01Who we are
Instituto Xutyw is an Indigenous non-profit organization registered in Brazil under CNPJ 65.268.802/0001-22, headquartered at SBS Quadra 2, Bloco E, Sala 206, Parte Y12, Asa Sul, Brasília (DF), Brazil, ZIP 70070-120, and working in the Araribóia Indigenous Territory, in Arame, Maranhão.
We are responsible (the controller) for the personal data processed on this website, institutoxutyw.com, under the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018).
For any privacy matter, contact us at institutoxutyw@gmail.com.
02What data we receive
When you write to us through the contact form
On the Contact page, we ask for your name, your email, the subject (for example, volunteering, a partnership or an idea) and the message you want to write, as well as your confirmation that you agree to the use of this data to receive a reply.
To protect the site from bots
To prevent automated submissions and abuse, the site creates a code from the IP address of the person sending the form (we do not store the IP address itself) and counts how many messages were sent. This code is automatically deleted within 1 hour after the last submission.
Technical access data
As with any website, the hosting server may automatically record technical information about visits, such as IP address, date and time, page visited and browser type. These records are used for security and for the proper functioning of the site.
Donations
Donations by PIX or bank transfer are made directly in your banking app, and PayPal donations on the PayPal website. The Instituto Xutyw website does not receive or store any card, bank account or payment data. When a donation arrives, the bank or PayPal may share data such as the donor’s name and the amount, which we use only for financial control and accountability.
What we do not collect
We do not use advertising cookies, we do not use visitor analytics tools, we do not ask for identity documents and we do not ask for sensitive data, such as racial or ethnic origin, religion, health or political opinions.
03How we use it
- To reply to your message and talk about volunteering, partnerships or ideas.
- To organize the messages we receive and follow up on each contact.
- To protect the site against bots, spam and abuse.
- To comply with legal obligations and account for donations.
We do not use your data to send you advertising without your permission.
04Legal bases
We only process personal data when the LGPD allows it:
- Consent (art. 7, I): when you send the form and tick the consent box.
- Legitimate interest (art. 7, IX): to keep the site secure and prevent abuse.
- Compliance with a legal obligation (art. 7, II): for financial records and accountability for donations.
05Who we share it with
To run the site, we use services from other companies. They only receive what is needed to provide their service:
- Hostinger: hosting of the website and of the messages sent through the form.
- Google (Gmail): receiving messages in the Institute’s email.
- Google Fonts: the site’s fonts are loaded from Google’s servers, which receive your device’s IP address when the page opens.
- YouTube: the video on the home page is shown through YouTube, which may collect information under Google’s privacy policy.
- Banks and PayPal: only when you choose to donate, directly in their own systems.
We may also share data when required by law or by order of a competent authority. We never sell your data.
Some of these services may store data on servers outside Brazil. We choose well-known companies that adopt security measures to protect this information.
07How long we keep it
- Form messages: for as long as needed to reply and follow up on the contact. You can ask us to delete them at any time.
- Bot protection code: automatically deleted within 1 hour.
- Donation records: for the period required by Brazilian tax and accounting laws.
08Your rights
Under the LGPD (art. 18), you can, at any time:
- confirm whether we process your data and access it;
- correct incomplete, inaccurate or outdated data;
- request the anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
- request the portability of your data;
- request the deletion of data processed with your consent;
- know who we share your data with;
- know that you may refuse consent and what happens in that case;
- withdraw your consent.
To exercise any of these rights, write to institutoxutyw@gmail.com with the subject “Privacy”. We will reply within 15 days.
You may also file a complaint with the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.
09Security
We take measures to protect your data: secure connection (HTTPS), restricted access to the site’s dashboard, bot protection and messages sent only to the Institute’s email.
No system is completely invulnerable, but we work to keep your data protected. If a security incident occurs that may cause relevant risk or harm, we will notify the people affected and the ANPD, as required by law.
10Children and teenagers
The site’s form is intended for people aged 18 or over. If you are under 18, please ask a parent or guardian to contact us on your behalf.
11Changes to this policy
We may update this policy to reflect changes to the site or to the law. The date of the latest update is always shown at the top of this page. This version is from October 12, 2026.
This English version is provided for convenience. In case of any difference, the Portuguese version prevails.