Ler em português

Privacy Policy

Last updated: 12 May 2026 Effective date: 12 May 2026

This Privacy Policy explains how IVIDENTIA Forensics & Compliance Audit (“IVIDENTIA”, “we”, “us”) collects, uses, discloses and protects personal data through the website https://ividentia.com and its related online forms, newsletters and social media applications (together, the “Website”).

This policy covers the Website only. Personal data contained in evidentiary material examined during a forensic engagement is governed by a separate document — see Section 3.3 and our Confidentiality & Data Handling Statement.

1. Who we are (Data Controller)

IVIDENTIA is the controller of the personal data described in this policy, within the meaning of the EU General Data Protection Regulation (GDPR) and the Brazilian General Data Protection Law (LGPD), and a business within the meaning of the California Consumer Privacy Act as amended (CCPA/CPRA).

Data Protection Officer / Encarregado: Diogo Lopes, reachable at contact@ividentia.com.

2. Summary

• We collect only what we need to answer enquiries, send requested communications and operate the Website.
• We do not sell personal data. We do use advertising technology that may qualify as “sharing” under California law — you can opt out (Section 9).
• We use cookies and similar technologies. In the EU, UK and Brazil, non-essential cookies are set only after you consent.
• Data may be transferred outside your country, including to Brazil and the United States, under appropriate safeguards (Section 8).
• You can request access, correction or deletion of your data at any time (Sections 9 and 10).

3. What personal data we collect, why, and on what legal basis

3.1 Data you provide directly

3.2 Data collected automatically

Microsoft Clarity records session interactions such as mouse movement, scrolling and clicks. We configure it to mask text input fields; nevertheless, do not enter confidential information into free-text fields on the Website.

3.3 Sensitive data and criminal-offence data — important notice

IVIDENTIA provides judicial and private forensic expert services. Material submitted to us in that context frequently contains special categories of personal data (GDPR Art. 9), personal data relating to criminal convictions and offences (GDPR Art. 10) and dados pessoais sensíveis (LGPD Art. 11) — including data about individuals who are not our clients and who have not consented.

That processing does not rely on this Privacy Policy or on consent. Where IVIDENTIA acts under a judicial appointment or as a party-appointed technical assistant, we process such data under GDPR Art. 6(1)(c) and 6(1)(f) combined with Art. 9(2)(f) (establishment, exercise or defence of legal claims), and under LGPD Art. 7, VI and Art. 11, II, “d” (regular exercise of rights in judicial, administrative or arbitral proceedings). Access, erasure and objection rights are correspondingly restricted where the data forms part of the record of legal proceedings.

Do not upload evidentiary material through the Website. Please contact us first so we can establish a secure and documented transmission channel with a proper chain of custody.

4. What we do not do

• We do not sell personal data for money.
• We do not use Website personal data to train artificial intelligence or machine learning models.
• We do not knowingly collect personal data from children (Section 12).
• We do not use contact-form data for unsolicited marketing.

5. Social media platform data (Meta and LinkedIn integrations)

Where you interact with an IVIDENTIA application on Meta (Facebook, Instagram) or LinkedIn, or authorise such an application, we may receive limited data from that platform.

We process this data only for the purposes described above and in accordance with the Meta Platform Terms and the LinkedIn API Terms of Use. We do not transfer platform data to data brokers, do not use it to build profiles unrelated to your enquiry, and do not retain it after the purpose has been fulfilled or after you request deletion.

You may revoke this access at any time through the privacy settings of the relevant platform, and you may request deletion of the data we hold — see Section 10.

6. Cookies and similar technologies

We use four categories of technology:

1. Strictly necessary — session management, security, load balancing and recording your cookie preferences. Always active; no consent required.
2. Analytics — Google Analytics 4, Microsoft Clarity. Consent required in the EU, UK and Brazil.
3. Advertising — Meta Pixel and comparable tags used for remarketing and conversion measurement. Consent required in the EU, UK and Brazil; opt-out available in California.
4. Functional — embedded media and third-party widgets, where present.

You can accept, refuse or change your choice at any time through the cookie banner or the “Cookie settings” link in the Website footer. Refusing non-essential cookies does not restrict access to any Website content.

Most browsers also allow you to block or delete cookies directly. We honour the Global Privacy Control (GPC) signal as a valid opt-out request where applicable law so requires.

7. Who we share data with

We share personal data only with the following categories of recipient, each bound by contract to process it on our instructions:

We do not disclose personal data to any other third party without your instruction or a legal obligation to do so.

8. International transfers

IVIDENTIA is established in Brazil. Some of our service providers are established in the United States, the European Union and other jurisdictions. Personal data collected through the Website is therefore transferred internationally.

For transfers of personal data out of the European Economic Area or the United Kingdom, we rely on:

• the European Commission’s adequacy decision for Brazil, where applicable and in force; and/or
• Standard Contractual Clauses adopted by the European Commission (and the UK International Data Transfer Addendum, where relevant), supplemented by a transfer risk assessment and technical measures including encryption in transit and at rest.

For transfers out of Brazil, we rely on the mechanisms provided in LGPD Art. 33, including standard contractual clauses approved by the ANPD.

A copy of the relevant safeguards can be requested at contact@ividentia.com.

9. Your rights

9.1 If you are in the EEA, UK or Switzerland (GDPR)

You have the right to: access your data; obtain rectification of inaccurate data; obtain erasure; restrict processing; object to processing based on legitimate interests, including profiling; receive your data in a portable format; and withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

You also have the right to lodge a complaint with your national supervisory authority. If you are in the EU, a list is available at edpb.europa.eu; in the UK, the Information Commissioner’s Office at ico.org.uk.

9.2 If you are in Brazil (LGPD)

You have the rights set out in LGPD Art. 18: confirmation of processing; access; correction; anonymisation, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed on the basis of consent; information about shared use; information about the consequences of refusing consent; and revocation of consent.

You may also petition the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

9.3 If you are in California (CCPA/CPRA)

You have the right to: know what personal information we collect, use and disclose; access and obtain a copy of it; request its deletion; request correction; and limit the use of sensitive personal information.

We do not sell personal information for monetary consideration. However, the use of advertising and remarketing technologies described in Section 6 may constitute “sharing” of personal information for cross-context behavioural advertising under the CPRA. You may opt out at any time via the “Do Not Sell or Share My Personal Information” link in the Website footer, by adjusting your cookie preferences, or by transmitting a Global Privacy Control signal.

We will not discriminate against you for exercising any of these rights.

9.4 Other jurisdictions

Residents of other jurisdictions with comparable legislation — including Japan (APPI), South Korea (PIPA), Singapore (PDPA), India (DPDP Act) and Switzerland (revFADP) — may exercise equivalent rights by contacting us at the address in Section 1. We apply the standard in this policy globally rather than restricting rights by territory.

9.5 How to exercise your rights

Write to contact@ividentia.com with the subject line “Privacy request”. We will acknowledge receipt and respond within 30 days (15 days for LGPD access requests, 45 days for CCPA requests, extendable where the law allows). We may ask for information reasonably necessary to verify your identity before acting on a request; we use that information for verification only.

Exercising these rights is free of charge.

10. Data deletion

You may request deletion of the personal data we hold about you at any time, regardless of your country of residence, and at no cost.

How to request deletion:

1. Send an email to contact@ividentia.com with the subject line “Data deletion request”.
2. State the email address, account or platform identifier the request relates to.
3. We will confirm receipt within 5 business days and complete the deletion within 30 days.
4. We will send you written confirmation once deletion is complete.

What is deleted: your contact details and message content; newsletter subscription records; any files you uploaded through the Website; analytics and advertising identifiers associated with you; and any Meta or LinkedIn platform data we hold about you.

Revoking platform access directly: for Meta, go to Settings & Privacy → Settings → Apps and Websites, select the IVIDENTIA application and click Remove, then request data deletion from the Removed section. For LinkedIn, go to Settings & Privacy → Data Privacy → Permitted Services.

Where deletion cannot be completed in full. We will tell you clearly if any of the following applies and will delete everything not covered by it:

• Legal proceedings. Data forming part of the record of judicial, arbitral or administrative proceedings, or of a forensic report already delivered to a court, cannot be deleted at the request of a data subject. Deletion would compromise the integrity of evidence and the chain of custody, and would conflict with our duties as a court-appointed expert (GDPR Art. 17(3)(b) and (e); LGPD Art. 16, I and III).
• Statutory retention. Accounting, tax and contractual records must be retained for the periods required by Brazilian law.
• Legal claims. Data necessary to establish, exercise or defend legal claims may be retained until the applicable limitation period expires.
• Backups. Data may persist in secure encrypted backups for up to 90 days after deletion from live systems, after which it is overwritten. It is not used for any purpose during that period.

11. Retention

12. Security

We apply technical and organisational measures appropriate to the risk, including TLS encryption in transit, encryption at rest for stored material, access control on a need-to-know basis, multi-factor authentication on administrative accounts, logging of administrative access, and periodic review of processors.

No transmission over the internet is entirely secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected individuals, within the periods set by applicable law.

13. Children

The Website is directed at legal, corporate and institutional professionals and is not intended for children. We do not knowingly collect personal data from anyone under 16 (or under 13 in the United States, or under 18 where local law so requires). If you believe a child has provided us with personal data, contact contact@ividentia.com and we will delete it.

14. Automated decision-making

We do not carry out automated decision-making producing legal or similarly significant effects concerning you, within the meaning of GDPR Art. 22 or LGPD Art. 20.

15. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The “Last updated” date at the top always indicates the current version. Where changes are material, we will give notice through a prominent notice on the Website and, where we hold your email address and the law requires it, by email. Previous versions are available on request.

16. Contact

IVIDENTIA Forensics & Compliance Audit Setor Comercial Norte, Quadra 02, Bloco A, nº 190, Sala 502 Parte P-2, Edifício Corporate F. Center, Asa Norte, CEP 70712-900, Brasília, Federal District, Brazil CNPJ 41.913.701/0001-07 Privacy and data protection: contact@ividentia.com General enquiries: contact@ividentia.com

This document is issued under the IVIDENTIA brand and applies to the Website identified above.