Opera Group Legal Framework

The data controller is Opera Group, with operating offices in Buenos Aires (Argentina) and Santiago (Chile) and representation in Toronto, Miami and Shanghai. For all privacy matters — including exercise of rights, requests for information or complaints — please contact:

• Privacy team: privacy@operag.com
• Brazil — Encarregado de Dados (DPO under LGPD): dpo-br@operag.com
• Argentina — Responsable de Datos (Ley 25.326): privacy@operag.com

We do not knowingly collect special-category data (health, racial or ethnic origin, political opinions, religious beliefs, biometric data) and ask you not to submit such data through our forms or Portal.

• Directly from you: forms on our website, Portal sign-up, emails, calls, meetings.
• From your organization: where a colleague invites you or provides your details for an engagement.
• Automatically: cookies and similar technologies (see Cookie Policy).
• From third parties: publicly available business databases (LinkedIn, company registries), referral partners, and B2B enrichment providers — only for legitimate prospecting in a B2B context.

We do not sell personal data. We share data only with vetted subprocessors under written agreements and for the purposes described above:

An up-to-date list is available on request. We may also share data with: (a) professional advisers (lawyers, auditors, accountants) bound by confidentiality; (b) acquirers in the context of a merger, acquisition or asset sale; and (c) authorities where legally required.

Opera Group operates across LatAm, North America, the EU and Asia. Personal data may be transferred to and processed in countries outside your country of residence. Where required, we rely on appropriate safeguards: EU Standard Contractual Clauses (SCCs), UK IDTA, adequacy decisions where available, and equivalent mechanisms under LGPD (Resolução ANPD nº 19/2024) and Argentine law.

Subject to applicable law, you have the right to: access your data; rectify inaccurate data; request erasure; restrict or object to processing; data portability; withdraw consent at any time (without affecting prior lawful processing); and lodge a complaint with the supervisory authority of your jurisdiction.

• EU/UK: your local Data Protection Authority.
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD).
• Argentina: Agencia de Acceso a la Información Pública (AAIP).
• Chile: the supervisory authority designated under the 2024 reform of Ley 19.628.

To exercise rights, write to privacy@operag.com. We respond within 30 days (extendable by a further 60 days for complex requests, with notice).

We implement technical and organizational measures appropriate to the risk: encryption in transit (TLS) and at rest, role-based access control, row-level security in the database, audit logging, least-privilege principle, vetted subprocessors, periodic security reviews and incident response procedures. No system is completely secure; we cannot guarantee absolute security.

In the event of a personal data breach likely to result in a risk to your rights, we will notify the competent authority within 72 hours (where required by GDPR / LGPD) and affected individuals without undue delay where the breach is likely to result in a high risk.

The Services are B2B and not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe we have, contact privacy@operag.com and we will delete it.

We may update this Policy. The "effective date" at the top reflects the latest version. Material changes will be notified by email to Portal account holders or via a prominent notice on the website.

Sections 1–12 above describe how Opera Group acts as Controller of its own data (leads, prospects, marketing). When a Client uploads data to the Portal, shares records for an engagement, or otherwise instructs us to process personal data on its behalf, Opera Group acts as Processor and the Client as Controller. The terms below summarize that relationship; they form part of the Terms of Service and any signed MSA.

• Instructions: we process personal data only on the Client's documented instructions, including for international transfers, unless required otherwise by law.
• Confidentiality: personnel authorized to process Client data are bound by confidentiality and receive privacy and security training.
• Security: TLS 1.2+ in transit and AES-256 (or equivalent) at rest, row-level security and least-privilege access, MFA for administrative access, audit logging, vulnerability scanning, tested backups and incident response.
• Subprocessors: the Client provides general written authorization for the subprocessors listed in section 5 (Supabase, Cloudflare, Odoo, AI Gateway providers, transactional email, analytics). We impose equivalent contractual obligations on each, remain liable for their acts and omissions, and give at least 30 days' notice of additions or replacements, with a right to object on reasonable data-protection grounds.
• Data-subject rights: we assist the Client, by appropriate technical and organizational measures and to the extent possible, in responding to requests from data subjects.
• International transfers: where personal data leaves the EEA, UK, Brazil or other restricted jurisdictions, the parties incorporate the EU SCCs (Module Two — Controller to Processor) by reference, plus the UK IDTA and equivalent mechanisms under LGPD and Argentine law.
• Breach notification: we notify the Client without undue delay (and within 72 hours where feasible) of a personal data breach affecting Client data, with the information reasonably available.
• Audit: we make available the information necessary to demonstrate compliance. Audits may be performed by an independent auditor agreed by the parties, no more than once per year (except after a material breach), at the Client's expense, with 30 days' notice and subject to confidentiality.
• Return or deletion: upon termination, and at the Client's choice, we return or delete personal data processed on the Client's behalf, unless retention is required by law. Backups are deleted on the regular rotation schedule.
• Liability: subject to the limits in the Terms of Service and any signed MSA, except where data-protection law mandates otherwise.

Clients with regulated workloads or vendor-onboarding requirements can download the full DPA template (signature-ready), execute it as an annex to the MSA, and return it to legal@operag.com.

Download DPA template (PDF)