Privacy notice

1. Introduction

This Privacy Policy presents, in a simple, objective and transparent way, information about how the SEK Group – Security Ecosystem Knowledge collects and uses the personal data of the users and visitors of our Institutional Portal.

The SEK Group – Security Ecosystem Knowledge is committed to providing the protection resources required by Latin American organizations to defend themselves against the broad and sophisticated range of today's cyber threats.

We value transparency, we respect your privacy and we are committed to complying with the requirements of the applicable national and international privacy and personal data protection laws, as well as with this document, which describes how we process your personal data, your rights and the means available to you to seek information.

To make this Policy easier to understand, whenever we use the term “YOU”, in uppercase or lowercase, we are referring to the user or visitor of our website.

Our responsibilities

If you are a user or merely a visitor of our Portal, we will act as the “controller” of your personal data whenever we collect it. And what does that mean? It means we determine the manner and purpose for which your personal data is used.

In addition, we need to clarify what your rights are and provide you with the appropriate means to exercise them. Therefore, below you will find the access channel to our Privacy Portal and the contact of the Personal Data Officer of the SEK Group – Security Ecosystem Knowledge.

Personal Data Officer

You may contact our Personal Data Officer to request your rights, ask for information and clarify questions, through the following means of communication:

Names of the DPOs:

• Colombia: Juan Carlos Lara ([email protected])
• Brazil: PDK Advogados – Raphael Dutra da Costa Campos ([email protected])

Your responsibilities

• Read this document, as it is linked to your rights regarding personal data processing activities;
• Should you provide us with the personal data of third parties, or should third parties provide us with your personal data, we will only use it for the specific reason for which such data was provided. We remind you that you are solely responsible for (i) ensuring, prior to providing the third party's data to the SEK Group – Security Ecosystem Knowledge, the legality of the sharing, (ii) having informed the third party about the terms of this Policy and (iii) keeping the SEK Group – Security Ecosystem Knowledge free from any liability related to the lack of information and/or consent of the third party (it may be necessary to make contact to ensure the authenticity of the requests of personal data subjects); and
• By providing your personal information, you authorize us to process it in accordance with this Policy and the applicable legislation.

2. When and how we collect your personal data

Personal data is any information that can identify you or relate to you, directly or indirectly. Therefore, in order to carry out its activities, the SEK Group – Security Ecosystem Knowledge collects and uses personal data. Regarding the way in which the collection of your personal data is carried out, the following stand out:

When you browse the SEK Group's portal

When you access and browse the website of the SEK Group – Security Ecosystem Knowledge, whether you are a partner, employee or simply a user interested in our activities, we collect your IP address, information about the device used, and the date and time of access.

In addition, the storage of information related to access to our Portal (such as the IP address, for example) is mandatory under the terms of the Brazilian Internet Civil Framework (Law 12,965/2014), which requires access logs to be kept for a minimum period of 6 months.

When you interact with us

We collect personal data when you show interest in our activities and wish to become an employee or a member of our network by filling out our registration forms. Or when you contact us through our service channels (such as social media, telephone, e-mail and contact forms available on our Portal) to resolve questions, raise an issue and/or send us your suggestions.

When you register through the Portal

When you register, we collect your data through the registration forms in order to carry out the selection and to contact you, which may involve collecting your first name, surname, position, company, telephone, e-mail, etc.

3. Why we use your personal data

To honor our commitment to your privacy, we only use your data in accordance with what the General Personal Data Protection Law permits. Here are the reasons why we process your data:

• Upon free, express, informed and unequivocal consent of the DATA SUBJECT, only when legally required, necessary or permitted. If the SEK Group – Security Ecosystem Knowledge uses the DATA SUBJECT's consent as the legal basis for processing their Personal Data, the DATA SUBJECT may withdraw their consent at any time;
• To comply with a legal or regulatory obligation;
• For the regular exercise of rights in judicial, administrative or arbitration proceedings;
• To establish a contractual relationship between the DATA SUBJECT and the COMPANY and to fulfill our obligations under the terms of a contract;
• In order to respond to requests from the DATA SUBJECT;
• To protect the vital interests of any person;
• On the basis of any other legal basis permitted by the LGPD;
• When necessary to meet the legitimate interests of the SEK Group – Security Ecosystem Knowledge, for example:

• Obtaining data to support and promote the activities of the SEK Group – Security Ecosystem Knowledge;
• Obtaining data to ensure the exercise of the DATA SUBJECT's rights or to provide services that benefit them;
• Ensuring the information security of our networks and systems;
• Administering and conducting business within the COMPANY;
• Preventing or investigating suspected or actual violations of the law, contractual breaches or breaches of other policies of the SEK Group – Security Ecosystem Knowledge;
• Optimizing or expanding our commercial reach and the relevance of our communication.

4. Your choices and rights

Your choices

You have control over your information and may object to operations involving your personal data; therefore, you may choose to unsubscribe from receiving newsletters about the SEK Group – Security Ecosystem Knowledge at any time, free of charge. In addition, you may:

• Request confirmation about which data we use and/or share and for what purposes;
• Request the deletion of your data from our database.

Your rights

You may exercise your rights through the Privacy Portal, as well as through our Form for requests of the rights of personal data subjects, under the terms of the General Data Protection Law (LGPD).

You have the right to confirm whether or not we process your personal information. If so, you may request access to your personal information, as well as additional information about personal data processing activities, such as:

• the categories of personal data processed about you;
• the purposes of the personal data processing activities;
• the retention periods of the personal information;
• and other matters that may clarify the data processing activities.

We remind you that, in order for your request to be granted, you must prove your identity by presenting your identification document or, in the case of a legal representative, a power of representation. In addition, your request will be answered within 15 (fifteen) days, counted from the date of receipt of your request.

Confirmation and Access

Confirmation of the existence or non-existence of personal data processing activities related to you will occur within 24h (twenty-four hours), counted from the receipt of your request (or, if a longer period is permitted by the applicable legislation, within that period) accompanied by the appropriate documentation referred to above. However, for a complete statement about the personal data processing activities and additional information about the activities carried out, we will observe the maximum period of 15 (fifteen) days (or within the longer period, if permitted by the applicable legislation).

Rectification

You have the right to request the correction and rectification of any inaccurate, incorrect or outdated personal data about you.

Objection

You may object to the personal data processing carried out on the basis of one of the situations where consent is not required.

Withdrawal of Consent

You may withdraw any consent previously granted. This action will make it impossible for us to continue performing operations with your personal data. However, the operations carried out up to the date of withdrawal will remain valid.

Portability

You may also request the portability of your personal data to another organization. In this case, we will send a copy in CSV so that you can provide it to the appropriate party. If you request it, and it is technically feasible, we will transfer your personal information to you. However, we will not do so if the portability involves personal data of third parties other than you, the request being exclusive to the data subject.

NOTE: The data considered portable is that which was provided to us by you, that is, data that may have been generated or supplemented by the SEK Group – Security Ecosystem Knowledge and that does not put our commercial and industrial secrets at risk.

Deletion

You have the right to request the deletion of your personal data held by the SEK Group – Security Ecosystem Knowledge, whenever your data is no longer necessary or is excessive for the established purposes.

It is important to note that in some situations the elimination of your personal data will not be possible, such as, for example, in cases where the storage of your data is an obligation provided for by law.

Therefore, in these cases we will respond to your request with the due explanation of the reasons that prevent us from deleting or anonymizing your personal data.

Petition

You may file a complaint with the National Data Protection Authority or with consumer protection bodies. However, we ask that you contact us in advance in an attempt to resolve your request.

5. How secure is your data?

We have a team specialized in Information Security, as well as in Privacy and Data Protection.

The security of your information is important to us and, therefore, we implement security, technical and administrative measures capable of protecting personal data from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication or any form of inappropriate or unlawful processing.

From this perspective, we apply technical and organizational measures capable of protecting personal data from destruction or loss, access, communication, dissemination, or alteration by unauthorized third parties, taking into account the risks, the structure, the scale, the volume of operations and the particularities of the personal data processed by the SEK Group – Security Ecosystem Knowledge.

And remember:

• Unfortunately, no data transmission is 100% secure, but we do everything possible within our technical and technological capabilities to ensure the privacy and protection of your data in accordance with the best practices recognized in the market;
• If you believe that your privacy or your data has been breached, contact us immediately through the Privacy Portal or by sending an e-mail.

6. Where do we store your data?

The personal data we collect and all our data processing activities are carried out in our offices, on our own servers, as well as on external servers, that is, third parties that provide services to the SEK Group – Security Ecosystem Knowledge for data storage purposes.

7. How long do we keep your data stored?

The retention and conservation of your personal data, including your records, will follow the measure necessary to carry out the purposes listed above, as well as to fulfill our obligations, such as: when it is necessary to retain your data for matters related to inspections and legal and/or regulatory obligations, to resolve judicial disputes and/or to perform our contracts.

8. Data sharing and third parties that process your personal information

We will share personal information when: (i) there is a legal, regulatory or judicial obligation; (ii) at the request of our donors or sponsors, always supported by a legal basis for doing so; (iii) to respond to requests from public authorities; (iv) by contractual force; and (v) with suppliers and service providers that operationalize our actions and projects, as well as among the Organizations that make up the ecosystem of the SEK Group – Security Ecosystem Knowledge, provided that they have a legitimate interest in processing your information, always respecting your rights and offering you mechanisms to object to the processing of your data, so as to ensure the legality of the operation.

The SEK Group – Security Ecosystem Knowledge relies on service providers that carry out personal data processing activities to assist us in the development of our activities. The sharing of personal data occurs to the extent necessary to enable the provision of the contracted services.

Our contracts and partnerships are entered into with companies that we believe to be among the best in the market in their respective activities.

We guarantee that your personal information will only be shared under a contractual agreement and always in accordance with this Privacy Notice.

9. Cookies

We use cookies, provided that you do not choose to disable them in your browser's configuration settings. Cookies will be issued, collected and stored based on your interaction with our website and help us measure metrics of use of our Portal, as well as observe, statistically, your browsing, with the aim of improving the users' browsing experience.

We also use cookies to address you according to your browsing habits, so as to present you with advertising suited to your profile.

10. Making this Policy useful for you

Congratulations on reaching the end of our Privacy and Personal Data Protection Policy. We designed it seeking to ensure the utmost transparency with you, aiming to bring clear language that is useful to your understanding.

Feel free to contact us and clarify any doubt that may persist, through the following e-mail: [email protected]

Be sure to read this Policy, as we will publish any changes on this page — and, of course, significant changes will be notified by e-mail.

DPO:

• Colombia: Juan Carlos Lara ([email protected])
• Brazil: PDK Advogados – Raphael Dutra da Costa Campos ([email protected])