Data Protection — LGPD & GDPR

Custodium treats data protection as a core part of its security practice. This page summarizes how we comply with Brazil's General Data Protection Law (LGPD, Law 13.709/2018) and, for visitors and clients in the European Union, the General Data Protection Regulation (GDPR, Regulation 2016/679). It complements our Privacy Policy.

1. Our principles

We process personal data according to the principles shared by the LGPD and GDPR:

• Lawfulness, fairness and transparency — we tell you what we do with your data.
• Purpose limitation — data is collected for specific, legitimate purposes.
• Data minimization — we collect only what is necessary.
• Accuracy — we keep data correct and up to date.
• Storage limitation — we retain data only as long as needed.
• Integrity and confidentiality — we protect data with appropriate security measures.
• Accountability — we can demonstrate our compliance.

2. Roles

For data you provide through this website, Custodium acts as the controller. When we process data on behalf of a client as part of a contracted service, we act as an operator / processor, strictly under the client's instructions and a data processing agreement.

3. Legal bases

Depending on the context, we rely on: consent; performance of a contract or pre-contractual steps; compliance with a legal obligation; and legitimate interests (such as responding to business enquiries and protecting our systems), balanced against your rights and freedoms.

4. Your rights

Under the LGPD and GDPR you may, subject to applicable conditions:

• Confirm whether we process your data and access it;
• Request correction of incomplete or inaccurate data;
• Request anonymization, blocking or erasure;
• Request data portability;
• Restrict or object to certain processing;
• Be informed about with whom your data has been shared;
• Withdraw consent at any time, without affecting prior processing;
• (EU data subjects) lodge a complaint with a supervisory authority.

5. International data transfers

Custodium is established in Brazil and primarily processes personal data there. Where personal data of EU data subjects is transferred outside the EEA, we apply appropriate safeguards (such as standard contractual clauses or an adequacy decision where available).

6. Data security

As a cybersecurity company, security is central to how we operate. We apply encryption in transit, strict access controls, logging and the principle of least privilege, and we review our measures regularly.

7. How to exercise your rights

To exercise any right, or to ask a data-protection question, contact us at [email protected]. We will respond within the timeframes required by applicable law. We may need to verify your identity before acting on a request.

Controller: CUSTODIUM CYBERSECURITY LTDA, CNPJ 67.593.314/0001-16, Joinville, Santa Catarina, Brazil.

These documents are provided in English for convenience; review by Custodium's legal counsel is required before publication.