Privacy and Data Protection Policy

01 Introduction

CBR Consultoria — led by Claudio Araujo and Bruno Raimundo — provides technology and information security consulting services, including governance, risk management, regulatory compliance, project management, specialist staffing, incident response and fractional leadership (CISO/CTO as a Service) for companies in the financial sector and highly regulated markets.

As a natural part of that work — and because we believe an information security and privacy consultancy must lead by example — we take seriously the protection of the personal data of everyone who visits our website, fills in our contact form or becomes our client. This policy was drafted in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018 — LGPD) and describes our practices for collecting, using, storing, sharing and protecting personal data.

By using the cbrconsultoria.info website or providing your data through our contact channels, you acknowledge the practices described in this document.

This is a courtesy translation. In the event of any discrepancy, the Portuguese version prevails.

02 Who the data controller is

For the purposes of the LGPD, the controller of the personal data processed through the cbrconsultoria.info website is CBR Consultoria, represented by its partners Claudio Araujo and Bruno Raimundo.

03 What data we collect

We collect only the data needed to respond to your enquiry and, where applicable, to provide the contracted services. We do not collect sensitive data (health, racial origin, religious beliefs, etc.) through the website.

04 What we use your data for

• Responding to requests submitted through the contact form, WhatsApp or e-mail;
• Understanding your company's context and needs before any commercial proposal;
• Scheduling and conducting assessment meetings and scoping presentations;
• Preparing commercial proposals and, if engaged, delivering the agreed services;
• Complying with legal, regulatory and contractual obligations applicable to the client relationship;
• Keeping records of communications for security, audit and dispute-resolution purposes.

We do not use your data to send unsolicited marketing communications (spam), nor do we sell or rent it to third parties under any circumstances.

05 Legal basis for processing

Each processing activity carried out by CBR Consultoria relies on one of the legal bases set out in Art. 7 of the LGPD:

• Consent (Art. 7, I) — when you voluntarily fill in the website contact form;
• Performance of a contract or preliminary procedures (Art. 7, V) — to prepare proposals and deliver contracted services;
• Compliance with a legal or regulatory obligation (Art. 7, II) — where applicable to the nature of the services provided to financial-sector clients;
• Legitimate interest (Art. 7, IX) — for internal administrative purposes, information security and fraud prevention, always proportionately and without overriding your fundamental rights and freedoms.

06 Who we share your data with

Your data is never sold and is only shared with third parties in the following cases, always limited to the minimum necessary:

• Infrastructure and technology providers that operate the website and message delivery — hosting (Bluehost) and transactional e-mail service (SMTP provider);
• Corporate e-mail provider (Microsoft 365) for receiving messages sent through the contact form;
• Public authorities, where required by law, court order or a valid regulatory request;
• Legal or accounting advisors, strictly where necessary for CBR Consultoria to exercise its rights.

All providers that may access personal data on behalf of CBR Consultoria are subject to contractual obligations and/or their own data protection policies compatible with this policy.

07 International data transfers

Part of the technology infrastructure used by CBR Consultoria — such as hosting and e-mail services — may process or store data on servers located outside Brazil, including in the United States. These international transfers occur only to the extent necessary to provide hosting and communication services, and we seek to use vendors that adopt data protection standards compatible with those required by the LGPD (Art. 33), including contractual clauses and the vendors' own privacy policies.

08 How long we keep your data

We keep your personal data only for as long as necessary to fulfil the purposes described in this policy, as follows:

• Data of contacts that do not progress to a proposal or contract: kept for up to 24 months from the last contact, and deleted earlier upon request;
• Data of clients with an active or terminated contract: kept for the period required by applicable civil, tax and regulatory legislation (as a rule, up to 5 years after the relationship ends, varying with the nature of the obligation);
• Communication records relevant to complying with a legal obligation or to defence in administrative/judicial proceedings: kept for the applicable limitation period.

Once the retention periods expire, data is securely deleted or anonymised, unless a legal obligation requires storage for a different period.

09 How we protect your data

As a consultancy specialised in information security, we apply to our own processes the same principles we recommend to our clients:

• Contact-form data transmitted over an encrypted connection (HTTPS/TLS);
• Access restricted to the people who actually need to process the data to handle your request;
• Protection against automated submissions/spam (honeypot) on the website form;
• Good practices for password management, authentication and access segregation in our internal systems;
• Periodic assessment of infrastructure vendors' security practices.

No system is 100% immune to incidents. Should a security incident occur that may create relevant risk to data subjects, CBR Consultoria will notify the Brazilian National Data Protection Authority (ANPD) and the affected data subjects, as required by the LGPD.

10 Cookies and tracking technologies

The cbrconsultoria.info website does not use its own tracking cookies, social media pixels or analytics tools (such as Google Analytics) as of the publication of this policy.

The website loads typefaces hosted by Google Fonts (fonts.googleapis.com / fonts.gstatic.com). This loading may expose your IP address to Google as part of the normal technical operation of the internet, subject to Google's privacy policy. We do not use this feature for tracking or advertising purposes.

If cookie, analytics or advertising tools are adopted in the future, this policy will be updated and, where required by law, a cookie consent banner will be implemented before those tools are activated.

11 Your rights as a data subject

Under Art. 18 of the LGPD, you have the right to:

You also have the right to lodge a petition regarding your data with the Brazilian National Data Protection Authority (ANPD) and to object to processing based on a legal ground other than consent, where applicable.

12 How to exercise your rights

To exercise any of the rights listed above, contact us at claudio.araujo@cbrconsultoria.info, stating your full name and the right you wish to exercise. We may request additional information to confirm your identity before processing the request, as a way of protecting your own data against undue access.

We respond to requests within the timeframes established by the LGPD, as a rule within 15 days of identity confirmation; this period may be extended with justification in the cases provided for by law.

13 Data of minors

CBR Consultoria's website and services are intended for companies and adult professionals. We do not knowingly collect personal data from children or adolescents. If we identify that a minor's data was provided without proper consent from their legal guardians, that data will be deleted.

14 Changes to this policy

This policy may be updated from time to time to reflect changes in our practices, our services or applicable legislation. The "last updated" date at the top of this page indicates the current version. Relevant changes will be highlighted on this same page.

15 Contact and data protection officer

For questions about this policy, requests relating to your personal data, or any matter concerning data protection at CBR Consultoria, contact us:

• E-mail: claudio.araujo@cbrconsultoria.info
• WhatsApp: +55 21 99870-2653
• Website: cbrconsultoria.info

This channel also serves as the point of contact for matters relating to CBR Consultoria's data protection officer (DPO), under Art. 41 of the LGPD.

16 Version control

This section records the version history of this Privacy Policy, for transparency and traceability purposes.