Information collected is used to manage stock, meet regulatory requirements and also for inclusion in loyalty programs - which is voluntary and can be withdrawn
"What is your CPF?" This is probably one of the most frequently asked questions by consumers in Brazilian pharmacies. That's because, in exchange for their Individual Taxpayer Registration (CPF) number, drugstores often offer discounts on the prices of medicines, toiletries and other items.
However, by providing the document, the customer is linking that purchase to their own history of consumption in that pharmacy chain. The data from that purchase - what was bought, when, frequency, brand, quantity - is stored and added to all the other purchases made previously, creating a profile of the consumer.
"This data is used in favor of customers," says the Brazilian Association of Pharmacy and Drugstore Chains (Abrafarma) in a statement sent to Valor. According to the association, this information is used to prevent a shortage of medicines in the units by managing stock according to demand, to meet regulatory requirements and also to meet regulatory requirements and also for inclusion in loyalty programs.
Abrafarma, which represents 30 of the largest national pharmaceutical retail chains, explains that the sector has legal obligations to formalize the sale of certain types of medicines, such as those with special controls (black stripe, for example). "The CPF information has to be entered into Anvisa's National System for the Management of Controlled Products (SNGPC)."
In addition, this consumer profile aims to help the company offer discounts on products that the customer is likely to be interested in, according to lawyer Luiz Augusto d'Urso, who works with cases involving the General Data Protection Act (LGPD). The strategy, according to him, is to "build consumer loyalty, so that they always buy from your networks, looking not only for the price, but also for these opportunities that are sent to them, which are actually strategies to keep consumers coming back"
CPF for discount
As for loyalty programs - the popular "enter your CPF to access discounts" - participation is voluntary. In other words, if the consumer doesn't want their data to be collected at the time of purchase, they don't have to give their document, as provided for in the General Law on the Protection of Personal Data (LGPD). Abrafarma says that by participating in these programs, "the consumer allows the chain to offer personalized discounts and/or provide relevant health information or information about specific perfumery products, in categories that would be relevant to the customer based on their consumption history, on the pharmacy chain's own initiative or in partnership with its suppliers." However, the association strongly maintains that the data is not traded between the companies or used for purposes other than those already described
"Even when they work in partnership, Abrafarma's chains do not trade or share identified consumer information, either with their own suppliers or with social media platforms. All analyses of market trends take place anonymously, following the guidelines of the LGPD. All very securely," the association said in a statement.
How can I delete my data?
On the other hand, the customer can also, if and when they want, leave the program and request the deletion of this personal data. This is because the holder is the owner of their own data, according to the law.
"They [the data subject] have absolute freedom to request access to that data, to check what data has been collected and processed by that company at any time and to request deletion from that database," explains d'Urso. This is why companies need to provide a means for these requests to be made. Many answer these questions only by e-mail, while others provide specific websites for the request. However, according to lawyer Luiz Fernando Plastino, also a specialist in the LGPD, when requesting the deletion of this data, you need to be aware that only information relating to loyalty programs will be deleted. "It will delete the data under these circumstances. The company won't, for example, forget all about you and go off
deleting your data in order to fulfill bureaucratic duties. For each use, the purpose is analyzed differently," he points out.
Source: Valor Econômico