Ler em português

Confidentiality & Data Handling Statement

Evidentiary material examined under a forensic engagement

Last updated: 12 May 2026 Effective date: 12 May 2026

Why this is a separate document

IVIDENTIA’s Privacy Policy governs personal data collected through our website — visitors, forms, newsletter, analytics and advertising. That processing rests largely on consent and legitimate interest.

Processing of evidentiary material under a forensic engagement is structurally different:

• the data subjects are not our clients and, as a rule, have not consented — they are parties, witnesses, suspects, third parties who appear in a recording, correspondents in a seized conversation;
• the data is frequently sensitive or relates to criminal offences;
• the processing arises from a judicial order or the exercise of legal rights in proceedings, not from a commercial choice;
• rights of erasure and objection are legally restricted, because deletion would destroy evidence.

Applying the website policy to that processing would create a legal contradiction and weaken both documents. Hence the separation.

Nothing in this Statement applies to website visitors. This document addresses instructing parties, courts, counsel, and data subjects whose information appears in material submitted for forensic examination.

1. Who we are and in what capacity we act

IVIDENTIA DIGITAL FORENSICS LTDA. — CNPJ 41.913.701/0001-07 — Setor Comercial Norte, Quadra 02, Bloco A, nº 190, Sala 502 Parte P-2, Edifício Corporate F. Center, Asa Norte, CEP 70712-900, Brasília, Federal District, Brazil. Data Protection Officer: Diogo Lopes — contact@ividentia.com

IVIDENTIA acts in three distinct capacities, with different consequences for data processing:

In none of these capacities does IVIDENTIA process evidentiary material for its own, commercial or marketing purposes.

2. Legal bases

Consent is not — and cannot be — the applicable legal basis. A data subject who is the target of an investigation is not in a position to consent freely, and the validity of evidence cannot depend on their agreement.

3. What material we receive

Depending on the engagement, we may receive and examine:

• CCTV, video and audio recordings and audiovisual material generally;
• forensic extractions from mobile devices and computers, including messages, media, location records and application artefacts;
• access records, server logs, transaction records and audit trails;
• source code, repositories, version control history and engineering documentation;
• electronic documents, contracts, digital certificates and electronic signature evidence;
• seized material, material transmitted by a court, or material delivered by an instructing party.

This material frequently contains special categories of personal data and data of persons who are not party to the engagement.

4. How material is received

We do not accept evidentiary material through the website, the contact form, or unsolicited email. Material received that way is not placed under chain of custody and is not covered by the controls described in this document.

Accepted channels:

1. Case record — media filed with or released by the court.
2. Secure transfer established case by case — encrypted channel, dedicated credential, access logging.
3. Physical delivery of media, against a signed receipt.
4. Direct collection by IVIDENTIA, in a documented on-site procedure.

In all cases we record: sender identification, date and time, item description, transmission method, and the cryptographic hash of each file (SHA-256).

5. Chain of custody and integrity

Evidentiary integrity is a condition of validity of forensic work and takes precedence over any operational consideration.

• Every item received is hashed on arrival and the hash is recorded in a custody record.
• Work is performed on copies; the original is preserved unaltered.
• Every transfer, copy or verification is logged, with date, time and responsible individual.
• Hashes are re-verified and declared in the delivered report or opinion.
• Any discontinuity, integrity failure or access limitation is expressly declared in the technical document, never omitted.

6. Security

No case material is processed on general-purpose public cloud services, in third-party artificial intelligence tools, or on any platform whose terms permit the provider to use submitted content.

7. Professional secrecy

Beyond data protection obligations, IVIDENTIA and its personnel are bound by independent duties of secrecy:

• CPC Art. 466 — the expert performs the appointment independently and must keep confidential what is ascertained;
• Brazilian Penal Code Art. 154 — breach of professional secrecy is a criminal offence;
• sealed proceedings (segredo de justiça) — cases under seal impose an additional restriction on disclosure, including as to the existence of the engagement itself;
• contractual confidentiality clauses agreed with the instructing party.

Personnel and any technical assistants sign an individual confidentiality undertaking before any access to case material.

8. Disclosure

Evidentiary material and its results are disclosed exclusively to:

• the court and the parties to the proceedings, within the terms and limits of the appointment;
• the instructing party, where we act as technical assistant or private consultant;
• technical assistants of IVIDENTIA, bound by a confidentiality undertaking and restricted to what is strictly necessary;
• authorities, where a legal duty to report applies.

There is no sub-processing to third parties — we do not use third-party transcription, analysis or processing services on case material, save with the express prior authorisation of the instructing party or the court, in which case the third party is identified and contractually bound.

Evidentiary material is never used for marketing, portfolio, model training, publication or demonstration. Case studies occasionally published by IVIDENTIA describe methodology only, without identifiable data, and only where the proceedings are public or express authorisation exists.

9. International transfers

Processing takes place in Brazil. We do not transfer evidentiary material outside Brazilian territory except where:

• ordered by a court or competent authority; or
• necessary to the engagement itself and expressly authorised by the instructing party.

In those cases the mechanisms of LGPD Art. 33 apply and, where data subjects in the EEA are involved, the European Commission’s Standard Contractual Clauses.

10. Retention and disposal

Disposal is recorded. Where the instructing party or the court orders return or destruction of material, we issue a certificate of disposal.

11. Data subject rights — and their limits

Data subjects whose data appears in material under examination may write to contact@ividentia.com. We respond to every request, but it is necessary to be clear about what can and cannot be granted.

Can be granted: confirmation that IVIDENTIA holds material relating to given proceedings, where those proceedings are not under seal; information on the legal basis and purpose of processing; correction of inaccurate administrative data we hold about you.

Cannot be granted — and the refusal will be reasoned in writing:

• Erasure of evidentiary material. Data forming part of a case record or of a report already delivered cannot be deleted at the request of a data subject. Deletion would destroy evidence and break the chain of custody (LGPD Art. 16, I and III; GDPR Art. 17(3)(b) and (e)).
• Access to the content of the material. Access to pleadings and evidence in proceedings is obtained through the case record, before the competent court, not through the expert. Supplying material directly to a data subject would circumvent judicial control and could breach a sealing order or a third party’s rights.
• Objection to processing. Processing ordered by a court, or necessary to the exercise of legal rights in proceedings, is not subject to objection.
• Portability. Does not apply to processing grounded in a legal obligation or in the exercise of rights in proceedings.

In those cases we direct the data subject to the court seised of the proceedings, which is the authority competent to decide on access, restriction and the fate of the evidence. We also inform them of their right to petition the ANPD or, where applicable, the competent European supervisory authority.

12. Security incidents

Where an incident may result in a significant risk to data subjects, we will notify, within the statutory periods: the instructing party, the court where the material is linked to proceedings, the ANPD and, where required, the affected data subjects and the competent European supervisory authority.

The notification will describe the nature of the incident, the data involved, the measures taken, and the effect on evidentiary integrity — the last point also being declared in the corresponding technical document.

13. Limitations of this Statement

Consistent with the forensic practice we apply, we expressly record the scope of this document:

• It describes the controls adopted by IVIDENTIA. It does not extend to processing by the court, the parties, counsel, other experts, or any third party who also holds the same material.
• It does not replace the confidentiality clauses of a specific engagement instrument; in the event of conflict, the engagement instrument prevails, unless it affords protection inferior to that declared here.
• It does not, in itself, warrant any forensic outcome, nor does it create an engagement. See the Terms of Service, Section 2.
• Security practices evolve. The “Last updated” date indicates the current version.

14. Contact

IVIDENTIA DIGITAL FORENSICS LTDA. Setor Comercial Norte, Quadra 02, Bloco A, nº 190, Sala 502 Parte P-2, Edifício Corporate F. Center, Asa Norte, CEP 70712-900, Brasília, Federal District, Brazil CNPJ 41.913.701/0001-07 Data Protection Officer: Diogo Lopes contact@ividentia.com