# LGPD Compliance Assessment Record

## Organisation Details

| Field | Value |
|-------|-------|
| Organisation Name | Zenith Global Enterprises Ltda |
| CNPJ | 12.345.678/0001-90 |
| Registered Address | Av. Paulista 1578, 12º andar, Bela Vista, São Paulo — SP, CEP 01310-200 |
| Industry Sector | International Logistics and Freight Forwarding |
| Assessment Date | 14 March 2026 |
| Assessor | Maria Fernanda Oliveira, Encarregada (DPO) |

## Encarregado (DPO) Appointment Record

| Field | Value |
|-------|-------|
| DPO Name | Maria Fernanda Oliveira |
| Title | Compliance Director and Encarregada pelo Tratamento de Dados Pessoais |
| Contact Email | dpo-brasil@zenithglobal.com |
| Contact Phone | +55 11 3456-7890 |
| Public Disclosure | Published on zenithglobal.com.br/privacidade and in the Política de Privacidade |
| Appointment Date | 15 September 2020 |
| Reporting Line | Chief Privacy Officer (functional) / Brazil Country Manager (dotted line) |

## Processing Activity Register (Registro de Atividades de Tratamento)

### Activity 1: Customer Freight Contract Processing

| Element | Detail |
|---------|--------|
| Activity ID | PAR-BR-001 |
| Description | Processing customer personal data for freight forwarding contract fulfilment |
| Data Categories | Full name, CPF/CNPJ, business email, phone, shipping addresses, payment details |
| Data Subject Categories | Individual shippers, consignees, customs brokers |
| Lawful Basis | Art. 7, V — Contract performance |
| Sensitive Data | None |
| Retention Period | Duration of contract + 5 years (CTN Art. 173) |
| International Transfers | Yes — EU headquarters (Germany), APAC operations (Singapore, Japan) |
| Transfer Mechanism | ANPD-approved SCCs (Resolution CD/ANPD No. 19/2024) |

### Activity 2: Employee Payroll and HR Management

| Element | Detail |
|---------|--------|
| Activity ID | PAR-BR-002 |
| Description | Processing employee personal data for employment contract execution and legal compliance |
| Data Categories | Full name, CPF, address, bank details, salary information, dependents |
| Data Subject Categories | Employees, dependents |
| Lawful Basis | Art. 7, V (contract performance) and Art. 7, II (legal obligation — CLT, tax law) |
| Sensitive Data | Health data for occupational medicine (NR-7) — processed under Art. 11, II(f) |
| Retention Period | Employment duration + 5 years (CLT Art. 11) |
| International Transfers | Yes — Regional HR hub (Singapore) |
| Transfer Mechanism | ANPD-approved SCCs |

### Activity 3: Marketing Communications

| Element | Detail |
|---------|--------|
| Activity ID | PAR-BR-003 |
| Description | Sending marketing communications to Brazilian customers about logistics services |
| Data Categories | Name, email, company, industry, service history |
| Data Subject Categories | Current and prospective customers |
| Lawful Basis | Art. 7, I — Consent |
| Sensitive Data | None |
| Retention Period | Until consent withdrawal + 6 months for compliance records |
| International Transfers | Yes — Marketing platform hosted in United States |
| Transfer Mechanism | Specific consent (Art. 33, VIII) + supplementary measures |

### Activity 4: Automated Credit Scoring

| Element | Detail |
|---------|--------|
| Activity ID | PAR-BR-004 |
| Description | Automated credit risk assessment for corporate customers requesting trade credit terms |
| Data Categories | Company name, CNPJ, payment history, credit bureau data, financial statements |
| Data Subject Categories | Corporate customers (legal representatives) |
| Lawful Basis | Art. 7, X — Credit protection |
| Sensitive Data | None |
| Retention Period | Duration of business relationship + 5 years |
| International Transfers | None — processed in Brazil |
| Automated Decision-Making | Yes — Art. 20 review mechanism in place |
| RIPD Reference | RIPD-BR-001 |

## Lawful Basis Assessment Record

### Assessment for Activity PAR-BR-003 (Marketing Communications)

| Assessment Element | Detail |
|-------------------|--------|
| Processing Activity | Marketing email campaigns to Brazilian customers |
| Proposed Basis | Art. 7, I — Consent |
| Alternative Bases Considered | Art. 7, IX (legitimate interest) — rejected due to ANPD guidance recommending consent for direct marketing |
| Consent Mechanism | Double opt-in via registration form; standalone consent clause per Art. 8, §1 |
| Granularity | Separate consent for: (a) product updates, (b) promotional offers, (c) industry insights |
| Revocation Mechanism | One-click unsubscribe in every email; privacy portal consent management; revocation effective within 24 hours |
| Consent Record Storage | Consent management platform with timestamp, IP address, consent version, scope |
| Assessment Date | 1 October 2025 |
| Next Review | 1 October 2026 |

## Data Subject Rights Response Log

| Request ID | Date Received | Request Type | Data Subject | Deadline | Status | Completed |
|-----------|--------------|--------------|-------------|----------|--------|-----------|
| DSR-BR-2026-0001 | 5 January 2026 | Access (Art. 18, II) | João Silva | 20 January 2026 | Completed | 18 January 2026 |
| DSR-BR-2026-0002 | 12 January 2026 | Deletion (Art. 18, VI) | Ana Costa | 27 January 2026 | Completed | 25 January 2026 |
| DSR-BR-2026-0003 | 3 February 2026 | Portability (Art. 18, V) | Carlos Mendes | 18 February 2026 | Completed | 15 February 2026 |
| DSR-BR-2026-0004 | 1 March 2026 | Automated decision review (Art. 20) | Empresa ABC Ltda | 16 March 2026 | In progress | — |

## International Transfer Register

| Transfer ID | Flow | Destination | Mechanism | TIA Reference | SCC Execution Date | Next Review |
|------------|------|-------------|-----------|---------------|-------------------|-------------|
| TFR-BR-001 | Customer data → EU HQ | Germany | ANPD SCCs | TIA-BR-DE-001 | 1 September 2025 | 1 September 2026 |
| TFR-BR-002 | Employee data → HR hub | Singapore | ANPD SCCs | TIA-BR-SG-001 | 1 September 2025 | 1 September 2026 |
| TFR-BR-003 | Marketing data → platform | United States | Specific consent + measures | TIA-BR-US-001 | N/A (consent) | 1 March 2026 |
| TFR-BR-004 | Logistics data → APAC ops | Japan | ANPD SCCs | TIA-BR-JP-001 | 1 October 2025 | 1 October 2026 |

## RIPD Register

| Reference | Activity | Basis | Risk Level | Date Completed | Next Review |
|-----------|----------|-------|------------|---------------|-------------|
| RIPD-BR-001 | Customer credit scoring | Art. 7, X | High | 15 January 2026 | 15 January 2027 |
| RIPD-BR-002 | Employee biometric access | Art. 11, I | High | 10 November 2025 | 10 November 2026 |
| RIPD-BR-003 | Marketing analytics profiling | Art. 7, IX | Medium | 1 December 2025 | 1 December 2026 |
| RIPD-BR-004 | International transfer to EU | Art. 33 | Medium | 15 February 2026 | 15 February 2027 |

## ANPD Compliance Checklist

| Requirement | Article | Status | Evidence |
|------------|---------|--------|----------|
| DPO appointed and publicly disclosed | Art. 41 | Compliant | Website publication; ANPD notification |
| Lawful basis documented for all processing | Art. 7/11 | Compliant | Processing activity register |
| Privacy notice published in Portuguese | Art. 9 | Compliant | zenithglobal.com.br/privacidade |
| Consent mechanism with revocation | Art. 8 | Compliant | Consent management platform |
| Data subject rights response workflow | Arts. 18-20 | Compliant | DSR portal and response procedures |
| Security measures implemented | Art. 46 | Compliant | ISO 27001 certification; security audit |
| RIPD prepared for high-risk processing | Art. 38 | Compliant | RIPD register with 4 active assessments |
| International transfer mechanisms in place | Art. 33 | Compliant | ANPD-approved SCCs executed |
| Breach notification procedures | Art. 48 | Compliant | Incident response plan; 3-day notification procedure |
| Employee training completed | Art. 50 | Compliant | Annual training; 98% completion rate |