1. Introduction and H10 Commitment

H10 Kids ("H10 Kids", "H10", "we") is H10 Esportes’ introductory sports school in São Paulo, Brazil. We recognize that the trust of families, students, guardians and partners is our most valuable asset. We therefore adopt this Privacy Policy as a public transparency instrument on how we collect, use, store, share and protect personal data in the context of providing multi-sport introductory training for children aged 5 to 7.

This Policy complies with Brazilian Law 13,709/2018 (LGPD), Law 8,069/1990 (Statute of the Child and Adolescent — ECA), the Internet Civil Framework (Law 12,965/2014) and ANPD guidance.

Everyone H10 Kids serves is a child under art. 2 of the ECA. Every flow described here therefore observes the best interest of the data subject and requires specific, highlighted consent from at least one parent or legal guardian.

By using our services or digital environments, you declare that you have read, understood and fully accepted this Policy.

2. Our Environments

• Digital: the website www.h10kids.com.br and its subdomains, the official Instagram profile (@h10sportskids) and the official service channels (WhatsApp Business and the email contato@h10escoladeesportes.com.br).
• Physical: the Brooklin · Baetinga unit — Rua Baetinga, 99 — Brooklin Paulista — São Paulo/SP — ZIP 04557-010 —, H10’s administrative headquarters and the venues for classes, events and institutional activities.

3. Definitions

• Personal Data: information relating to an identified or identifiable natural person.
• Sensitive Personal Data: racial/ethnic origin, religious belief, political opinion, health, sexual life, genetic or biometric data.
• Data Subject: the natural person the data refers to.
• Processing: any operation performed with personal data.
• Controller: H10, which makes the decisions on processing.
• Processor: who processes data on the Controller’s behalf.
• Data Protection Officer (DPO): communication channel between H10, data subjects and ANPD.
• Consent: free, informed and unequivocal statement for a specific purpose.

4. Who Is the Controller of Your Data

Legal entity: H10 Esportes e Eventos Ltda.

CNPJ: 64.143.535/0001-02

Address: Rua Conselheiro Elias de Carvalho, 626 — Vila Santa Catarina — São Paulo/SP — Brazil — ZIP 04373-000

Product covered: H10 Kids — multi-sport introductory training for children aged 5 to 7, at the Brooklin · Baetinga unit.

The same controller runs other sports schools (futsal, volleyball, handball and basketball), each with its own website. The service and registration systems are shared across them, under the same controls described in this Policy; H10 Kids records are identified and segregated by sport.

5. Principles Governing Processing

H10 observes the principles of art. 6 of the LGPD: purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination and accountability.

6. Personal Data Processed

On this website H10 does not collect documents, health data or any sensitive data about the student. The enrollment form does collect the paying guardian’s CPF and address, because they are required for the contractual record — and only theirs. Student health information, when needed, is handled off-site, at the in-person enrollment stage, with its own legal basis and controls. IP addresses are not stored: we keep only an irreversible salted hash of them, used to rate-limit abusive form submissions.

7. How We Collect Data

• Trial-class scheduling form (the guardian provides the student’s data);
• Enrollment form, which gathers the paying guardian’s and the student’s registration data;
• Official service channels (WhatsApp, email, phone and in-person service at the unit);
• Cookies and tracking technologies on the site (see Cookie Policy);
• Image and Sound Authorization Term, signed at enrollment.

The site’s forms are filled in by the legal guardian, never by the child. We do not direct collection at children and offer no sign-up, login or account area for minors.

8. How We Use Data

Trial-class service and scheduling; class and unit recommendation; communication with the guardian through the channels they provided; relationship and enrollment management; internal interest scoring (to prioritize the human follow-up); campaign measurement, subject to consent; compliance with legal obligations; and site security, including form abuse control.

Marketing and measurement: with marketing consent, H10 uses analytics and advertising platforms. The conversion events sent to those platforms carry only the guardian’s contact data (email and phone), always protected by cryptographic hashing (SHA-256), plus technical identifiers of the ad itself (cookies and click IDs). No student data — name, date of birth, age, school or message — is ever sent to advertising platforms, under any circumstances.

H10 does not make automated decisions with legal effects on the data subject. Lead scoring is only an ordering of priority for human follow-up.

9. Data Sharing

To deliver the service, data submitted through the forms passes through the following processors, all under contractual security and confidentiality obligations:

• Supabase — database and server functions where trial-class requests are recorded;
• Vercel — website hosting and delivery;
• Google (Workspace and Apps Script) — the team’s internal spreadsheet, where trial-class requests and enrollments are consolidated for follow-up;
• EVO / W12 — H10’s management system (ERP), where the interested family is registered as a prospect for commercial and enrollment follow-up;
• WhatsApp (Meta) — official service channel: the request summary is sent to the H10 team’s number and, at enrollment, the guardian sends the summary from their own device;
• Meta and Google — as advertising and analytics platforms, only subject to consent and only with the data described in section 8 (never student data);
• H10 staff — authorized employees, within their roles;
• Public authorities — to comply with a legal or regulatory obligation.

H10 does not sell personal data, does not transfer it to third parties unrelated to the service, and does not share children’s data outside the cases described above. Sending student data to WhatsApp and to the management system is purely operational (service and enrollment) and is not to be confused with sending it to advertising platforms, which never happens.

10. Data Subject Rights

Under art. 18 of the LGPD: confirmation, access, correction, anonymization/blocking/deletion, portability, deletion of consent-based data, information on sharing, information on not consenting, and consent withdrawal.

Since everyone H10 Kids serves is a child, these rights are exercised by the legal guardian on the minor’s behalf, subject to identity verification.

To exercise them, use the DPO channel (section 14) or the Data Subject Rights page. We respond within 15 (fifteen) days.

11. Information Security and Governance

Role-based access control; encryption in transit (HTTPS/TLS); storage with security-certified providers; auditing of sensitive operations; incident response; restricted internal access; contractual assessment of processors.

In the database, trial-class requests live in tables with no public read access: writes happen only through a server function, and reads only through administrative roles. The site never exposes to the browser the keys that would grant access to those records. We do not log visitors’ IP addresses in the clear — only a salted hash, to rate-limit form abuse.

11.1. Retention Periods

• Unconverted leads: up to 12 months, then anonymized or deleted;
• Enrolled students: up to 24 months after the relationship ends, unless a legal obligation applies;
• Financial data: 5 years (civil and tax law);
• Image and sound: per the Term, subject to withdrawal;
• Navigation: per the Cookie Policy and consent.

The same periods apply to the operational copies of the records (internal spreadsheet and management system), which follow the deletion of the primary record.

12. Cookies

The site uses cookies and similar technologies. Details in the Cookie Policy, an integral part of this Policy.

13. Changes to This Policy

This Policy may be updated. The current version will always be available on the site, with the last-updated date. Material changes will be communicated.

14. Contact and Data Protection Officer (DPO)

DPO: Valter Costa Guimarães Filho — dpo@h10esportes.com.br — +55 (11) 94022-5452.

Deputy DPO: Elaine Roth — elaine.roth@h10esportes.com.br — +55 (11) 99442-2324.

Address: Rua Conselheiro Elias de Carvalho, 626 — Vila Santa Catarina — São Paulo/SP — Brazil — ZIP 04373-000.

The DPO channel is exclusive to data protection matters and is answered by H10 staff. It does not go through the school’s commercial WhatsApp or any automated assistant: to exercise your rights, write to dpo@h10esportes.com.br.

You may also file a complaint with the ANPD (gov.br/anpd).