This Privacy and Data Protection Policy is also accessible through our Trust Portal at trust.opencybersecurity.co, where you can find additional security, compliance and privacy documentation.
01 — Application
This policy applies to all employees, contractors, and vendors while doing business with OPEN CYBERSECURITY LLC and others who have access to personally identifiable information (PII), also referred to as personal data, in connection with OPEN CYBERSECURITY LLC’s operating activities.
02 — Policy
OPEN CYBERSECURITY LLC is committed to protecting the security, confidentiality, and privacy of its information resources including personal data in accordance with the requirements set forth in ISO 27701, the Brazilian General Data Protection Law (LGPD), GDPR, CCPA, and all relevant privacy frameworks, laws and regulations. Personal data shall only be processed when there is a legal basis to do so; data shall be managed to ensure that security, confidentiality, and privacy are maintained, and data will be used only for authorized purposes. All employees and contractors share the responsibility for safeguarding personal data to which they have access.
2.1 Company Role and Scope
OPEN CYBERSECURITY LLC acts as an authorized Vanta reseller and operates primarily as a Data Processor (Operator) under Article 5 of the LGPD when applicable. The company does not store personal data of Nubank end-customers in its own systems, but may process personal data in accordance with contractual obligations and applicable law.
When performing commercial activities in support of OPEN CYBERSECURITY LLC products and services that impact personal data, OPEN CYBERSECURITY LLC may engage in activities which require it to receive, store, process, transmit, create, or access personal data. This policy is intended to:
- Ensure compliance with LGPD, GDPR, and CCPA
- Establish technical, physical, and administrative safeguards for personal data
- Set forth roles and responsibilities for processing of personal data
03 — Data Classification
OPEN CYBERSECURITY LLC employs a four-tier data classification system to ensure appropriate handling and protection of data based on sensitivity levels.
3.1 Classification Levels
- Public — Information that can be disclosed externally without restriction. Handling: No special access controls. Encryption: Not required. Examples: Marketing materials, public website content.
- Internal — Information for internal use within OPEN CYBERSECURITY LLC. Handling: Access limited to employees and authorized contractors. Encryption: Required for transmission outside company networks. Examples: Internal policies, business plans.
- Confidential — Sensitive information requiring protection from unauthorized disclosure. Handling: Strict need-to-know basis; written authorization for external sharing. Encryption: Required for storage and transmission. Requirement: All personal data must be classified at minimum as ‘Confidential’. Examples: Customer data, employee records, financial information.
- Restricted — Highly sensitive information requiring the highest level of protection. Handling: Limited to specifically authorized individuals; formal approval required. Encryption: Strong encryption + access logging. Requirement: Sensitive personal data (LGPD Art. 5, II) must be classified as ‘Restricted’. Examples: Health data, biometric data, racial/ethnic origin, political opinions.
3.2 Classification Requirements
- All personal data must be classified at least as ‘Confidential’
- Sensitive personal data (LGPD Article 5, II) must be classified as ‘Restricted’
- Data classification reviewed annually and updated as necessary
- All data must be clearly labeled with its classification level
04 — Incident Response
OPEN CYBERSECURITY LLC maintains a formal incident response process for personal data breaches and security incidents.
4.1 Incident Response Process
- Detection — Identification through monitoring, reporting, or automated systems
- Containment — Immediate actions to limit scope and impact
- Analysis — Investigation of nature, scope, and cause
- Notification — Timely notification to authorities and affected parties
- Lessons Learned — Post-incident review and improvements
4.2 Notification Requirements
ANPD Notification (LGPD Compliance). Notify the Brazilian National Data Protection Authority within 72 hours of confirming a personal data breach (LGPD Article 48). Notification must include nature of breach, categories of data affected, approximate number of data subjects, and mitigation measures.
Partner Notification. Notify affected partners (including Nubank) within 24 hours of confirming a personal data incident affecting their data or operations. Provide detailed information and status updates.
DPO Contact. All incident notifications must be coordinated through the DPO at dpo@opencybersecurity.co.
4.3 Documentation Requirements
- All incidents documented with timestamps, actions taken, and lessons learned
- Incident records maintained for compliance reporting and audit purposes
05 — Retention and Disposal
5.1 Data Retention Periods
| Data Type | Retention | Scope |
|---|
| Operational Data | Duration of contract | Service delivery (annual review) |
| Fiscal & Contractual | 5 years after termination | Financial records, contracts, invoices, tax docs |
| Audit Logs | 1 year | System access, security events, audit trails |
5.2 Data Disposal Procedures
Logical Deletion
- Overwriting of data using approved secure deletion tools
- Multiple-pass overwriting for sensitive data
- Verification of successful deletion
Physical Destruction
- Physical destruction of storage media when logical deletion insufficient
- Use of certified destruction services for sensitive media
- Documentation of destruction process
Certificate of Destruction
- Certificates provided upon request for compliance purposes
- Include details of data destroyed, method used, and date
- Maintained as part of compliance documentation
06 — Roles and Responsibilities
6.1 Chief Information Security Officer (CISO)
Jorge García (ciso@opencybersecurity.co) serves as the CISO and is responsible for:
- Overall oversight of this Privacy and Data Protection Policy
- Ensuring implementation of technical and administrative safeguards
- Coordinating privacy and security program activities
- Serving as primary contact for privacy and security matters
6.2 Data Protection Officer (DPO)
Contact: dpo@opencybersecurity.co. Under Article 39 of the GDPR and LGPD, the DPO shall:
- Inform and advise the controller/processor and employees on data protection obligations
- Monitor compliance with applicable privacy regulations and internal policies
- Provide advice regarding data protection impact assessments
- Cooperate with supervisory authorities
- Act as contact point for supervisory authorities on processing matters
- Respond to data subject requests and complaints
- Maintain records of processing activities
07 — Implementation
7.1 Data Protection and Regulatory Compliance
All personal data requires a legal basis for processing and will be accessible on a strict need-to-know basis. Personal data must be protected from unauthorized access, modification and disclosure.
Storage and Transmission
- Personal data encrypted with strong cryptography in storage and transmission
- Encryption standards must meet current industry best practices and regulatory requirements
Disposal
- Paper records securely shredded prior to disposal
- Electronic media securely wiped, sanitized or physically destroyed prior to disposal/reuse
Awareness Training
- Training on information security and data privacy responsibilities
- Includes DSAR procedures and incident response
- Annual refresher required for personnel handling personal data
Third-Party Data Sharing
- No PII transmitted to third-party/vendor until DPA fully executed
- Service provider contracts must prohibit unauthorized retention, use, or disclosure
Compliance Requirements
- At least two methods for data subjects to submit access requests (email + webform)
- Public-facing Privacy Policy describes data subjects’ rights and updated at least annually
- Opt-out processes require minimal steps consistent with customer interaction
7.2 Breach Notification
Notification of any reportable unauthorized use or disclosure of personal data will be sent to affected parties, Data Controllers, and relevant regulators in accordance with all applicable notification requirements and the Incident Response Policy.
7.3 Identity Verification
OPEN CYBERSECURITY LLC shall establish reasonable methods for verifying the identity of requestors which shall not require a fee from the data subject.
- Implement reasonable security measures to detect and prevent fraudulent identity verification
- For password-protected accounts, existing authentication may be used
- Before providing categories of personal information — reasonable degree of certainty
- Before providing specific data or honoring deletion requests — high degree of certainty
08 — Data Subject Access Requests
Subject to applicable legal exceptions, OPEN CYBERSECURITY LLC will comply with data subject requests concerning:
- Access — copy of personal data undergoing processing
- Rectification — correction of data stored or processed
- Erasure — right to be forgotten
- Restriction of processing
- Data portability
- Objection — withdrawal of consent
- Automated decision-making, including profiling
8.1 Request Submission Methods
8.2 Response Requirements
- Acknowledge requests within 10 business days
- Respond within 30 days of initial submission
- May extend up to additional 45 days if necessary
- Individual responses required; not generic or policy referrals
- Search all relevant systems and databases for requested information
8.3 Agent Verification
- Require proof of signed authorization from data subject
- Verify agent identity and authority
- May require data subject to verify identity directly
09 — Records of Processing Activities
In accordance with LGPD Article 37 and GDPR Article 30, records of processing activities are maintained including:
- Name and contact details of controller/processor and DPO
- Purposes of processing
- Categories of data subjects and personal data
- Categories of recipients of personal data
- International transfers and safeguards
- Time limits for data erasure
- General description of technical and organizational security measures
10 — International Data Transfers
When transferring personal data internationally, OPEN CYBERSECURITY LLC ensures:
- Adequate level of protection in destination country, or
- Appropriate safeguards through binding corporate rules, standard contractual clauses, or certification mechanisms
- Documentation of transfer mechanism and safeguards applied
11 — Compelled Disclosure
Compelled disclosure of personal data pursuant to valid legal demands is governed by:
- No voluntary provision to law enforcement without express written consent
- Immediate notification to Chief Legal Officer, CEO, and DPO upon receipt of legal demands
- Immediate notification to relevant Data Controllers unless prohibited by law
- Investigation of demands for validity before compliance
- External communications require approval from designated authorities
12 — Enforcement
The CISO, DPO, and Legal Counsel are responsible for enforcement of this policy. Employees with questions should contact their local Information Security, IT or HR management representative.
13 — Disciplinary Action
Failure to comply with any provision of this policy may result in disciplinary action, including, but not limited to, termination.
14 — Reporting
Suspected violations must be reported to the DPO at dpo@opencybersecurity.co or via the incident reporting process.
OPEN CYBERSECURITY LLC takes no adverse action against persons reporting in good faith. Failure to report known or suspected wrongdoing may subject personnel to disciplinary action up to and including termination.
15 — Applicable Laws, Regulations and Standards
- Brazilian General Data Protection Law (LGPD — Lei Geral de Proteção de Dados)
- General Data Protection Regulation (GDPR)
- California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)
- ISO 27701 Privacy Information Management System (PIMS)
- SOC 2 Privacy Criterion
16 — Version History
| Version | Date | Description | Author | Approved By |
|---|
| 1.0 | 2026-05-12 | Initial version | Jorge García | Lucas Galvão |
