Privacy and Data Protection Policy (LGPD)
Vision Marine Nautical Training Center Ltda. | CNPJ: 44.990.460/0001-80
Version 1.0, September 2026
This is a translation of the Portuguese original. In the event of any conflict of interpretation, the Portuguese version prevails.
1. Purpose and scope
1.1. This Policy describes how Vision Marine Nautical Training Center Ltda. ("VMT") processes personal data and brings together the information required by Law No. 13,709/2018 (LGPD, the Brazilian General Data Protection Law), by Law No. 12,965/2014 (Brazilian Internet Civil Framework), by the Consumer Protection Code, by Decree No. 7,962/2013 and by the regulations of the Brazilian National Data Protection Authority (ANPD).
1.2. Platform means the websites, systems and subdomains operated by VMT, including visionmarinetraining.com.br and visionmarinetraining.com, covering the institutional website, the online store, the student area, the operations panel, the corporate client area and the public certificate verification page.
1.3. It applies to visitors, buyers, students, instructors, managers of corporate clients and other authorised users. The processing of data of VMT employees and contractors, in that capacity, is governed by their respective agreements and internal policies.
1.4. Data Protection Officer. The role of Data Protection Officer is performed by the area responsible for data protection governance at VMT, whose official contact channel is privacidade@visionmarinetraining.com. Through that same channel you may request the name of the Officer, under article 41 of Law No. 13,709/2018.
2. VMT's roles
| Scenario | VMT's role | Controller |
|---|---|---|
| Direct sale to individuals, institutional website and lead management | Controller | VMT |
| Enrolment contracted by a legal entity for its employees | Processor | Contracting company |
| Issuance, custody and verification of certificates | Controller | VMT |
| VMT's own legal, tax and regulatory obligations | Controller | VMT |
2.1. As a processor, VMT processes data in accordance with the controller's documented instructions, without using it for its own purposes. Data subject requests received in that capacity are forwarded to the controller, with notice to the data subject (article 18, paragraph 4, I, of the LGPD).
2.2. The allocation of responsibilities with each corporate client is set out in a specific contractual clause, which prevails over this Policy in relations between legal entities.
3. Data processed
| Category | Content |
|---|---|
| Identification and contact | Name, CPF or equivalent document, ID document, date of birth, nationality, e-mail, telephone, address |
| Professional | Company, position, role on board, CIR, sea time, maritime and professional certificates |
| Prerequisite documents | Documents required for the course, with issue and expiry dates |
| Payment | Billing data processed by a partner institution. VMT does not store the full card number |
| Academic | Enrolments, attendance, grades, assessment results, pass or fail, certificates and validity |
| Supervised assessment | Records described in item 5 |
| Browsing, access and audit | IP address, date and time of access, session identifiers, device, browser, cookies and the record of changes made on the Platform |
3.1. Sensitive data. As a rule, VMT does not request sensitive personal data. Where a prerequisite requires a document of a medical nature, processing will comply with article 11 of the LGPD, with restricted access and retention limited to the period of the regulatory requirement. The processing of images in connection with supervised assessments follows item 5.
3.2. In corporate enrolments, employee data is provided by the contracting company, which declares that it has an adequate legal basis for the sharing.
4. Purposes and legal bases
| Purpose | Legal basis (LGPD) |
|---|---|
| Registration, enrolment, course delivery, assessment and certificate issuance | Performance of a contract, article 7, V |
| Payment, issuance of tax documents and collection | Article 7, V and article 7, II |
| Operational course communications: confirmation, welcome, pre-course, certificate, document expiry notice, cancellation and rescheduling | Article 7, V |
| Integrity of the assessment process, including remote supervision | Article 7, V and VI; article 11, II, "g", where identity verification takes place |
| Certification history and public verification page | Article 7, V and IX |
| Requirements of regulators and certifying bodies (DPC/Brazilian Navy, The Nautical Institute, OPITO) | Article 7, II and V |
| Monitoring, by the corporate client, of the employees it has enrolled | Article 7, V, in the relationship between VMT and the client |
| Retention of application access logs | Article 7, II, together with article 15 of Law No. 12,965/2014 |
| Auditing, fraud prevention and Platform security | Legitimate interest, article 7, IX |
| Lead management and recovery of incomplete purchases | Article 7, V and IX, with opt-out available in every message |
| Marketing not linked to a purchase in progress, and usage analysis dependent on non-essential cookies | Consent, article 7, I |
| Defence in judicial, administrative or arbitration proceedings | Article 7, VI |
4.1. Where processing is based on legitimate interest, it is limited to what is strictly necessary for the stated purpose, and the data subject retains the right to object under article 18, paragraph 2, of the LGPD.
5. Remotely supervised assessments
5.1. What is recorded. Certain assessments are taken online with remote supervision, which records:
- technical session events: tab switching, exit from full screen mode, loss of window focus, start and end times;
- image capture of the candidate and of the browser screen during the exam, for identity verification and exam integrity;
- the record of the acknowledgement given by the student before the exam begins.
5.2. Scope of capture. Capture is limited to the browser window used in the assessment and to the framing necessary to identify the candidate, for the duration of the exam. There is no capture outside the assessment period.
5.3. Legal basis. Supervision is based on performance of the contract (article 7, V) and on the regular exercise of rights (article 7, VI), forming part of the contracted service and meeting a requirement of the accrediting bodies. Where biometric identity verification takes place, article 11, II, "g", of the LGPD applies, concerning fraud prevention and the security of the data subject in identification and authentication processes.
5.4. Prior information. Before each exam, the student receives a description of what will be captured, of the retention period and of their rights, with a record of the acknowledgement.
5.5. Environment. The student must take the exam in a private setting, without third parties present. VMT has no interest in processing images or data of third parties and will delete them if identified.
5.6. Restricted access. Recordings are accessible only to personnel designated for integrity analysis and auditing, with a record of who accessed them and when.
5.7. Retention. Recordings are deleted 1 (one) year after the results are released, or upon the conclusion of any challenge or audit by an accrediting body, whichever occurs last.
5.8. Decision and review. Where an irregularity is found, the assessment may be invalidated. The student and/or corporate client is notified with an indication of the events that led to the decision and may submit a challenge within 10 (ten) days, with review by a natural person, under article 20 of the LGPD. Upon request, VMT will provide information about the criteria used, subject to trade secrecy.
6. Public certificate verification
6.1. Each certificate has a unique identifier and can be verified on a public page, by QR Code or by the certificate number.
6.2. The page displays only the holder's name, course, number, issue date, validity and current status, and no other data.
6.3. Verification is part of the attestation function of the certificate and of the verifiability requirement of certifying bodies and industry clients. While the certificate remains valid, the record is not removed, without prejudice to the data subject's other rights.
7. Sharing
7.1. Data may be shared with:
- the company contracting the training, in corporate enrolments, limited to enrolment, attendance, completion, result and certificates of the employees it has designated;
- the payment institution, for financial processing;
- The Nautical Institute and other certifying or accrediting bodies;
- public authorities and regulators, including the DPC and the Brazilian Navy, where required by law or by request of a competent authority;
- technology, hosting, messaging and CRM suppliers, as processors or sub-processors, bound by confidentiality and security obligations;
- legal, accounting and audit advisers, where necessary for the regular exercise of rights.
7.2. An up-to-date list of the suppliers that process personal data on behalf of VMT, with the respective purpose and location, may be obtained on request through privacidade@visionmarinetraining.com.
7.3. VMT does not sell personal data.
8. International transfers
The main database is hosted in Brazilian territory. Transfers abroad are limited to what is necessary and comply with article 33 of the LGPD and ANPD Board Resolution No. 19/2024:
| Destination | Mechanism |
|---|---|
| European Union and European Economic Area | Adequacy decision, article 33, I, under ANPD Board Resolution No. 32/2026 |
| United Kingdom | Standard contractual clauses approved by the ANPD (article 33, II, "b"); alternatively, article 33, VIII |
| United States and other destinations | Standard contractual clauses approved by the ANPD, article 33, II, "b" |
9. Retention periods
| Category | Period |
|---|---|
| Contractual, financial and tax data | Applicable limitation and tax retention periods |
| Academic and certification data | Validity of the certificate plus the periods required by regulators and certifying bodies; where no specific period applies, 5 years after completion |
| Supervised assessment recordings | As set out in item 5.7 |
| Application access logs | 6 months (article 15 of Law No. 12,965/2014), extendable upon request of an authority |
| Audit and incident records | 5 years |
| Cookies and browsing data | As set out in the Cookie Policy |
| Data processed on the basis of consent | Until withdrawal |
Once these periods end, the data is deleted or anonymised, subject to article 16 of the LGPD.
10. Security and incidents
10.1. VMT adopts technical and administrative measures to protect data against unauthorised access and accidental or unlawful situations, including encryption in transit and at rest, access control segregated by profile, audit logging, backups and monitoring. The measures reflect the state of the art and may be replaced by controls of equivalent or greater effectiveness.
10.2. Where an incident is identified that may give rise to relevant risk or damage, VMT will notify the ANPD and the affected data subjects within the period set by the applicable regulations, counted from becoming aware that the incident affected personal data, under ANPD Board Resolution No. 15/2024, informing the data affected, the measures adopted and the recommendations to the data subject.
11. Data subject rights
11.1. Under article 18 of the LGPD, the data subject may, free of charge: obtain confirmation of the existence of processing and access to the data; correct incomplete, inaccurate or outdated data; request anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law; request portability; request the deletion of data processed on the basis of consent; obtain information about sharing and about the consequences of refusing consent; withdraw consent; object to processing carried out without consent; request review of automated decisions; and petition the ANPD.
11.2. How to exercise. Requests must be sent to privacidade@visionmarinetraining.com, identifying the data subject and describing the request. VMT may request additional information solely to confirm the requester's identity, deleting it once the request has been handled. The request may be made by a representative with proven powers.
11.3. Deadlines. A simplified response immediately (article 19, I); a clear and complete statement within 15 (fifteen) days of the request (article 19, II). Where it is not possible to act immediately, VMT will explain the reasons of fact or of law (article 18, paragraph 4).
11.4. Limits. A request may be refused, always with reasons given, where it conflicts with a legal retention obligation, with the regular exercise of rights in judicial, administrative or arbitration proceedings, or with the rights of third parties.
11.5. ANPD. The data subject may petition the National Data Protection Authority (gov.br/anpd); prior contact with the Data Protection Officer is recommended.
12. Cookies
The use of cookies and similar technologies is governed by the Cookie Policy available on the website.
13. Changes and contact
13.1. This Policy may be updated at any time, with the version and date indicated. Changes that restrict the data subject's rights or materially expand the purposes will be notified in advance through the registered channels.
13.2. Privacy and data protection: privacidade@visionmarinetraining.com. General matters: atendimento@visionmarinetraining.com. Correspondence: Avenida das Américas, nº 2.480, Bloco 4, Barra da Tijuca, Rio de Janeiro/RJ, CEP 22.640-101, Brazil.