1. Commitment

H10 Kids serves children aged 5 to 7 only — the youngest audience in all of H10. Every student data point handled here is therefore children’s data under art. 2 of the ECA, and receives the reinforced treatment of art. 14 of the LGPD.

We process it always in the best interest of the data subject, with specific, highlighted consent from at least one parent or legal guardian, given in the form itself before submission.

The trial-class form accepts dates of birth from age 4 so that a child about to turn 5 is not excluded; enrollment, however, is for the 5-to-7 age range.

2. Minimization — what we ask for, and nothing else

When booking a trial class, we collect from the child only: full name, date of birth (from which the age is derived) and where they currently study or play sports. Nothing beyond that.

From the child, we do not ask for documents, ID, tax ID, health data, photos, address, phone, email or any sensitive data. The child has no account, login or profile area on the site.

In the enrollment form, besides the student’s full name and date of birth, we collect the paying guardian’s registration data — full name, CPF (tax ID), email, WhatsApp, full address and postal code — required to formalize the contract. These are the adult’s data, not the child’s, even though the address given is, in practice, the family’s home.

Student health information, when needed for sports practice, is handled off-site, in person, with its own legal basis and controls.

3. Who provides the data

The child’s data is provided and authorized by the legal guardian, who fills in the form on their behalf. H10 does not direct collection at children, does not run advertising aimed at children and offers them no sign-up channel of their own.

4. Purposes

Service, class recommendation, scheduling and running the trial class, communication with the guardian, and relationship and enrollment management.

The child’s data is not used for targeted advertising nor sent to ad platforms — not to Meta, not to Google, with or without marketing consent. The conversion events sent to those platforms carry only the guardian’s email and phone, protected by cryptographic hashing, and only when they consent to marketing.

To serve the family, the child’s name and date of birth flow through the school’s operational systems described in section 9 of the Privacy Policy — database, the team’s internal spreadsheet, the management system (ERP) and the message sent to the team’s WhatsApp. That is service circulation, never advertising.

5. Image and sound

Capturing and using a child’s image and sound (voice) requires the legal guardian’s authorization, granted upon signing the enrollment contract with H10 (Annex III — Minor Image Term) or in a specific Image and Sound Use Authorization Term. Without it, H10 does not publish identifiable individual images or voice of the child. The guardian may revoke this authorization at any time, as provided in that Term.

6. Security and rights

The child’s data is protected by reinforced measures: the tables that store it have no public read access, writes happen only through a server function, and reads only through H10 administrative roles.

The guardian may exercise art. 18 rights on the child’s behalf through the DPO channel, subject to verification of legal-guardian status.

7. Contact

DPO: Valter Costa Guimarães Filho — dpo@h10esportes.com.br — +55 (11) 94022-5452.

This channel is exclusive to data protection and does not go through the school’s commercial WhatsApp.