Privacy Policy

1. Our Privacy Commitment

Berghem – Smart Information Security specialises in application, infrastructure and payment security assessments, helping leaders build a secure digital world. Committed to ethics and transparency, we recognise the importance of protecting personal data. Acting as data Controller, we ensure that we collect, store and process information appropriately and transparently, in full compliance with the LGPD — Brazilian General Data Protection Law (Law No. 13,709/2018).

2. What data do we collect?

We collect information you provide voluntarily, as well as information gathered automatically as you browse our site:

• Data you provide: name, email address, phone number, job title, company name and the content of messages sent through our contact forms, emails or phone calls.
• Recruitment information (Work With Us): full name, email address, phone number, professional history (previous roles and experience), education, technical skills and links to professional social networks (such as LinkedIn).
• Automatically collected data: IP address, browser type, operating system, device information, pages visited, time spent on pages and navigation paths.
• Cookie data: session identifiers and preference settings used to optimise your experience (detailed in section 8).

Privacy note: we ask candidates not to include identity document numbers, photographs or sensitive data in résumés submitted for initial screening. If such information is sent spontaneously, it will not be considered in the initial evaluation.

3. Why do we use your data?

We process your data for legitimate, specific and explicit purposes:

• Enquiries and proposals: responding to enquiries, processing quotation requests and sending information about our cybersecurity services.
• Service delivery: performing contracts and providing information security consulting.
• Marketing communications: sending news, educational content, events and relevant commercial offers from Berghem.
• Recruitment: screening, assessing and selecting candidates who send us résumés.
• Site optimisation: analysing usage trends and browsing behaviour to improve the performance and usability of our site.
• Security: ensuring site integrity, fraud protection and prevention of unauthorised access.

4. Which legal bases do we rely on?

Berghem processes personal data on valid legal bases as set out in the Brazilian General Data Protection Law (Law No. 13,709/2018). Each processing activity has a specific legal ground, as detailed below:

Consent (Art. 7, I of the LGPD)

We rely on this basis when you expressly authorise the processing of your data for specific purposes. It applies to:

• Marketing communications and newsletter: sending news, events and commercial offers from Berghem when you voluntarily subscribe through our forms. You may withdraw this consent at any time.

Performance of a contract (Art. 7, V of the LGPD)

We process your data when necessary to manage a contract with you or to carry out the steps preceding it. It applies to:

• Enquiries and proposals: processing quotation requests, responding to commercial enquiries and sending information about our cybersecurity services.
• Work With Us (recruitment): screening and reviewing résumés submitted voluntarily for our selection processes.

Legitimate interest (Art. 7, IX of the LGPD)

We process data based on our legitimate business interests, provided this does not infringe your fundamental rights and freedoms. It applies to:

• Site optimisation: analysing navigation metrics, usage patterns and visitor behaviour to improve technical performance and user experience.
• Information security: monitoring access, preventing fraud and protecting our site infrastructure against cyber attacks.

5. Who do we share personal data with?

We do not sell your personal data. Information is shared strictly to fulfil the operational purposes described in this policy, limited to the following providers:

• IT and infrastructure suppliers: companies providing cloud hosting, cybersecurity and technical support services to ensure the stability and integrity of our platforms.
• Marketing automation and CRM tools: technology platforms used for customer relationship management, institutional communications, traffic analytics reporting and support for our legitimate marketing campaigns.
• Communication partners and agencies: specialist service providers engaged to manage, audit and optimise our advertising, educational content and corporate events.
• Public authorities or government bodies: where required by law, court order or to comply with regulatory obligations to which Berghem is subject.

6. How long do we keep your information?

We retain collected data only for as long as strictly necessary to meet its legal or operational purposes.

• Candidate résumés: kept for up to 12 months in our talent pool for future selection processes, unless the data subject requests deletion beforehand.
• Commercial contact data: kept for the duration of the pre-contractual or contractual relationship, or until deletion/withdrawal is formally requested.
• Application access logs (server logs): kept for the mandatory period of 6 months, in strict compliance with Article 15 of the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014), under the legal basis of compliance with a legal obligation (Art. 7, II of the LGPD).
• Statistical and navigation data (Google Analytics): kept for up to 14 months (as configured in Google Analytics 4) for metrics analysis, or until the user clears their browser cookies.

7. How do we keep your data secure?

Berghem gives absolute priority to data protection, implementing rigorous measures to ensure information is handled securely. We adopt internationally recognised standards and appropriate technical and administrative measures to mitigate the risk of unauthorised access, leakage or alteration of data.

8. Cookies

We use cookies to ensure the basic operation of the site (essential cookies). For traffic analytics and marketing cookies (non-essential cookies), we ask for your prior choice through our consent banner.

You can configure or refuse collection directly in your browser settings, bearing in mind that disabling certain cookies may affect your browsing experience.

9. Data subject rights

In strict compliance with Article 18 of the LGPD, Berghem ensures you can exercise your rights at any time. Upon request to our Data Protection Officer, you may ask for:

• Confirmation that processing exists and access to your data;
• Correction of incomplete, inaccurate or out-of-date data;
• Anonymisation, blocking or deletion of unnecessary data or data processed in breach of the law;
• Portability of your data to another service provider;
• Deletion of personal data processed on the basis of your consent;
• Information about the public and private entities with which we share data;
• Withdrawal of consent.

To exercise any of these rights, contact us directly at [email protected].

10. Updates to this Privacy Policy

This policy may be updated periodically to reflect improvements to our internal processes or new legislative guidance. The date of the most recent version will always be shown at the top of this document.