Integrity Program · Data protection · Official channels
Compliance Portal
This portal brings together the policies, commitments and official channels of EBAEM and Observatório de Gestão. Here you will find how we handle personal data, how we prevent irregularities in our relationship with public administration, how we protect the platform and how we ensure accessibility — and, above all, how to exercise your rights with a protocol number, a deadline and follow-up.
EBAEM LTDA · CNPJ (Brazilian tax ID) 55.054.849/0001-30 · Data Protection Officer (DPO): lgpd@ebaem.com.br · Ombudsman: ouvidoria@ebaem.com.br
Why a product for the public sector needs an integrity program
Observatório de Gestão is contracted by municipalities, states and consortia, through a procurement waiver or sole-source procurement, and processes official databases every day that contain data on public entities, managers and beneficiaries. This places EBAEM in two positions that call for clear rules: supplier to public administration and processor of personal data on behalf of its clients.
Our integrity program is structured on Brazil’s Law No. 12,846/2013 (Anti-Corruption Law) and Decree No. 11,129/2022, which define the parameters of an effective program, and incorporates the General Data Protection Law (LGPD, Law No. 13,709/2018), the rules for dealing with public authorities in Law No. 14,133/2021 (public procurement law), the Brazilian Inclusion Law (Law No. 13,146/2015) and the Pay Equality Law (Law No. 14,611/2023). For information security and privacy, we adopt the ISO/IEC 27001, ISO/IEC 27701 and ISO 37001 standards as a reference for good practice.
- Public, reviewed policies — every document on this portal is open, written in plain language and reviewed at least once a year.
- Channels with a protocol number — reports, data subject requests, support and contact all generate a unique protocol number, with a timeline you can look up.
- Named officers — a Data Protection Officer (DPO) and an Ethics and Integrity Committee independent of the sales team.
- Applied across the whole chain — management, employees, accredited consultants, resellers and suppliers all commit to the same rules by contract.
- Traceability — every relevant action on the platform is recorded in an audit trail, with controlled retention and purging.
Policies and commitments
Each policy has its own page, with scope, rules, responsible parties, deadlines and a contact channel. All of them apply to both the website and the platform. (Policy pages are currently available in Portuguese.)
🧭
Compliance
Integrity program: code of conduct, risk analysis, internal controls, third-party due diligence and disciplinary measures.
🔐
LGPD
Controller and processor roles, legal bases, sharing, retention, incidents and data subject rights.
📋
Privacy Notice
What we collect on the website and the platform, why, for how long and with whom we share it — context by context.
🍪
Cookies
Cookie categories, duration, third-party services and how to manage your preferences in the banner or your browser.
⚖️
Equity
Diversity, inclusion, pay equality, non-discrimination and digital accessibility on the website and the platform.
🌱
ESG
Environmental, social and governance commitments, with qualitative targets and indicators to be published.
🛡️
Information Security
Technical controls, user responsibilities, incident response and vulnerability reporting.
📣
Service channels
Whistleblower Channel (anonymous and retaliation-free), LGPD Requests (reply within 15 days) and public protocol lookup.
This portal is complemented by the Accessibility Statement, with the features available on the website and the platform and the channel for reporting barriers.
How a request works
Reports, data subject requests, support tickets and contact messages all follow the same flow. Each record receives a protocol number in the format OG-AAAA-XXXXXX and a timeline with every update.
Registration with a protocol number
You fill in the form for the appropriate channel and receive the protocol number on screen. For anonymous reports, you also receive a tracking key — keep both, as they are not shown again.
E-mail confirmation
If you identified yourself, we send an e-mail with the protocol number and a link to confirm the address. Once confirmed, every update also arrives by e-mail. Without confirmation, follow-up remains available through the protocol lookup.
Review by the responsible area
The protocol is forwarded to the competent area: Ethics and Integrity Committee (reports), Data Protection Officer (LGPD), Support or Sales. If information is missing, the status changes to “Awaiting user” and you add it through the protocol itself.
Reply and updates
The reply is recorded in the protocol, together with every update. You can send new messages to the team until it is closed. Closed protocols remain available for lookup.
Deadlines and guarantees
| Channel | Deadline | Guarantees |
|---|---|---|
| LGPD requests | Reply within 15 days (LGPD, art. 19, II). Simple confirmations may be handled immediately. | Identity verification before releasing data; free of charge; written justification whenever a request cannot be fulfilled. |
| Whistleblower Channel | Immediate registration and protocol number. The first update states the responsible area and the estimated investigation time, which varies with the complexity of the report. | Confidentiality, optional anonymity, a ban on retaliation and an investigation independent of the sales team. |
| Support | Triage according to the ticket’s priority; every update is recorded in the protocol. | Service for the authorized users of the public entity or the consultant; data used only to resolve the ticket. |
| Sales contact | Reply within 2 business days. | No obligation to buy; you can object to further contact at any time. |
| Ombudsman | Receives feedback about the service provided by the channels above. | ouvidoria@ebaem.com.br |
Program governance
👤
Data Protection Officer (DPO)
Appointed under art. 41 of the LGPD, the DPO is the point of contact between data subjects, the ANPD (Brazil’s data protection authority) and EBAEM. The DPO handles LGPD requests, guides the teams and leads incident communication. Contact: lgpd@ebaem.com.br.
🧑⚖️
Ethics and Integrity Committee
Made up of management and the legal and technology areas, with no involvement of the sales team in investigations. It receives reports, decides on disciplinary measures and monitors action plans.
🔁
Annual review
Every policy is reviewed at least once a year and whenever there is a legal or product change or a relevant incident. The version and effective date are stated in each document.
Responsible party
EBAEM LTDA — CNPJ (Brazilian tax ID) 55.054.849/0001-30 — SRTVN Quadra 702, Lote P, Edifício Rádio Center, Salas SS18 a SS28, Asa Norte, Brasília/DF, Brazil, ZIP 70719-900 — +55 (61) 98128-6479
Data Protection Officer (DPO): lgpd@ebaem.com.br · Ombudsman: ouvidoria@ebaem.com.br · Support: suporte@ebaem.com.br · Sales: contato@ebaem.com.br
Need information for your procurement process?
EBAEM’s team answers requests for clarification about any policy on this portal and about how the platform handles your public entity’s data.
For public contracting, the commercial proposal provides sufficient inputs (technical description, exclusivity/patent, price breakdown, schedule) to support the public entity’s team throughout the procurement process — notice/terms of reference, preliminary technical study (ETP), risk analysis, legal opinion — according to the entity’s own specifications. See How to contract.