1. Controller and scope
VERIXA CONSULTORIA EM TECNOLOGIA DA INFORMAÇÃO LTDA, Brazilian company registration (CNPJ) 66.466.170/0001-74, is responsible for the Apex site, for commercial contacts and for the processing carried out to manage the engagement and delivery of its services.
Privacy matters can be sent to privacidade@verixa.com.br.
2. Data processed
We process data according to the interaction, the proposal and the authorized scope.
- Name, email, phone, role, company, company registration number and contact details.
- Data provided to prepare a proposal, contract, authorization and invoicing.
- Assets, owners, windows, access and restrictions provided to plan the assessment.
- Evidence, findings, technical records and communications produced during the service.
- IP address, browser, date, time and logs needed for security and audit.
3. Purposes and legal bases
We use the data to answer requests, prepare and perform contracts, maintain security and traceability, comply with legal obligations and exercise rights. When Vorvex processes data present in the client's environment, it acts according to the scope and the documented instructions of the client.
4. Roles under data protection law
Vorvex acts as controller of the data of its contacts, clients, users and administrative processes. During assessments in contracted environments it may act as processor, while the client remains controller of the data and responsible for the authorization, the legal basis and the definition of the scope.
Vorvex is a Brazilian company and operates under Brazil's General Data Protection Law (LGPD, Law 13.709/2018). Where the client is subject to another regime — such as the GDPR — the applicable requirements, including those for international transfers, are addressed in the contract before work starts.
5. Sharing and confidentiality
Data may be processed by essential providers of hosting, communication, monitoring, billing and technical tooling. Access is limited to what is necessary and subject to controls and confidentiality commitments. Evidence and vulnerabilities are never sold.
6. Retention and security
Records are kept according to the contract, operational need, legal obligations and the defense of rights. We apply access controls, protection of communications, audit logs and security procedures proportionate to the sensitivity of the data.
7. Rights and contact
Data subjects can exercise their rights through privacidade@verixa.com.br. Where the request involves data under the client's control, we cooperate with the responsible controller.
8. Updates
This policy may be updated to reflect legal, contractual or operational changes. The version in force will remain published on this page.