Privacy
Data Subject Rights
Brazil’s General Data Protection Law (LGPD) gives you a set of rights over your personal data. This page explains what they are, how to request them and what happens next.
This document has been in effect since October 28, 2026.
How to make a request
Use the data subject rights channel: your request receives a tracking number, and you follow its progress and read the reply in the same place. If you prefer, email our Data Protection Officer (DPO) at the address below, with the subject "Data Subject Rights".
What you can request
- Confirmation and access
- Find out whether we process your data and get access to it.
- Correction
- Correct incomplete, inaccurate or outdated data.
- Anonymization, blocking or deletion
- For data that is unnecessary, excessive or processed in breach of the law.
- Portability
- Receive your data in a structured format, to take it to another provider, within legal limits.
- Deletion of data processed with consent
- Except where the law requires it to be kept.
- Information about sharing
- Find out which public and private entities we share your data with.
- Information about refusing consent
- Find out what happens if you do not consent and what the consequences are.
- Withdrawal of consent
- Withdraw, at any time, an authorization given earlier.
- Objection
- Object to processing carried out on a legal basis that does not require consent, where the law is not being complied with.
- Review of automated decisions
- Request a review of decisions made solely on the basis of automated processing that affect your interests.
Deadlines and identification
We confirm receipt and reply as quickly as possible, within the legal deadlines: immediately, in simplified form, or within 15 days for the full statement, depending on the type of request.
To protect your data, we may ask for information that confirms your identity before fulfilling the request. We only ask for what is needed for that confirmation.
If we cannot fully fulfill the request, for example when there is a legal obligation to retain the data, we explain the reason and the basis for the refusal.
If you took an EXIN exam
Data about the exam, the result and the certificate is processed by EXIN as a controller. For this data, you can exercise your rights directly with the EXIN Privacy Office at privacy@exin.com. If you prefer, write to us and we will help forward the request.
EXIN privacy policy(opens in a new tab)If your data is in a Galáxia system
When Cyber Consulting processes personal data within the Galáxia systems on behalf of a contracting company, we act as a processor. In these cases, direct your request to the controller, the company that collected your data. If you do not know who that is, write to us and we will help point you in the right direction.
Complaint to the ANPD
If you believe your request was not handled as the law requires, you can file a complaint with the ANPD, Brazil’s National Data Protection Agency.
ANPD website(opens in a new tab)