POLICY · VERSION 1.0

Privacy Policy

Effective since October 12, 2026

1. Who we are

This Policy explains how NESS Processos e Tecnologia Ltda., registered in Brazil under CNPJ 72.027.097/0001-37, processes personal data on this website and on the channels linked to it. NESS operates the brands ness., trustness. and forense.io and is the controller of the data processed here, under Brazil's General Personal Data Protection Law (LGPD, Law No. 13,709/2018).

When we provide services to clients and process personal data on their behalf, we act as a processor, following the client's instructions and the contract. This Policy covers what NESS does as a controller.

2. What data we process and why

Contact and sales requests: name, email, company and the message you send. We use them to reply, prepare proposals and maintain the business relationship. Legal basis: steps prior to a contract at the data subject's request, and legitimate interest (art. 7, V and IX).

Job applications: name, email and the position you chose. We use them only for the selection process. Legal basis: steps prior to an employment or service contract (art. 7, V).

Data subject requests: your identification and the content of the request, to meet your rights and to prove that we did. Legal basis: compliance with a legal obligation (art. 7, II).

Ethics and whistleblowing channel: the report and, if you wish, your identification. Reports may be anonymous. We use them to investigate the report and take appropriate action. Legal basis: compliance with legal and regulatory obligations and legitimate interest (art. 7, II and IX).

Technical access data: IP address, date and time and browser information, recorded for security, fraud prevention and compliance with Brazil's Internet Civil Framework (Law No. 12,965/2014). Legal basis: compliance with a legal obligation and legitimate interest (art. 7, II and IX).

We do not ask for sensitive personal data on this website. If you include it on your own in a message, it will be processed only for the purpose of that message.

3. Cookies and tracking

This website does not use advertising cookies or third-party tracking tools. It does not build browsing profiles. The technical records mentioned above serve only security and the operation of the service.

4. Who we share data with

We share personal data only when necessary for the purposes above: with infrastructure and email providers, who process the data on our behalf and under contract; with authorities, when required by law or court order; and with legal advisors and auditors, under a duty of confidentiality. We do not sell personal data.

Our infrastructure uses cloud providers that may process data outside Brazil. In these cases, the international transfer follows art. 33 of the LGPD, with contractual clauses and compatible safeguards.

5. How long we keep data

Contact messages: 12 months from submission; requests to talk to a specialist: 24 months.

Job applications: 6 months from submission.

Data subject requests: 5 years from submission, to prove that the request was handled. Ethics channel reports: 5 years after the investigation is closed.

Access records: for the minimum period set by the Internet Civil Framework (6 months), or longer when required by law or needed for defense in legal proceedings.

At the end of the period, the data is deleted or anonymized automatically.

6. How we protect data

We apply technical and administrative security measures, such as encryption in transit, need-to-know access control, operation logging and incident response, in line with our Information Security Policy. If a security incident occurs that may cause relevant risk or harm, we will notify Brazil's National Data Protection Authority (ANPD) and the affected data subjects, as required by the LGPD.

7. Your rights

You may, at any time and free of charge: confirm whether we process your data; access it; correct incomplete, inaccurate or outdated data; request anonymization, blocking or deletion of unnecessary data or data processed in breach of the law; request portability; know who we share it with; withdraw consent, when consent is the legal basis; and object to processing based on legitimate interest (art. 18).

To exercise your rights, use the data subject request form on this website or write to our data protection officer. We may ask for information to confirm your identity, in order to protect your data. We reply within the legal deadline. You may also file a complaint with the ANPD.

8. Data protection officer

The data protection officer (DPO) is the channel between you, NESS and the ANPD. The officer's name and contact details appear on this page.

9. Changes to this Policy

We may update this Policy to reflect changes in the law or in our practices. The current version and its effective date are always shown on this page, and the version history is kept.