Privacy Policy

1. Who We Are

DPOSaaS Solutions Ltd. operates in privacy, data protection, and information governance, providing technological, methodological, and educational solutions focused on legal compliance and best practices for personal data processing. Unless otherwise specified, DPOSaaS Solutions Ltd. is the Data Controller responsible for the personal data described in this Privacy Notice.

Through www.dposaas.com, we provide tools, certifications, and training related to GDPR, LGPD, and AI governance for individuals, companies, and public institutions — through three integrated products: DPO App, Academy, and Authority.

2. Scope of this Privacy Notice

This Privacy Notice applies to www.dposaas.com and to the services operated by DPOSaaS Solutions, including the DPO App, DPOSaaS Academy, DPOSaaS Authority, customer support, contact forms, marketing communications, recruitment processes, and any related online service. It describes how personal data is collected, used, shared, and protected across these services. Where a specific product or process has its own supplementary notice, that notice applies in addition to this one.

3. Personal Data We Collect

The personal data processed may vary depending on how you interact with our services.

Information you provide

• Identification data (name, email address)
• Contact data (phone number)
• Professional data (company, role, department)
• Billing and payment information, when applicable

Information collected automatically

• IP address
• Browser and device type
• Access logs and timestamps

Information generated while using the platform

• Course progress and training records
• Activity history
• Authentication events
• Audit logs

DPOSaaS Solutions does not collect unnecessary sensitive data and limits processing to what is strictly necessary for each purpose.

4. Purposes of Processing

• Create and manage user accounts
• Provide access to platform features (DPO App, Academy, Authority)
• Manage licenses, subscriptions, and corporate access
• Process payments and fulfill contractual obligations
• Send communications related to contracted services
• Comply with legal and regulatory obligations (GDPR, LGPD)
• Improve user experience and platform security

5. Legal Bases

Data processing is grounded in the following legal bases:

• Performance of a contract — Art. 6(1)(b) GDPR / Art. 7(V) LGPD
• Legal or regulatory obligation — Art. 6(1)(c) GDPR / Art. 7(II) LGPD
• Legitimate interest — Art. 6(1)(f) GDPR / Art. 7(IX) LGPD
• Consent, where required — Art. 6(1)(a) GDPR / Art. 7(I) LGPD

6. Data Sharing

Personal data may be shared only when strictly necessary, with:

• Technology infrastructure providers (e.g., Google LLC / Firebase for hosting and authentication)
• Essential partners for service delivery
• Public authorities or supervisory bodies (CNIL, ICO, ANPD, etc.) when legally required

Third parties only receive the personal data necessary to perform the contracted services, under confidentiality and data protection obligations. DPOSaaS Solutions does not sell personal data.

7. International Data Transfers

Some of our infrastructure and service providers may process personal data outside the country where it was originally collected. Where such transfers occur, DPOSaaS Solutions implements appropriate safeguards in accordance with the GDPR, the LGPD, and other applicable data protection regulations, including contractual safeguards with service providers where required. These safeguards are intended to ensure that personal data continues to receive an appropriate level of protection regardless of where it is processed.

8. Data Retention

Personal data is retained according to the purpose for which it was collected, and only for as long as necessary to fulfil that purpose or to comply with applicable legal obligations.

9. Security Measures

DPOSaaS Solutions maintains technical, organisational, and administrative safeguards based on a risk-based information security program, including:

• Role-based access control
• Encrypted data transmission (TLS)
• Activity logging and audit trails
• Use of technology providers with recognized security certifications (Google Cloud)

These measures are reviewed periodically and adapted to the evolving risks associated with the personal data processed.

10. Your Rights

Depending on your jurisdiction, you may exercise the following rights at any time:

• Right of access to your personal data
• Right to rectification of inaccurate or incomplete data
• Right to erasure (“right to be forgotten”) — Art. 17 GDPR / Art. 18(IV) LGPD
• Right to restriction of processing
• Right to object to processing
• Right to data portability — Art. 20 GDPR / Art. 18(V) LGPD
• Right to withdraw consent at any time (where processing is consent-based)
• Right to lodge a complaint with your supervisory authority (e.g., CNIL for France, ICO for the UK, ANPD for Brazil)

All requests should be directed to our Data Protection Officer (DPO). Requests are handled in accordance with the response periods established by applicable legislation.

11. Data Protection Officer (DPO)

DPOSaaS Solutions has appointed a Data Protection Officer available to assist data subjects and competent supervisory authorities.

12. Recruitment Privacy

When candidates apply for employment opportunities through DPOSaaS Solutions, the personal information contained in CVs, cover letters, and other recruitment communications — including qualifications, interview notes, and references — is processed solely for recruitment purposes.

This information is used to assess candidate suitability, organise interviews, and manage the recruitment process. It is retained only for as long as necessary for recruitment purposes or to comply with applicable legal obligations, after which it is securely deleted or anonymised. Candidates should avoid submitting sensitive personal data that is not necessary for the recruitment process.

13. Children's Privacy

DPOSaaS Solutions' services are designed for professional and business use and are not intended for children, unless expressly indicated for a specific educational context. We do not knowingly collect personal data from children in violation of applicable legislation. If we become aware that personal data has been collected from a child without appropriate legal basis or authorisation, we will take reasonable steps to delete that information.

14. Artificial Intelligence

DPOSaaS Solutions provides AI-enabled features within its platform, such as DPO Agent™ and AI Assist, designed to support privacy and governance professionals in their work. AI-assisted features operate under human oversight and governance principles: outputs are intended to inform, not replace, professional judgement, and remain subject to review by qualified individuals.

DPOSaaS Solutions does not rely exclusively on automated decision-making producing legal or similarly significant effects on individuals, unless expressly communicated and permitted by applicable law.

15. Cookies and Similar Technologies

The platform uses cookies and similar technologies for operation, security, and user experience improvements. Please refer to our Cookie Policy for full details. Cookie preferences can be managed through your browser settings.

16. Changes to This Policy

This Privacy Policy may be updated to reflect legal, regulatory, or operational changes. The current version is always available at this URL, with the effective date shown above.

17. Contact

For any questions or requests related to this Privacy Policy or personal data protection, please contact our DPO at dpo@dposaas.com.br, or use our contact form.