1. Identification
Controller: VERIXA CONSULTORIA EM TECNOLOGIA DA INFORMAÇÃO LTDA, Brazilian company registration (CNPJ) 66.466.170/0001-74. Privacy channel: privacidade@verixa.com.br.
2. Applicable regime
Vorvex is established in Brazil and its processing is governed by the General Data Protection Law (LGPD, Law 13.709/2018). This does not remove the obligations of clients subject to other regimes: where the GDPR, the CCPA or another law applies to the client, the corresponding requirements are addressed in the contract and in the testing authorization.
3. Controller and processor
The client is responsible for the assets, data, purposes and authorizations related to the assessed environment. Vorvex processes information according to the contract and the scope, acting as processor during execution and as controller in its own registration, security, billing and support processes.
4. Minimization and purpose
The collection of evidence is limited to what is needed to demonstrate the risk. Wherever possible we avoid reproducing or storing personal data beyond what is necessary to validate, communicate and remediate the finding.
5. Data subject rights
Confirmation, access, correction, anonymization, blocking, deletion, information, portability and objection can be requested under the applicable law and according to the role played in each processing activity.
6. Security and incidents
Prevention and response measures are applied according to risk and contract. Significant incidents will be analyzed and communicated to the client and to the authorities where there is a legal obligation to do so.
7. Contact channel
Requests should be sent to privacidade@verixa.com.br, with enough information to identify the data subject and the context of the processing.