Information Security
and Privacy Policy
Information Security
and Privacy Policy
1. Introduction
Oplium values information security, privacy, and personal data protection.
This Information Security and Privacy Policy informs you how we protect the information under our responsibility and how personal data is collected, used, stored, and protected in every interaction, including when browsing our digital environment, in compliance with the General Data Protection Law (LGPD – Law No. 13.709/2018) and, when applicable, with the General Data Protection Regulation of the European Union (GDPR) and equivalent privacy laws in the countries where Oplium operates.
This page also presents the summarized version of Oplium's Information Security Policy, approved by senior management and applicable to the Information Security Management System (ISMS) of Oplium Segurança Digital Ltda., certified under the ISO/IEC 27001:2022 standard.
1. Introduction
Oplium values information security, privacy, and personal data protection.
This Information Security and Privacy Policy informs you how we protect the information under our responsibility and how personal data is collected, used, stored, and protected in every interaction, including when browsing our digital environment, in compliance with the General Data Protection Law (LGPD – Law No. 13.709/2018) and, when applicable, with the General Data Protection Regulation of the European Union (GDPR) and equivalent privacy laws in the countries where Oplium operates.
This page also presents the summarized version of Oplium's Information Security Policy, approved by senior management and applicable to the Information Security Management System (ISMS) of Oplium Segurança Digital Ltda., certified under the ISO/IEC 27001:2022 standard.
2. Purpose
This Policy clarifies, in a transparent manner, how Oplium protects information and processes personal data collected through its institutional website or other digital interaction channels, covering purposes, legal bases, data subjects' rights, and adopted security practices. The document guides users regarding their rights and how to exercise them, reinforcing Oplium's commitment to ethics, legal compliance, and privacy protection.
2. Purpose
This Policy clarifies, in a transparent manner, how Oplium protects information and processes personal data collected through its institutional website or other digital interaction channels, covering purposes, legal bases, data subjects' rights, and adopted security practices. The document guides users regarding their rights and how to exercise them, reinforcing Oplium's commitment to ethics, legal compliance, and privacy protection.
3. What data we collect
During the interaction with our website or in other forms of interaction between the data subject and Oplium, the following types of personal data may be collected:
• Voluntarily provided information: name, email, phone number, and company (for example, when filling out contact forms, requesting services, or registering for events);
• Browsing information: IP address, browser type, device, pages accessed, time spent, approximate location, cookies, and similar data collected automatically to improve your experience and security.
3. What data we collect
During the interaction with our website or in other forms of interaction between the data subject and Oplium, the following types of personal data may be collected:
• Voluntarily provided information: name, email, phone number, and company (for example, when filling out contact forms, requesting services, or registering for events);
• Browsing information: IP address, browser type, device, pages accessed, time spent, approximate location, cookies, and similar data collected automatically to improve your experience and security.
4. Purpose of data use
The collected data, especially through the Oplium website, are used to:
• Respond to questions and requests sent through the website;
• Contact for commercial and institutional purposes;
• Share content, invitations, newsletters, and updates (when authorized);
• Analyze usage statistics and improve the website experience;
• Ensure information security and prevent fraud.
4. Purpose of data use
The collected data, especially through the Oplium website, are used to:
• Respond to questions and requests sent through the website;
• Contact for commercial and institutional purposes;
• Share content, invitations, newsletters, and updates (when authorized);
• Analyze usage statistics and improve the website experience;
• Ensure information security and prevent fraud.
5. Data sharing
Oplium does not share your data with third parties, except in the following cases:
• With partners who provide technological support services (e.g., hosting, email delivery, and analytics tools), always under contractual confidentiality clauses;
• When necessary to comply with legal obligations or orders from competent authorities.
Oplium does not directly carry out international data transfers through the website, but some technology providers may operate servers outside of Brazil, always in compliance with the LGPD and, when applicable, the GDPR.
5. Data sharing
Oplium does not share your data with third parties, except in the following cases:
• With partners who provide technological support services (e.g., hosting, email delivery, and analytics tools), always under contractual confidentiality clauses;
• When necessary to comply with legal obligations or orders from competent authorities.
Oplium does not directly carry out international data transfers through the website, but some technology providers may operate servers outside of Brazil, always in compliance with the LGPD and, when applicable, the GDPR.
6. Use of cookies
Our website uses strictly necessary cookies for its operation and, eventually, analytical cookies to improve its performance.
Users can manage or disable cookies directly in their browser settings, although this may affect some website functionalities.
6. Use of cookies
Our website uses strictly necessary cookies for its operation and, eventually, analytical cookies to improve its performance.
Users can manage or disable cookies directly in their browser settings, although this may affect some website functionalities.
7. Information security
7.1 Our commitment
Oplium maintains an Information Security Management System certified under the ISO/IEC 27001:2022 standard, with the scope of "provision of cybersecurity services; provision of security operations center (SOC) services". Senior management approves the Information Security Policy, defines security objectives, and ensures the necessary resources. The policy applies to all employees, service providers, and suppliers who access Oplium's information and systems.
7.2 Principles
We protect the confidentiality, integrity, and availability of Oplium's and our clients' information, complying with legal (including the LGPD and, when applicable, the GDPR), regulatory, and contractual requirements. Security controls are defined based on risk assessment and reviewed periodically.
7.3 Main security practices
• Information security risk management, with periodic assessment and treatment plan;
• Access control based on the principle of least privilege, with multi-factor authentication;
• Cryptography to protect information in transit and, when applicable, at rest (website traffic is protected by the HTTPS protocol);
• Protection of equipment against malicious codes and monitoring of security events;
• Vulnerability management and periodic security tests;
• Change management with risk and security impact assessment;
• Response to security incidents, with communication to affected parties and competent authorities when required by law;
• Business continuity, with periodic recovery and backup plans and tests;
• Security assessment of suppliers and cloud services;
• Continuous awareness and training of employees, including the safe use of artificial intelligence tools;
• Treatment of client information in accordance with contracts and confidentiality agreements.
7.4 Continuous improvement
The management system is monitored by objectives and indicators, audited internally and by an independent certification body, and critically analyzed by senior management, ensuring its continuous improvement.
7.5 Contact
Questions about this policy and reports of information security or privacy incidents can be sent to privacidade@oplium.com.
7. Information security
7.1 Our commitment
Oplium maintains an Information Security Management System certified under the ISO/IEC 27001:2022 standard, with the scope of "provision of cybersecurity services; provision of security operations center (SOC) services". Senior management approves the Information Security Policy, defines security objectives, and ensures the necessary resources. The policy applies to all employees, service providers, and suppliers who access Oplium's information and systems.
7.2 Principles
We protect the confidentiality, integrity, and availability of Oplium's and our clients' information, complying with legal (including the LGPD and, when applicable, the GDPR), regulatory, and contractual requirements. Security controls are defined based on risk assessment and reviewed periodically.
7.3 Main security practices
• Information security risk management, with periodic assessment and treatment plan;
• Access control based on the principle of least privilege, with multi-factor authentication;
• Cryptography to protect information in transit and, when applicable, at rest (website traffic is protected by the HTTPS protocol);
• Protection of equipment against malicious codes and monitoring of security events;
• Vulnerability management and periodic security tests;
• Change management with risk and security impact assessment;
• Response to security incidents, with communication to affected parties and competent authorities when required by law;
• Business continuity, with periodic recovery and backup plans and tests;
• Security assessment of suppliers and cloud services;
• Continuous awareness and training of employees, including the safe use of artificial intelligence tools;
• Treatment of client information in accordance with contracts and confidentiality agreements.
7.4 Continuous improvement
The management system is monitored by objectives and indicators, audited internally and by an independent certification body, and critically analyzed by senior management, ensuring its continuous improvement.
7.5 Contact
Questions about this policy and reports of information security or privacy incidents can be sent to privacidade@oplium.com.
8. Data subjects' rights
According to the LGPD, you have the right to:
• Confirm if we process your data;
• Access the personal data processed;
• Request the correction, deletion, or anonymization of data;
• Revoke consent, when applicable;
• Obtain information about sharing with third parties.
To exercise your rights, contact our Data Protection Officer (DPO) via email at privacidade@oplium.com.
8. Data subjects' rights
According to the LGPD, you have the right to:
• Confirm if we process your data;
• Access the personal data processed;
• Request the correction, deletion, or anonymization of data;
• Revoke consent, when applicable;
• Obtain information about sharing with third parties.
To exercise your rights, contact our Data Protection Officer (DPO) via email at privacidade@oplium.com.
9. Updates to this policy
This Policy may be updated at any time, and we recommend reading it periodically. In case of significant changes, we will communicate them prominently on our website.
Last updated: October 2026.
9. Updates to this policy
This Policy may be updated at any time, and we recommend reading it periodically. In case of significant changes, we will communicate them prominently on our website.
Last updated: October 2026.