Security, transparency, and privacy are priorities for DD8. This policy outlines the main information about how DD8 handles personal data to which it has access.
DD8 maintains this website to provide institutional information, contact options, and access to our platform and services. As the owner of the website, DD8 is the primary data controller of the data collected here.
KEY DEFINITIONS To make this policy easier to read and understand, we provide below some relevant definitions.
We are a company focused on delivering technology—driven solutions for the M&A, venture capital, capital markets, and real estate sectors. We generate intelligence from data to streamline and accelerate the due diligence process, enabling the parties involved in a transaction to focus on strategic aspects and make informed decisions. To do so, we leverage technology to aggregate and analyze data from various public and private sources.
DD8 is fully committed to the security and privacy of the data subjects whose personal data is processed, as well as to ensuring their right to choose how their data is used.
We process information made publicly available by federal, state, and municipal government entities in Brazil, including data disclosed under the Freedom of Information Law (Law No. 12.527/2011) and the Federal Government’s Open Data Policy, as well as other publicly accessible non—governmental data sources. In specific projects, we may also receive data from partners, suppliers, and clients. In such cases, we always rely on contractual clauses and compliance reports that ensure a high level of data protection and security, based on the authorizations our partners and clients hold for processing personal data—while also ensuring transparency to the data subject regarding the processing carried out by DD8.
As the controller of personal data collected through our website, DD8 employs robust protocols for information security and data protection, aligned with industry best practices. Since data management and analysis are core to our services, we have implemented internal policies to define clear standards for the processing of Personal Data within the scope of our activities, ensuring effective governance over internal processes and compliance with applicable legal requirements.
This Policy is published and enforced by DD8 as part of its compliance efforts with the Brazilian General Data Protection Law (LGPD).
If you still have any questions, feel free to contact us by emailing dpo@dd8.ai.
DD8 processes Personal Data according to the relevant categories and through distinct sources:
DD8 operates in partnership with a range of other companies to deliver its products and services. Accordingly, we may share your Personal Data with partner companies, always mantaining the highest security standards, safeguarding your privacy, and, whenever possible, in anonymized form. Below we describe with whom and for what purposes we may share Personal Data.
In addition to the situations described above, we reserve the right to share any Personal Data we deem necessary to comply with legal obligations or to protect the rights, property, or safety of DD8, our employees, or our clients.
Although DD8 is headquartered in Brazil and its products and services are primarily intended for the Brazilian market—making Brazilian data protection laws applicable—the Personal Data we collect may be transferred to other countries, such as the United States of America. These transfers may occur when engaging foreign service providers and technology vendors contracted by DD8 to ensure a higher level of security in the preservation of the data we process. Such transfers are supported by technical measures that guarantee data asset redundancy, helping prevent severe consequences resulting from events like natural disasters that could damage or destroy specific datacenters. They also reflect DD8’s partnerships with certain vendors and service providers, such as cloud infrastructure providers, whose physical storage infrastructure may be located in other countries.
DD8 strives to ensure that such transfers involve only companies that demonstrate compliance—or are in the process of becoming compliant—with applicable data protection and privacy laws, and that maintain a level of compliance equal to or more stringent than that required under applicable Brazilian legislation
As the Data Subject, you are the owner of your Personal Data, and Brazilian law guarantees you a series of rights related to it. We are committed to upholding these rights, and in this section, we explain how you may exercise them with DD8:
DD8’s personal data retention policy is aligned with applicable laws. Personal Data is stored only for as long as necessary to fulfill the purposes for which it was collected, unless there is another legal basis for retaining it—such as compliance with legal, regulatory, or contractual obligations—provided such retention is properly justified under the law.
We are responsible for safeguarding all Personal Data we process and using it solely for the purposes outlined in this Policy. To ensure privacy and the protection of Personal Data, we adopt security best practices appropriate to our operations, including access controls, encryption, advanced threat monitoring, data loss prevention (DLP), and other information security systems and procedures. Our security management practices are aligned with ISO 27001, and the ISO 27002 controls are integrated into DD8’s operations through dedicated teams, tools, and systems that follow the highest available standards.
DD8 requires all employees involved in data processing to sign Confidentiality Agreements, provides training in Information Security, Privacy, and Data Protection, implements appropriate measures to ensure data integrity, and ensures data availability through backup routines and incident response plans, among other damage mitigation practices.
While we make every effort to protect all Personal Data we process, we cannot guarantee absolute security, particularly in the face of malicious third—party acts. Hardware or software failures outside of DD8’s control and other external factors may compromise the security of the Personal Data we hold. If you become aware of or identify anything that may compromise the security of your data, please contact us at dpo@dd8.ai.
To learn more about our information security practices, please visit our Security Page. If you believe your Personal Data has been used in a manner inconsistent with this Policy or your stated preferences as a Data Subject—or if you have any questions, comments, or suggestions regarding this Policy-feel free to contact us at dpo@dd8.ai.
We are constantly working to improve our solutions, and as such, this Data Processing Policy may be updated to reflect improvements made. We recommend visiting this page periodically to check for any updates.
If you still have questions or need more details about how we collect and use your Personal Data-as well as your rights concerning data protection—please contact us at: dpo@dd8.ai
