Privacy policy

1. Purpose

This Personal Data Protection Policy sets out the guidelines and procedures for the processing of personal data by NUVEM.ONLINE, in compliance with the Brazilian General Data Protection Law (Law No. 13,709/2018 — LGPD), ANPD Board Resolution (CD/ANPD) No. 15/2024 and other applicable legislation.

The specific objectives of this Policy are:

• To ensure full compliance with the LGPD and other data protection legislation;
• To protect the fundamental rights of freedom and privacy of data subjects;
• To establish clear responsibilities for the processing of personal data;
• To ensure the security, confidentiality and integrity of personal data;
• To prevent security incidents and data leaks;
• To establish procedures for incident response and notification to the ANPD within the legal deadlines;
• To meet NUVEM.ONLINE’s contractual obligations towards its clients.

2. Scope

This Policy applies to:

• All administrators, directors and partners of NUVEM.ONLINE;
• All staff (employees, interns, temporary workers);
• Service providers, consultants and contracted third parties;
• Business partners with access to personal data;
• Subcontractors (sub-processors) that process data on behalf of NUVEM.ONLINE;
• Controlled, associated or affiliated companies.

2.1 Types of Data Covered

• Personal data of NUVEM.ONLINE staff;
• Personal data of clients and business partners;
• Personal data of suppliers and service providers;
• Personal data of data subjects belonging to clients (when NUVEM.ONLINE acts as processor);
• Sensitive personal data;
• Data of children and adolescents (where applicable).

2.2 Territorial Application

This Policy applies to all data processing operations carried out by NUVEM.ONLINE, regardless of the means, the country of its headquarters or the country where the data is located, pursuant to Art. 3 of the LGPD.

3. Definitions

For the purposes of this Policy, the definitions of the LGPD (Law No. 13,709/2018) apply:

4. Legal Framework

This Policy is based on:

• Law No. 13,709/2018 (LGPD) — Brazilian General Personal Data Protection Law;
• CD/ANPD Resolution No. 15/2024 — Regulates deadlines and procedures for notifying the ANPD of security incidents;
• Federal Constitution — Art. 5, items X, XII and LXXIX (protection of privacy, inviolability of communications and data protection as a fundamental right);
• Law No. 12,965/2014 (Brazilian Internet Civil Framework — Marco Civil da Internet) — Principles, guarantees, rights and duties for internet use;
• Law No. 8,078/1990 (Consumer Protection Code) — Protection of consumer data;
• Contractual Obligations — Data protection clauses in contracts with clients.

5. LGPD Principles

NUVEM.ONLINE undertakes to observe the following principles in the processing of personal data (Art. 6 of the LGPD):

6. Roles and Responsibilities

6.1 NUVEM.ONLINE as Controller

When NUVEM.ONLINE determines the purposes and means of processing, it is responsible for:

• Making all decisions about data processing;
• Defining purposes and legal bases;
• Implementing appropriate security measures;
• Answering for security incidents before data subjects and the ANPD;
• Fulfilling data subjects’ rights within the legal deadlines.

6.2 NUVEM.ONLINE as Processor

When NUVEM.ONLINE processes data on behalf of the Controller:

• It may only process personal data when EXPRESSLY AUTHORIZED in writing by the Controller;
• Processing must be carried out SOLELY AND EXCLUSIVELY for the purposes previously communicated by the Controller;
• It must implement appropriate security measures;
• It must report security incidents to the Controller IMMEDIATELY;
• It must return or delete data at the end of the processing, as instructed by the Controller;
• It must not process data for its own purposes;
• It must not share data without express authorization.

6.3 NUVEM.ONLINE and Sub-processors

When NUVEM.ONLINE subcontracts third parties to carry out personal data processing activities on its behalf, the following rules apply, in accordance with Art. 39 of the LGPD:

• The sub-processor may only be engaged with the prior written authorization of the Controller, when contractually required;
• NUVEM.ONLINE will be liable to the Controller for the acts of the sub-processor to the same extent as for its own responsibility;
• A specific contract must be signed with the sub-processor, containing data protection clauses equivalent to those of this Policy;
• The sub-processor is prohibited from processing data for any purpose other than the one contracted;
• NUVEM.ONLINE will periodically monitor the sub-processor’s compliance with its obligations.

6.4 Data Protection Officer (DPO)

NUVEM.ONLINE appoints as Data Protection Officer:

The Data Protection Officer is responsible for:

• Accepting complaints and communications from data subjects;
• Providing clarifications about data processing;
• Receiving communications from the ANPD;
• Advising staff on data protection practices;
• Coordinating the response to security incidents;
• Conducting periodic training;
• Supervising data mapping and the preparation of the RIPD.

6.5 Board of Directors

• Approving this Policy and ensuring resources for its implementation;
• Defining the data protection strategy;
• Making decisions on serious incidents;
• Reporting incidents to clients when contractually required.

6.6 All Staff

• Knowing and complying with this Policy;
• Processing data only when authorized;
• Adopting security measures;
• Immediately reporting security incidents or suspected security incidents;
• Not sharing data without authorization.

7. Legal Bases for Processing

NUVEM.ONLINE will only process personal data when there is a legal basis, in accordance with Art. 7 of the LGPD:

• Consent of the data subject;
• Compliance with a legal or regulatory obligation;
• Performance of a contract or preliminary procedures;
• Regular exercise of rights in judicial, administrative or arbitration proceedings;
• Protection of the life or physical safety of the data subject or third parties;
• Health protection (by health professionals or services);
• Legitimate interest of the controller or a third party;
• Credit protection.

7.1 Consent

When consent is the legal basis, it must be:

• Free (without defect of will);
• Informed (with clear information about the processing);
• Unequivocal (not ambiguous);
• Specific (for determined purposes);
• Documented and traceable;
• Revocable at any time by the data subject.

7.2 Legitimate Interest

When legitimate interest is the legal basis, NUVEM.ONLINE must:

• Prepare and document the Legitimate Interest Assessment (LIA), under the responsibility of the Data Protection Officer, with approval from the Board of Directors;
• Demonstrate that the processing is necessary, proportionate and does not override the fundamental rights and freedoms of the data subject;
• Ensure transparency to the data subject by means of a privacy notice;
• Respect the data subject’s right to object (Art. 18, IX, LGPD);
• Review the LIA annually or whenever there is a change in the processing.

8. Data Subjects’ Rights

NUVEM.ONLINE undertakes to facilitate the exercise of the following rights by data subjects, in accordance with Art. 18 of the LGPD:

8.1 Procedure for Exercising Rights

Data subjects may exercise their rights through the following channels:

• Data Protection Officer’s email: [email protected]
• Privacy Form: available at the end of this page
• Direct contact with NUVEM.ONLINE, at the addresses and hours published on its website.

Response time: up to 15 (fifteen) calendar days, extendable for a further 15 (fifteen) days, with justification to the data subject, under the ANPD’s regulations.

9. Processing of Personal Data

9.1 Data Collection

• Collect only the minimum necessary for the specific purpose (minimization);
• Clearly inform the data subject about the collection, by means of a privacy notice;
• Obtain specific consent when this is the applicable legal basis;
• Document the purpose of the collection in the record of processing activities.

9.2 Storage

• Store personal data securely;
• Implement access controls based on the principle of least privilege;
• Use encryption when appropriate to the level of risk;
• Keep secure backups, tested periodically;
• Respect the retention periods defined in this Policy (Section 16).

9.3 Use and Processing

• Use data ONLY for the purposes disclosed to the data subject or authorized by the Controller;
• Not use data for incompatible purposes;
• Not use data for its own purposes when acting as Processor;
• Keep up-to-date records of processing activities.

9.4 Specific Prohibitions

10. Sensitive Personal Data

Sensitive personal data receives enhanced protection and special treatment, under Art. 11 of the LGPD.

10.1 Specific Legal Bases

Sensitive data may only be processed in the following cases:

• Specific and highlighted consent of the data subject;
• Compliance with a legal or regulatory obligation;
• Sharing necessary for the implementation of public policies;
• Studies carried out by a research body;
• Regular exercise of rights;
• Protection of life or physical safety;
• Health protection, by a health professional or health authority;
• Fraud prevention and safety of the data subject.

10.2 Additional Protection Measures

• Mandatory encryption for storage and transmission;
• More restrictive access controls;
• Logging of all access, with traceability;
• Specific and highlighted consent, where applicable;
• Half-yearly review of the need to keep the data.

11. Data of Children and Adolescents

The LGPD (Art. 14) and the Brazilian Statute of Children and Adolescents (ECA, Law No. 8,069/1990) grant special protection to the processing of personal data of children (under 12 years of age) and adolescents (between 12 and 17 years of age). NUVEM.ONLINE adopts the following differentiated rules:

11.1 Data of Children (under 12)

• Processing must be carried out in the best interest of the child;
• It requires specific and highlighted consent from at least one parent or legal guardian;
• Information about the processing must be provided in a simple and clear manner;
• Collecting data beyond what is strictly necessary for the provision of the service is prohibited;
• The data may not be passed on to third parties without new authorization from the legal guardian.

11.2 Data of Adolescents (12 to 17)

• Processing must observe the principle of the best interest of the adolescent;
• As a rule, adolescents may give consent themselves, provided the information is presented in language suited to their age group;
• For the processing of sensitive or high-risk data, concurrent consent from the legal guardian is recommended;
• Building behavioral profiles for the purpose of targeting advertising or content potentially harmful to their development is prohibited;
• Adolescents’ data may not be processed in a discriminatory manner.

11.3 Exceptions to Consent

Parental consent is not required when:

• The contact with parents or guardians is a one-off, with no data being stored;
• The processing is necessary for the protection of the child or adolescent, provided the data is not passed on to third parties.

12. Data Sharing

12.1 General Rule

NUVEM.ONLINE will only share personal data when:

• There is a legal basis for sharing;
• The data subject is duly informed;
• There is authorization from the Controller (when NUVEM.ONLINE acts as Processor);
• The recipient guarantees an adequate level of protection.

12.2 Sharing with Third Parties

Before sharing data with third parties, NUVEM.ONLINE must:

• Verify that the third party has adequate security measures;
• Formalize a contract with data protection clauses;
• Clearly define the purposes of the sharing;
• Limit access to the minimum necessary;
• Periodically monitor the third party’s use of the data.

12.3 Sharing with Authorities

Sharing with public authorities is permitted when there is a legal or judicial request, when it is necessary to comply with a legal obligation or to protect rights. Whenever possible and legally permitted, the data subject shall be informed.

13. International Transfer

International transfer of personal data is only permitted when (Art. 33, LGPD):

• The destination country provides an adequate level of protection, recognized by the ANPD;
• The controller offers sufficient guarantees (standard contractual clauses, binding corporate rules — BCR, certifications approved by the ANPD);
• There is specific and highlighted consent from the data subject;
• It is necessary for international legal cooperation;
• It is necessary for the protection of life or physical safety;
• It is authorized by the ANPD.

13.1 Safeguard Measures

When carrying out an international transfer, NUVEM.ONLINE must:

• Document the protection safeguards adopted;
• Inform the data subject about the transfer in the privacy notice;
• Include specific data protection clauses in contracts with recipients;
• Regularly verify the adequacy of protection in the destination country or organization.

14. Information Security

NUVEM.ONLINE will implement technical and administrative measures to protect personal data against unauthorized access and accidental or unlawful situations.

14.1 Technical Measures

• Access controls (authentication, role-based authorization);
• Encryption of data in transit and at rest;
• Firewall and intrusion detection systems (IDS/IPS);
• Antivirus and malware protection;
• Regular, secure backups with periodic restore tests;
• Logs and continuous monitoring of access;
• Segregation of environments (production, development, staging);
• Management of security updates and patches.

14.2 Administrative Measures

• Information security policies;
• Formal access control procedures;
• Password management (complexity, periodic change, prohibition of sharing);
• Confidentiality and non-disclosure agreements signed by staff and third parties;
• Documented incident response procedures;
• Regular security audits;
• Vulnerability management.

14.3 Access Control

• Principle of least privilege (minimum access necessary for the role);
• Segregation of duties;
• Periodic review of permissions (at least half-yearly);
• Immediate deactivation of access when the relationship ends;
• Multi-factor authentication (MFA) for critical systems.

14.4 Clean Desk and Clear Screen Policy

• Documents containing personal data must not be left on desks or in places with unrestricted access;
• Screens must be locked when leaving the workstation;
• Printouts containing personal data must be removed from the printer immediately;
• Secure disposal of physical documents (shredding).

15. Security Incidents

15.1 What a Security Incident Is

Any adverse event resulting in:

• Unauthorized access to personal data;
• Leakage or unauthorized disclosure;
• Accidental loss, destruction or alteration of data;
• Data hijacking (ransomware);
• Misuse of personal data;
• Any security breach affecting personal data.

15.2 Obligation to Report

15.3 Incident Response Procedure

15.4 Notification to the ANPD

The preliminary notification to the ANPD, within 3 business days of detection, must contain:

• Description of the nature of the personal data affected;
• Information about the data subjects involved (estimated number and categories);
• Indication of the technical and security measures adopted;
• Risks related to the incident;
• Reasons for any delay in the notification;
• Measures to reverse or mitigate the effects of the incident.

16. End of Processing and Data Retention

16.1 When to End Processing

The processing of personal data must end when:

• The purpose has been achieved;
• The data is no longer necessary or relevant;
• The data subject withdraws consent (if this is the legal basis);
• The data subject exercises the right to deletion;
• The ANPD so determines;
• The contract with the client ends (when NUVEM.ONLINE acts as Processor).

16.2 Retention Periods by Data Category

16.3 Deletion Procedures (NUVEM.ONLINE as Processor)

At the end of the contract with a client, NUVEM.ONLINE must:

• Return, delete or destroy all personal data, as instructed by the Controller;
• Delete copies, backups and derived data;
• Certify the deletion in writing, within the contractually agreed period.

16.4 Deletion Methods

• Permanent and unrecoverable deletion from systems;
• Physical destruction of storage media;
• Shredding of physical documents;
• Technically irreversible anonymization.

17. Transparency and Communication

17.1 Privacy Notices

NUVEM.ONLINE will make clear Privacy Notices available, containing:

• Purposes of the processing;
• Form and duration of the processing;
• Applicable legal basis;
• Data collected and categories of data subjects;
• Sharing with third parties;
• Data subjects’ rights and how to exercise them;
• Contact information of the Data Protection Officer.

17.2 Clear Language

Privacy communications must use clear, simple language accessible to the data subject, avoiding unnecessary technical terms.

17.3 Updates

Privacy notices must be reviewed and updated whenever there is a change in the processing or in the applicable legislation, and at least annually.

18. Training and Awareness

• Initial training: all staff must receive LGPD training upon hiring;
• Periodic training: refresher sessions held at least annually;
• Specific training: staff who process personal data will receive in-depth training on LGPD principles, data subjects’ rights, security measures, incident response procedures and contractual obligations as Processor;
• Awareness campaigns: carried out regularly by NUVEM.ONLINE, covering all staff and relevant third parties.

19. Monitoring and Auditing

19.1 Continuous Monitoring

NUVEM.ONLINE will continuously monitor:

• Personal data processing activities;
• Compliance with this Policy;
• Incidents and breaches;
• Data subjects’ requests and response times;
• Effectiveness of the security measures implemented.

19.2 Records of Processing Activities

NUVEM.ONLINE will keep detailed records of all processing activities, including: identification of the controller/processor, purposes, categories of data and of data subjects, recipients of shared data, international transfers, security measures adopted and retention periods by category.

19.3 Audits

Internal privacy audits will be carried out every six months. NUVEM.ONLINE will make information and records available for audits by clients and contractual partners and will cooperate with ANPD inspections.

20. Reporting to Clients

20.1 Immediate Incident Reporting

Mandatory reporting covers any security incident, improper processing of data, unauthorized access or well-founded suspicion of a breach.

20.2 Content of the Report

The initial report must contain:

• Date and time of detection;
• Description of the incident;
• Personal data potentially affected;
• Data subjects affected (estimated number and categories);
• Cause (when known);
• Containment measures adopted;
• Preliminary risk assessment;
• Action plan.

20.3 Updates and Cooperation

NUVEM.ONLINE undertakes to provide the client with continuous updates on the progress of the investigation and to cooperate fully in the investigation of the incident, damage mitigation, notification to the ANPD and notification to data subjects, when necessary.

21. Data Mapping and Inventory

Personal data mapping is an essential instrument for LGPD compliance and for managing privacy risks.

21.1 Mapping Obligations

• NUVEM.ONLINE will keep an up-to-date inventory of all personal data flows it processes, indicating: source, purpose, legal basis, data categories, data subjects, recipients, retention period and security measures adopted;
• The inventory will be reviewed every six months and whenever there is a new project, contract or significant change in operations;
• The Data Protection Officer is responsible for coordinating and updating the mapping;
• Mapping is a prerequisite for preparing the RIPD (Section 22) and for responding to audits.

21.2 Recording Instrument

The inventory must be kept in an accessible and auditable format, preferably in an electronic system, and made available to the ANPD and to contracting clients whenever requested.

22. Data Protection Impact Report (RIPD)

Under Art. 38 of the LGPD, the ANPD may require the controller to prepare a Personal Data Protection Impact Report (RIPD/DPIA), especially for processing that may pose risks to the civil liberties and fundamental rights of data subjects.

22.1 When to Prepare the RIPD

NUVEM.ONLINE will prepare the RIPD preventively when it:

• Processes sensitive personal data on a large scale;
• Systematically monitors data subjects in public areas;
• Implements new high-risk processing systems or processes;
• Processes data of children and adolescents;
• Is required to do so by a client/Controller or by the ANPD.

22.2 Minimum Content of the RIPD

The RIPD must contain:

• Description of the processing and its purposes;
• Applicable legal bases;
• Assessment of necessity and proportionality;
• Identification and assessment of risks to data subjects’ rights;
• Mitigation measures adopted;
• Residual risk assessment after mitigation.

22.3 Responsibility and Review

The Data Protection Officer coordinates the preparation and review of the RIPD, with approval from the Board of Directors. The RIPD must be reviewed whenever there is a significant change in the processing assessed.

23. Sanctions

23.1 Internal Sanctions

For staff:

• Verbal warning;
• Written warning;
• Suspension without pay;
• Dismissal for just cause (Art. 482, "h", CLT);
• Civil liability for damages caused.

For third parties and sub-processors:

• Termination of the contract for breach;
• Inclusion in a restricted list;
• Civil liability.

23.2 ANPD Administrative Sanctions

The LGPD (Art. 52) provides for the following administrative sanctions:

• Warning, with a deadline for adopting corrective measures;
• Simple fine of up to 2% of the economic group’s revenue in Brazil, limited to R$ 50,000,000.00 per infraction;
• Daily fine, subject to the total limit;
• Public disclosure of the infraction;
• Blocking or deletion of the personal data to which the infraction refers;
• Partial or total suspension of the database;
• Partial or total prohibition of processing activities.

23.3 Liability of Third Parties and Sub-processors

NUVEM.ONLINE may be held liable for the acts of third parties and sub-processors acting on its behalf. Therefore, all of them must strictly comply with this Policy, the contracts entered into and the applicable legislation.

24. Final Provisions

24.1 Effective Date

This Policy comes into force on the date of its approval by the Board of Directors of NUVEM.ONLINE.

24.2 Review and Update

This Policy will be reviewed periodically (at least annually) or whenever:

• There is a change in data protection legislation or regulations;
• There is a significant change in NUVEM.ONLINE’s operations;
• A need for improvement is identified after an incident or audit;
• There are new requirements from clients or regulatory authorities.

24.3 Communication of Changes

Any change will be communicated to all staff and relevant third parties, with reasonable advance notice.

24.4 Questions

Questions about this Policy should be addressed to the Data Protection Officer, through the channels listed in Section 6.4.

24.5 Integration with Other Policies

This Policy is part of NUVEM.ONLINE’s Integrity Program and must be read together with:

• Code of Ethics and Conduct;
• Anti-Corruption Policy;
• Information Security Policy;
• Third-Party and Sub-processor Management Policy;
• Other compliance policies.

24.6 Legal and Contractual Compliance

This Policy meets the requirements of Law No. 13,709/2018 (LGPD), CD/ANPD Resolution No. 15/2024 and NUVEM.ONLINE’s contractual obligations towards clients and partners.