Data Protection & Information Security Policy

Connectas Enterprises LLC handles personal and business information for clients in the United States, Brazil and Guyana. This policy sets the rules that everyone working for or with Connectas follows to protect it.

1. Scope

This policy applies to all staff, contractors and partners of Connectas, to all information we hold (paper and digital), and to the systems we build and operate for clients, including our Platform.

2. Principles

• Lawfulness and transparency: we collect data only for clear purposes and explain them in our Privacy Policy.
• Minimisation: we collect only what a service needs.
• Accuracy: we keep data correct and up to date.
• Limited retention: we keep data only as long as needed or required by law.
• Security: we protect data against loss, misuse and unauthorised access.
• Accountability: we can show how we comply.

3. Laws we follow

Depending on where people are and where services are delivered, these include the Brazilian General Data Protection Law (LGPD — Law 13.709/2018), Guyana’s Data Protection Act 2023, applicable U.S. federal and state privacy laws, and the EU/UK GDPR when it applies.

4. Access control

• Access by role and need to know. Each person sees only the data their work requires.
• Accounts are created by invitation only, and no account is activated before its e-mail address is confirmed.
• Two-step verification is mandatory for staff and for client HR users; apps support Face ID.
• Passwords are never shared, set or seen by administrators. Reset links are single-use, time-limited and sent only to the registered e-mail.
• Access is removed immediately when someone leaves or changes role.

5. Platform security

• Customer separation: each customer’s data is isolated from every other customer’s by rules in the database itself.
• Encryption in transit (HTTPS/TLS) and at rest, provided by our cloud infrastructure.
• Audit log: changes to records are logged and cannot be edited.
• Support access: Connectas staff cannot read a customer’s data unless that customer approves temporary access, limited to a maximum of 7 days and recorded.
• Payments: card data is handled only by Stripe (PCI DSS certified); Connectas never stores card numbers.
• Backups are made daily and tested.

6. Suppliers

We use suppliers that offer appropriate security, under written contracts that limit their use of data, and we review them when they change.

7. Incidents

Anyone who suspects a data incident must report it at once to info@connectasconsulting.com. We contain it, assess the risk, and notify affected clients, individuals and authorities within the deadlines set by law.

8. Rights requests

Requests to access, correct or delete data are answered within the deadlines set by law. For Platform data, we help the customer that controls the data to respond.

9. Training and review

Everyone with access to personal data is trained on this policy. The policy is reviewed at least once a year.