Privacy Policy

This Privacy Policy explains how CUSTODIUM CYBERSECURITY LTDA ("Custodium", "we", "us") collects, uses, stores, shares and protects personal data when you visit https://custodiumcybersecurity.com or contact us. We are committed to processing personal data lawfully, transparently and securely, in accordance with Brazil's General Data Protection Law (LGPD, Law 13.709/2018) and the EU General Data Protection Regulation (GDPR, Regulation 2016/679) where applicable.

1. Data we collect

We collect only the data needed to respond to your requests and provide our services:

• Contact data you provide through our forms or channels: name, company, business email, phone/WhatsApp, country and the content of your message.
• Technical data collected automatically, such as IP address, browser type and pages visited, used to keep the site secure and functioning. We use privacy-friendly analytics and do not build advertising profiles.

2. How we use your data

• To respond to your enquiries and provide the information or services you request.
• To prepare and manage service proposals and contracts.
• To maintain the security, integrity and proper operation of our website.
• To comply with legal and regulatory obligations.

3. Legal bases for processing

We process personal data on the basis of your consent, the steps necessary to enter into or perform a contract, our legitimate interests in responding to business enquiries and securing our systems, and compliance with legal obligations.

4. Sharing of data

Custodium does not sell, rent or trade personal data. We may share data only with service providers that support our operations (for example, email or infrastructure providers) under confidentiality obligations, or when required by law or competent authorities.

5. International data transfers

Custodium is based in Brazil and personal data is primarily processed in Brazil. Where data is transferred internationally, we apply appropriate safeguards consistent with the LGPD and GDPR.

6. Data security

We apply technical and organizational measures appropriate to the risk — including encryption in transit (HTTPS/TLS), access controls and the principle of least privilege — to protect personal data against unauthorized access, loss or disclosure.

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes described here, to comply with legal obligations, or to exercise or defend legal rights. After that, data is deleted or anonymized.

8. Cookies

We use only essential cookies and privacy-friendly analytics that do not track you across other websites. Where non-essential cookies are used, we ask for your consent and you can change your choice at any time.

9. Your rights

Subject to applicable law, you have the right to: access your data; request rectification of inaccurate data; request erasure; restrict or object to processing; request data portability; withdraw consent at any time; and obtain information about data sharing. EU data subjects additionally have the right to lodge a complaint with a supervisory authority.

10. Third-party links

Our website may link to third-party sites. We are not responsible for their privacy practices and encourage you to review their policies.

11. Changes to this policy

We may update this Policy to reflect legal, technical or operational changes. The "last updated" date above indicates the latest revision.

12. Controller and contact

Data controller: CUSTODIUM CYBERSECURITY LTDA, CNPJ 67.593.314/0001-16, Joinville, Santa Catarina, Brazil.

For any privacy request or question, contact us at contact@custodiumcybersecurity.com.

These documents are provided in English for convenience; review by Custodium's legal counsel is required before publication.