Data Protection & Privacy Statement

Data Protection & Privacy

At Centinela Cyber, we are committed to ensuring the privacy and security of all data entrusted to us. We strictly adhere to applicable data protection laws and regulations across our operating regions, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), other applicable U.S. state privacy regulations, and Latin American data protection legal frameworks—specifically including statutory privacy laws across Central and South America, Costa Rica’s Law on the Protection of Individuals Regarding the Processing of their Personal Data (Law No. 8968 / Ley de Protección de la Persona Frente al Tratamiento de sus Datos Personales), its Executive Regulation (Decree No. 37554-JP), Law No. 7975 (Ley de Información No Divulgada), and supervision guidelines from the Data Protection Agency of Costa Rica (Agencia de Protección de Datos de los Habitantes - PRODH). We maintain a responsible approach to data collection, usage, and security across both U.S. and Latin American jurisdictions.

Data Collection and AI Model Training

We utilize data to train and enhance our security AI models, ensuring they deliver improved accuracy, threat detection, efficiency, and user experiences. In some instances, this data may include personally identifiable information (PII). However, we apply rigorous anonymization, de-identification, and encryption measures to minimize privacy risks and protect individuals’ identities wherever possible in compliance with applicable statutory standards.

Handling of Personally Identifiable Information (PII)

While PII may be processed to enhance our cybersecurity capabilities, Centinela Cyber follows strict protocols to limit access, ensure compliance, and prevent misuse. We take proactive steps to:

• De-identify sensitive and personal data whenever feasible.
• Implement role-based access controls to restrict who can view PII.
• Encrypt PII both at rest and in transit.
• Maintain registration and governance procedures for personal databases where required by regulatory bodies such as Costa Rica's PRODH.
• Regularly audit our data handling processes to maintain compliance across U.S., Costa Rican, and broader Latin American standards.

Compliance and Security

We employ industry-standard security measures to protect data from unauthorized access, modification, loss, or disclosure. Our commitment to compliance includes:

• Conducting regular security audits and penetration tests.
• Reviewing and updating our policies to align with evolving data protection regulations, local agency mandates, and international best practices.
• Maintaining detailed logs of data access, modification, and processing activities.
• Ensuring that any third-party service providers and data processors also adhere to strict security and confidentiality standards.

User Rights and Transparency

We believe in transparency and empowering our users across the Americas with full control over their personal information. In accordance with Costa Rica’s Law No. 8968 (Derechos ARCO), and international privacy standards, users have the right to:

• Access (Acceso): Understand how their data is collected, processed, and shared, and request a copy of their personal information in a machine-readable format.
• Rectification (Rectificación): Request corrections, updates, or modifications to inaccurate or incomplete personal data.
• Cancellation/Deletion (Cancelación): Request the deletion or suppression of their personal data (“right to be forgotten”) where applicable by law.
• Opposition (Oposición): Object to or opt out of specific processing activities, or withdraw consent at any time for uses that require explicit consent.

We provide clear disclosures regarding our data practices and strive to ensure that users can easily make informed choices about their privacy preferences.