Privacy Policy

1 Scope and Acceptance

This Privacy Policy ("Policy") is a legally binding document governing the collection, use, storage, disclosure, and deletion of personal data by Data Orbis AI ("Data Orbis AI," "we," "us," "our") in connection with its website, digital platforms, and AI and Data Consulting services.

This Policy applies to:

• All visitors to our website and digital properties, regardless of location
• Prospective, current, and former clients and their authorized representatives
• Individuals whose data is processed within the scope of a consulting engagement
• Job applicants, freelancers, contractors, and business partners
• Any third party who communicates with Data Orbis AI by any means

2 Legal Framework

Data Orbis AI operates in compliance with applicable data protection legislation. Our primary compliance frameworks include:

• LGPD — Lei Geral de Proteção de Dados, Federal Law No. 13,709/2018 (Brazil) — primary governing law
• Marco Civil da Internet — Federal Law No. 12,965/2014 (Brazil)
• GDPR — General Data Protection Regulation (EU) 2016/679, applied where EU data subjects are involved
• CCPA/CPRA — California Consumer Privacy Act and Privacy Rights Act, applied where California residents are involved
• Any other applicable national or regional data protection legislation in jurisdictions from which our services are accessed

Compliance with this Policy does not constitute legal advice, and nothing herein creates an attorney-client relationship. References to legal frameworks are informational only and may change without notice as laws are amended or new regulations are enacted.

3 Data Controller

Data Orbis AI is the data controller for personal data collected through its website and general business activities. For consulting engagements where we act as a data processor, the client is the data controller.

4 Data We Collect

We apply strict data minimization. We collect only what is adequate, relevant, and objectively necessary for defined purposes.

Data You Provide Directly

• Identity and contact details: name, professional email, phone number, company name, job title
• Communication content: messages, inquiries, feedback submitted through forms or email
• Business and contractual data: proposal requests, signed agreements, payment details processed by third-party payment providers (we do not store raw payment card data)
• Credentials: username and password, stored in hashed and salted form

Data Collected Automatically

• Technical identifiers: IP address, browser type, operating system, device type
• Usage data: pages visited, session duration, click paths, referral source
• Access logs: as mandated by Brazil's Marco Civil da Internet (Article 15), retained for the statutory minimum period only

Sensitive Personal Data

5 Legal Basis for Processing

Every data processing activity conducted by Data Orbis AI is grounded in one or more valid legal bases under LGPD Article 7 and, where applicable, GDPR Article 6.

Where consent is the legal basis, you may withdraw it at any time without retroactive effect. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6 Purposes of Processing

Personal data is processed exclusively for the following defined and documented purposes:

• Operating, maintaining, and improving our website, tools, and consulting services
• Preparing, delivering, managing, and closing client consulting engagements
• Responding to business inquiries, RFPs, and service requests
• Processing invoices, payments, and maintaining financial records as required by law
• Sending marketing and thought leadership content (exclusively on an opt-in, consent basis)
• Conducting benchmarking and research using strictly anonymized or aggregated data
• Ensuring cybersecurity, access control, fraud detection, and business continuity
• Complying with legal obligations and responding to lawful governmental requests
• Recruiting and onboarding personnel, contractors, and partners

Data Orbis AI will not use personal data for any purpose incompatible with those stated above without prior notification and, where required by law, explicit written consent.

7 AI and Automated Processing

As an AI and Data Consulting firm, Data Orbis AI maintains the following binding commitments regarding artificial intelligence and automated processing:

• No training on client personal data: Data Orbis AI does not use personal data provided by or about clients to train, fine-tune, or validate any AI or machine learning model without explicit written authorization in a signed agreement.
• Disclosure of AI tools: Where AI-powered tools are deployed within a consulting engagement, this is disclosed in the applicable Statement of Work or engagement documentation.
• Anonymization-first approach: Internal AI methodology development uses only anonymized, aggregated, or synthetically generated data. Once data is de-identified, it is no longer considered personal data and is outside the scope of this Policy.
• Re-identification prohibition: Data Orbis AI will not attempt to re-identify any de-identified dataset. Any third-party recipient of de-identified data is contractually prohibited from re-identification.
• No fully automated consequential decisions: No decision producing legal or similarly significant effects on a data subject will be made by automated means alone without human oversight and, where required, explicit consent.
• AI Privacy Impact Assessments: Data Orbis AI conducts internal AI PIAs for new tools or algorithms deployed in client-facing or data-intensive contexts.

8 Data Retention (Minimum Necessary)

Data Orbis AI applies a minimum necessary retention policy. Personal data is deleted or irreversibly anonymized as soon as the purpose for which it was collected has been fulfilled, unless a specific and documented legal obligation mandates continued retention. Indefinite retention violates the necessity principle under LGPD Article 6 and is expressly prohibited in our internal data management procedures.

Where no mandatory legal retention period applies, Data Orbis AI's default action is immediate deletion or anonymization upon completion of purpose. We do not retain data "just in case." Upon expiration of any retention period, data is securely deleted using industry-standard data destruction methods or irreversibly anonymized.

You may request confirmation of the retention period applicable to your data by contacting hello@orbisdata.ai.

9 Data Sharing and Third Parties

Personal data may be shared only in the following strictly defined circumstances:

• Service Providers (Sub-processors): Vendors providing infrastructure services (hosting, email delivery, analytics, payment processing) operating under signed Data Processing Agreements that impose data protection obligations at least equivalent to this Policy. Sub-processors are permitted to process data only for the documented, limited purpose specified in their agreement.
• Client Organizations: Where Data Orbis AI acts as data processor, data may be returned to or shared with the client controller as directed under the engagement agreement.
• Professional Advisors: Legal counsel, accountants, auditors, and insurers, bound by professional confidentiality obligations.
• Legal and Governmental Authorities: Where disclosure is required by a binding court order, regulatory directive, or applicable law. Data Orbis AI will disclose only the minimum data required to satisfy the legal obligation and will notify the affected data subject to the extent permitted by law.
• Business Successors: In the event of a corporate restructuring, merger, acquisition, or asset transfer, personal data may be transferred to the successor entity subject to the same or stronger protections. Affected individuals will be notified in advance.
• With Your Explicit Written Consent: Any sharing not described above requires your documented prior consent, obtainable at hello@orbisdata.ai.

A current list of active sub-processors is available upon written request to hello@orbisdata.ai.

10 Your Rights as a Data Subject

Under LGPD and, where applicable, GDPR, you have the following rights. All requests must be submitted in writing to hello@orbisdata.ai and will be processed within 15 business days of receipt of a verified request.

Identity verification is required before any right is fulfilled. We reserve the right to deny requests that are manifestly unfounded, repetitive, or abusive, in accordance with LGPD Article 18. Where an exception applies under applicable law preventing full compliance, we will inform you of the reason within the response period.

11 Cookies and Tracking Technologies

Our website uses cookies and similar technologies. On your first visit, a consent banner will allow you to accept or reject non-essential cookies. You may update your preferences at any time via the cookie settings link in the website footer.

Data Orbis AI does not deploy cross-site tracking, behavioral fingerprinting, or invasive advertising technologies without explicit opt-in consent. Rejecting non-essential cookies does not impair your access to the core functionality of our website.

12 International Data Transfers

Personal data may be transferred to and processed in countries outside Brazil as part of our consulting operations and use of cloud-based service providers. All such transfers comply with LGPD Chapter V (international transfer rules) and, where applicable, GDPR Chapter V. Transfer mechanisms include adequacy decisions, Standard Contractual Clauses (SCCs), and binding contractual safeguards with sub-processors.

Where no adequacy determination exists, Data Orbis AI ensures appropriate safeguards are in place before any transfer occurs. You may request information about the specific safeguards applied to transfers involving your data by contacting hello@orbisdata.ai.

13 Data Security

Data Orbis AI implements technical and organizational security measures proportionate to the risk of each processing activity. Measures include:

• TLS 1.2+ encryption for all data in transit
• Encryption at rest for stored personal and client data
• Role-based access controls and the principle of least privilege
• Multi-factor authentication for internal system access
• Periodic security assessments, vulnerability scanning, and penetration testing
• Documented incident response procedures and breach notification protocols
• Data protection training for all personnel with access to personal data
• Vendor security review prior to onboarding any new sub-processor

In the event of a personal data breach that poses a risk to your rights and freedoms, Data Orbis AI will notify the Autoridade Nacional de Proteção de Dados (ANPD) within 72 hours and affected individuals without undue delay, to the extent required under LGPD Article 48 and applicable law.

14 Disclaimer of Warranties

15 Limitation of Liability

16 Indemnification

This indemnification obligation survives termination of any agreement or engagement with Data Orbis AI and your discontinuation of use of our website and services.

17 Consulting Client Liability

In all consulting engagements where Data Orbis AI acts as a data processor on behalf of a client organization:

• The client organization is the data controller and bears primary and direct legal responsibility for all data protection obligations under LGPD, GDPR, and applicable laws
• The client is solely responsible for ensuring a valid legal basis exists for every personal data element provided to or processed by Data Orbis AI
• The client is solely responsible for the accuracy, completeness, and lawfulness of data delivered to Data Orbis AI for processing
• The client is solely responsible for providing adequate privacy notices to data subjects whose data is shared with Data Orbis AI
• Data Orbis AI's liability as a data processor is strictly limited to processing activities performed in material breach of a signed, written DPA and only to the extent directly caused by Data Orbis AI's proven failure to comply with its processor obligations
• Data Orbis AI shall have no liability for any privacy or data protection violation arising from client instructions, client-provided data, or client-owned systems, platforms, or databases

18 Children's Privacy

Our website and services are directed exclusively at individuals aged 16 and above. We do not knowingly collect, solicit, or process personal data from children under 16. If we become aware that a minor has submitted personal data without verifiable parental or guardian consent, we will delete such data immediately upon discovery.

If you believe a minor has provided personal data to Data Orbis AI, please notify us immediately at hello@orbisdata.ai. Data Orbis AI bears no liability for personal data submitted by minors misrepresenting their age.

19 Marketing Communications

Data Orbis AI sends marketing, newsletter, or promotional communications only to individuals who have provided explicit prior opt-in consent. Every such communication includes a clear, one-click unsubscribe mechanism. Withdrawal of marketing consent will take effect within 5 business days and does not affect transactional, contractual, or legally required communications. Consent records are maintained in compliance with LGPD Article 8.

20 Third-Party Links

Our website may contain links to external websites, platforms, and resources operated by third parties. These links are provided for informational convenience only. Data Orbis AI does not endorse, control, or assume responsibility for the content, privacy practices, security, data handling, or availability of any third-party website. Access to third-party websites is entirely at your own risk, and Data Orbis AI expressly disclaims all liability arising from your interaction with any third-party site.

21 Force Majeure

Data Orbis AI shall not be liable for any failure or delay in performing its obligations under this Policy to the extent that such failure or delay is caused by events beyond its reasonable control, including but not limited to: acts of God, natural disasters, pandemic, epidemic, governmental actions, war, terrorism, riots, embargoes, acts of civil or military authority, fire, flood, earthquakes, strikes or labor disputes, power outages, internet or telecommunications failures, third-party cyberattacks or ransomware incidents, denial of service attacks, or failure of third-party infrastructure or service providers.

In such circumstances, Data Orbis AI's obligations will be suspended for the duration of the force majeure event. Data Orbis AI will use commercially reasonable efforts to notify affected parties and resume normal operations as soon as reasonably practicable.

22 Changes to This Policy

Data Orbis AI reserves the right to update, modify, or replace this Policy at any time to reflect changes in applicable law, our data practices, or our services. When material changes are made:

• The "Last Updated" date at the top of this page will be revised
• Known contacts and registered clients will be notified by email at least 30 days before changes take effect where practicable
• A prominent notice will be displayed on the website

Your continued access to or use of our website or services after the effective date of any updated Policy constitutes your binding acceptance of the revised terms. If you do not accept the revised Policy, you must immediately cease use of our services and may request deletion of your data at hello@orbisdata.ai.

23 Dispute Resolution and Arbitration

Before initiating any formal legal proceeding, you agree to first attempt to resolve any privacy-related dispute with Data Orbis AI informally by contacting hello@orbisdata.ai. Data Orbis AI will make good-faith efforts to resolve the matter within 30 days.

If informal resolution is unsuccessful, any dispute, controversy, or claim arising out of or relating to this Policy, including any question regarding its existence, breach, validity, or termination, shall be finally resolved by binding arbitration administered under the rules of the Câmara de Comércio Brasil-Canada (CCBC) in São Paulo, Brazil, or such other mutually agreed arbitral institution. The arbitration shall be conducted in Portuguese or English (to be agreed), and the arbitral award shall be final and binding on both parties. You waive any right to a jury trial or to participate in a class action lawsuit with respect to any claim subject to this arbitration clause.

Nothing in this clause prevents either party from seeking urgent injunctive or provisional relief from a competent court where necessary to prevent imminent irreparable harm.

24 Governing Law and Jurisdiction

This Policy is governed by and construed in accordance with the laws of the Federative Republic of Brazil, without regard to conflict of law principles. For any matter not subject to arbitration under Section 23, the parties submit to the exclusive jurisdiction of the courts of the Comarca de São Paulo, State of São Paulo, Brazil.

Where mandatory consumer protection or data protection laws in your jurisdiction provide rights that cannot be contractually waived, those rights are preserved solely to the minimum extent required by law, and all other provisions of this Policy remain in full force and effect.

25 Severability and Entire Agreement

Severability: If any provision of this Policy is found to be invalid, unlawful, or unenforceable under applicable law, that provision shall be modified to the minimum extent necessary to make it enforceable, or if modification is not possible, severed from this Policy. The remaining provisions shall continue in full force and effect without interruption.

Entire Agreement: This Policy, together with any signed engagement letter, Statement of Work, DPA, or other written agreement between you and Data Orbis AI, constitutes the entire agreement between the parties with respect to privacy and data protection and supersedes all prior discussions, representations, or understandings on those subjects.

No Waiver: Failure by Data Orbis AI to enforce any provision of this Policy at any time shall not constitute a waiver of its right to enforce that provision in the future.

Language: This Policy is drafted in English. Any translation is provided for convenience only. In the event of any inconsistency between the English version and a translation, the English version shall prevail.

26 Supervisory Authorities

You have the right to lodge a complaint directly with the relevant data protection supervisory authority at any time, without prejudice to any other administrative or judicial remedy:

We strongly encourage you to contact us first at hello@orbisdata.ai before escalating to a supervisory authority, so we may attempt to resolve your concern directly.

27 Contact Us