1. Who is responsible for what
The customer company is the controller: it decides to use Vigiles, where the cameras go, which rules apply and how long data is kept. Vigiles is the processor: it handles data on the customer's behalf, following its instructions and only to provide the service.
2. What data is processed
• Images of people captured by the cameras in monitored areas. • Detection results: presence or absence of each PPE item, camera, zone, date and time. • Alert evidence: an image or video clip of the moment of the event. • Data of dashboard users and alert channels: name, email and accounts registered to receive notifications. Vigiles does not use facial recognition and does not identify who the person is: it checks what they are wearing.
3. What it is used for
To check PPE use, issue safety alerts, support compliance with Brazilian Regulatory Standards (NRs) and keep records for audits. Vigiles does not use this data for advertising and does not sell it. It is up to the customer to define the purpose of the monitoring and communicate it to workers.
4. Legal basis
Choosing the legal basis is up to the customer, as controller. In occupational safety, the bases usually applied are compliance with a legal or regulatory obligation (LGPD, art. 7, II), protection of life and physical safety (art. 7, VII) and legitimate interest (art. 7, IX), assessed case by case.
5. Where the data is kept
Detection runs on the device installed at the site, with no internet dependency. What goes to the cloud is set in each customer's configuration: by default, alert evidence; if the customer wants, video as well. Alerts sent to the dashboard, Telegram and the app go through technology providers that may be located outside Brazil. In those cases, the international transfer follows the LGPD (art. 33).
6. How long
The customer sets how long evidence and records are kept. When that period ends, the data is deleted. When the contract ends, the data is returned or deleted, as agreed with the customer.
7. Security
Dashboard access requires a login and each customer only sees its own data. Connections to the dashboard are protected by HTTPS. The Vigiles team only accesses a customer's data when needed for support or maintenance.
8. Transparency with workers
We recommend that the customer: • mark monitored areas with visible signs; • inform workers about the monitoring, its purpose and the data processed; • update its internal privacy notice and involve its safety team and safety committee (SESMT and CIPA); • assess the need for a Data Protection Impact Assessment (RIPD).
9. Data subject rights
Workers and other people captured by the cameras can exercise their LGPD rights (art. 18), such as access, correction and deletion, with the customer, who is the controller. Vigiles helps the customer respond to these requests.
Documents for your legal team
On request, we provide the data processing agreement (processor) and technical support for the Data Protection Impact Assessment (RIPD). Write to vigiles.epi@gmail.com.
Informational content about how Vigiles works. It does not replace your company's legal advice. Last updated: November 2026.