Privacy Policy

01Who the controller is

Cyber Consulting is the controller of the personal data described in this policy. For any data protection matter, contact our Data Protection Officer (DPO) at dpo@cyberconsulting.com.br.

02Website visitors

This website has no sign-up. Contact happens through the contact form, by email, phone or WhatsApp, always on your initiative. In the form we ask for your name, email and message and, if you wish, your phone number and company; how we use this data is described in the next section.

When you access the website, the hosting infrastructure records technical data, such as IP address, date and time, pages visited, browser type and operating system, for security and stability reasons.

With your permission, given in the notice shown on your first visit, we use Google Analytics to measure how the website is used: pages viewed, where the visit came from, device type and approximate region. Google Analytics stores cookies in your browser and is set up without advertising signals or ad personalization. Without your permission, no measurement cookie is stored and nothing is sent to Google. You can change your choice at any time through the "Cookie preferences" link in the footer.

This website does not use advertising cookies or cross-site tracking cookies.

03Contacts and companies that hire our consulting

When you write to us, we process your name, email or phone number, company, job title and whatever you tell us in the message, in order to reply, prepare proposals and carry on the business conversation you started.

When carrying out a consulting project, we process the contact details of the people involved and, when the scope requires it, personal data of the contracting company under the instructions and within the limits set out in the contract.

04Course students

Online courses are sold and hosted by Hotmart and Udemy. The platform processes registration and payment data under its own privacy policy, and shares with us the data it provides to the course producer.

We use this data to grant and maintain your access, provide support, answer your questions about the content, issue tax documents and comply with legal obligations.

For in-company classes, we process the list of participants sent by the contracting company, attendance and the activities completed, in order to run the course and issue participation records.

In mentoring, we process the information you share during the sessions, in confidence. The behavioral profile assessment carried out with our partner MBPsico only takes place if you choose it, and the result is used solely to guide your mentoring.

05EXIN exam candidates

When you buy an EXIN exam voucher from us, we process your name, email, the chosen exam and the proof of payment (PIX or bank deposit), in order to buy the voucher in your name, send it to you and provide support.

To issue the voucher and register you as a candidate, we share the necessary data with EXIN: name, email and the chosen exam. EXIN Holding B.V., headquartered in Utrecht, the Netherlands, then processes this data as a controller, to administer and grade the exam, issue the result, the certificate and the digital badge, verify the authenticity of the certificate and prevent fraud.

To deliver the exam, EXIN uses its own service providers, such as computer based testing and online proctoring providers, some of them located in the United States and Japan. EXIN states that it keeps the data for as long as its purposes require: up to 7 years for legal and tax obligations and up to 30 years for the records that prove the certification obtained.

EXIN may share your result with whoever bought the voucher for you. Anyone who has your name and certificate number can verify its authenticity on the EXIN website.

Processing by EXIN follows its own privacy policy, which we recommend you read. To exercise your rights over this data with EXIN, contact the EXIN Privacy Office at privacy@exin.com.

06On what legal basis

• Replying to your contact and preparing proposals: preliminary procedures related to a contract, at your request (art. 7, V, of the LGPD), and legitimate interest in communicating with companies interested in our services (art. 7, IX).
• Delivering consulting, courses, mentoring and the voucher purchase: performance of a contract (art. 7, V).
• Sharing candidate data with EXIN: performance of the voucher purchase contract, at your request (art. 7, V).
• Issuing tax documents and keeping records required by law: compliance with a legal obligation (art. 7, II).
• Technical access and security logs for the website: compliance with a legal obligation (art. 7, II) and legitimate interest (art. 7, IX).
• Visit measurement with Google Analytics: consent (art. 7, I), which you may withdraw at any time through the website footer.
• Behavioral profile assessment in mentoring: consent (art. 7, I), which you may withdraw at any time.

07Who we share data with

• EXIN, in the voucher purchases described above.
• Hotmart and Udemy, which sell and host the online courses.
• MBPsico, for the behavioral profile assessment, when you choose it.
• Infrastructure, hosting, email and communication providers acting as processors, under contract and a duty of confidentiality.
• Google, which operates Google Analytics, when you allow visit measurement.
• Public authorities, when there is a legal request or a court order.

We do not sell personal data and we do not share it for advertising purposes.

08International transfer

Candidate data shared with EXIN is transferred to the Netherlands and, when the exam is delivered, may reach EXIN’s providers in the United States and Japan. This transfer is necessary to perform the contract you requested (art. 33, IX, in conjunction with art. 7, V, of the LGPD), and EXIN states that it adopts the safeguards required by European law.

Infrastructure and email providers may keep servers outside Brazil. In these cases, the transfer is carried out with the safeguards required by applicable law, including contractual clauses and technical protection measures.

Visit measurement data, when you allow it, is processed by Google on servers outside Brazil, including in the United States. The cookie notice states this international nature before you choose, and the transfer relies on your specific consent (art. 33, VIII, of the LGPD) and on the contractual safeguards offered by Google.

09How long we keep data

• Business contacts: for the duration of the discussions and, once they end, for the period needed for the regular exercise of rights.
• Contracting companies, students and candidates: for the duration of the contract or of course access and, afterwards, for the legal retention periods for tax and contractual documents.
• Technical access logs: for the period set by applicable law.
• Visit measurement data: 14 months in Google Analytics; after that, it is deleted automatically.

Once the period ends, the data is deleted or anonymized.

10How we protect data

We adopt technical and organizational measures suited to the nature of the data: role based access control, encryption in transit, audit logging and periodic review of controls, the same principles we apply in the projects we run.

11Children and adolescents

Our courses and services are aimed at professionals and companies. We do not knowingly collect data from children or adolescents.

12Your rights

You can confirm whether processing takes place, access your data, correct incomplete or outdated data, request anonymization, blocking or deletion, request portability, find out who we share it with, withdraw consent and object to processing based on legitimate interest. You can also file a complaint with the ANPD, Brazil’s National Data Protection Agency.

13Changes to this policy

We may update this policy to reflect legal, technical or process changes. The version in effect is always the one published on this page, with the effective date shown above.