatically: IP address, date and time of access, browser, device, pages visited, chosen language and cookies (see section 8).
Data we never receive: full card number, security code and banking passwords. You type these directly into PagBank or PayPal, and they stay with them.
We do not ask for sensitive data. Because donating to a band with a Christian message may reveal religious belief, we protect donation history with the same care as sensitive data and never make it public without your consent.
3. Why we use it and on what legal basis
| Purpose | Data | Legal basis (LGPD / GDPR) |
|---|---|---|
| Process donations and purchases, send receipts and ship products | Profile, payment, address | Performance of a contract (art. 7, V / art. 6(1)(b)) |
| Meet tax, accounting and reporting duties | Donation and order records | Legal obligation (art. 7, II / art. 6(1)(c)) |
| Keep access logs for 6 months | IP, date and time | Legal obligation (Internet Civil Framework, art. 15) |
| Answer contact, press and booking requests | Form data and attachments | Pre-contractual steps and legitimate interest (art. 7, V and IX / art. 6(1)(b) and (f)) |
| Update you on the campaign you supported | E-mail, campaign | Legitimate interest (art. 7, IX / art. 6(1)(f)) |
| Protect the site against fraud, spam and attacks | IP, technical data | Legitimate interest and fraud prevention (art. 7, IX and art. 11, II, g / art. 6(1)(f)) |
| Measure traffic and improve the site | Analytics cookies | Consent (art. 7, I / art. 6(1)(a)) |
| Defend our rights in legal proceedings | Necessary records | Exercise of rights (art. 7, VI / art. 6(1)(f)) |
We do not sell personal data and do not make automated decisions that have legal effects on you.
4. Who we share it with
We share only what is needed, with providers acting as processors or independent controllers:
- PagBank (PagSeguro Internet Instituição de Pagamento S.A.): processes payments in Brazilian reais (Pix, boleto, card).
- PayPal: processes international payments in US dollars. PayPal is the controller of your PayPal account data.
- Hostinger: website and e-mail hosting, including delivery of receipts and confirmations.
- Google (Site Kit/Analytics, reCAPTCHA and embedded YouTube videos): traffic analysis, spam protection and video playback.
- Wordfence (Defiant Inc.): website firewall and security.
- Carriers and Brazilian Post: product delivery, once the store opens.
- Public authorities: under a court order or legal obligation.
5. International transfers
Some providers (Google, PayPal, Wordfence) store data outside Brazil, mainly in the United States. These transfers rely on articles 33 and 34 of the LGPD and ANPD Resolution 19/2024, using standard contractual clauses or equivalent safeguards offered by those providers. For donors in the European Economic Area, transfers to Brazil and the US rely on the European Commission’s standard contractual clauses, the EU-US Data Privacy Framework where the provider takes part in it, or the need to carry out the donation you requested (GDPR, art. 49(1)(b)).
6. How long we keep it
| Data | Period |
|---|---|
| Access logs (IP, date and time) | 6 months (Internet Civil Framework, art. 15) |
| Donations, orders and tax data | 5 years after the fiscal year, or the applicable legal period |
| Donor account | While the account is active; donation records then follow the period above |
| Contact, press and booking messages | Up to 2 years after the last contact |
| Security logs | Up to 90 days |
After these periods, data is deleted or anonymized, unless the law requires us to keep it longer or we need it to defend a legal claim.
7. Your rights
Under the LGPD (art. 18) you may, at any time and free of charge: confirm whether we process your data; access it; correct incomplete or wrong data; ask for anonymization, blocking or deletion of unnecessary data; ask for portability; learn who we share it with; withdraw consent; and object to processing based on legitimate interest.
If you are in the European Union, you also have the rights in articles 15 to 22 of the GDPR, including restricting processing and complaining to your country’s data protection authority. If you live in California or another US state with a privacy law, you may ask to know, correct or delete your data; we do not sell or “share” data for cross-context behavioral advertising, and you will not be discriminated against for using these rights.
To use any right, write to [email protected]. We may ask you to confirm your identity. We answer within 15 days (LGPD, art. 19) and, for GDPR requests, within 30 days. You may also complain to Brazil’s National Data Protection Authority (ANPD) at gov.br/anpd.
8. Cookies
We use cookies to make the site work and, with your permission, to measure traffic:
- Necessary: donor account login, cart and checkout (WooCommerce), chosen language (Polylang), security (Wordfence) and caching (LiteSpeed). They cannot be turned off without affecting the site.
- Analytics: Google Analytics through Site Kit, to count visits in aggregate.
- Third-party: YouTube videos and Google reCAPTCHA may set their own cookies when loaded.
You can delete or block cookies in your browser settings. Blocking necessary cookies may prevent donations and account access.
9. Security
We use encrypted connections (HTTPS), a firewall, encrypted passwords, backups and restricted admin access. No system is fully immune; if a security incident creates a relevant risk, we will notify those affected and the ANPD, as LGPD art. 48 requires (and, where applicable, the European authority within 72 hours).
10. Children and teenagers
Donations and purchases are not intended for people under 18. If we learn that we collected a child’s data without a guardian’s consent (LGPD, art. 14), we will delete it.
11. External links
The site links to Instagram, Facebook, YouTube, Spotify, Bandcamp and other platforms. Each has its own privacy policy, which we do not control.
12. Changes to this policy
We may update this Policy. The date at the top shows the version in force; we will announce relevant changes on the site or by e-mail to account holders.
13. Governing law
This Policy is governed by Brazilian law. Consumers may bring claims in the courts of their own domicile, as the Consumer Protection Code allows. Nothing here removes rights granted by the law of your country of residence.
This English text is a translation; if there is any conflict, the Portuguese version prevails, except where the law of your country requires otherwise.