Governance, integrity and compliance

1. Integrity and anti-corruption

GVC conducts its business in accordance with the anti-corruption and integrity laws that apply to our work, starting with those of Brazil, where we are based.

In practice, this means:

• we do not offer, promise, give or accept payments, gifts, travel or any other improper advantage, directly or through intermediaries;
• we do not use third parties to do what we would not do ourselves;
• we record our transactions accurately, with no payment without a purpose and no document that does not reflect what happened;
• when we work with the public sector, we follow the rules of the procurement process and do not seek privileged information.

We expect the same from partners and suppliers acting on our behalf.

2. Conflicts of interest and independent recommendations

A recommendation is only worth something if the person making it has no other stake in the outcome. That is why:

• we choose tools, systems and vendors based on the client's objective, and we record the reasons;
• GVC does not receive commissions, fees or benefits from software vendors without telling the client, in writing, before the decision;
• when we recommend one of GVC's own products, such as Project Valley, we say so explicitly and present the alternatives we considered;
• if a conflict arises during a project, we tell the client and agree on how to handle it.

The client decides with all the information on the table.

3. Confidentiality and ownership of deliverables

Information, documents, data and systems a client shares with us are used only to deliver the contracted project and are limited to the people working on it.

We do not name clients, projects or results without permission. At the end of a project, we return or delete the client's information, except for what the law requires us to keep.

Deliverables produced for the client, such as assessments, process designs, data models, documentation and configurations, belong to the client under the terms of the contract. GVC retains ownership of its methods, base materials and proprietary tools, and the DaedalusPy framework remains under its open source license.

4. Information security

We apply these principles when we work with our own information and our clients':

• Least privilege: each person and each integration accesses only what their role requires, for as long as it requires.
• Strong authentication: access to systems and data requires strong authentication wherever the system supports it.
• Providers with recognized practices: we use cloud services from providers with recognized security practices.
• Access logs: we keep a record of who accessed what in the environments we are responsible for.
• Protected connections: data travels over encrypted connections.

If we identify an incident that affects a client's information, we notify the client without undue delay and work with them on the response.

5. Responsible use of artificial intelligence

We use artificial intelligence as a working tool, with clear rules:

• client data is not used to train third-party models;
• we use AI with client data only in services whose terms prevent that data from being used for training, and only to the extent the project requires;
• analyses, recommendations and decisions that affect the client go through human review by an accountable professional;
• we tell the client when a deliverable was produced with significant help from AI, and when a solution we deliver uses AI to make or suggest decisions.

Responsibility for the result always lies with a person, never with the tool.

6. Personal information protection

As a Brazilian company, we handle personal information under Brazil's General Data Protection Law (Lei 13.709/2018, LGPD): for a defined purpose, on a legal basis, only what is needed and only for as long as it is needed. We also respect the privacy rights that U.S. state laws may give you.

When we deliver a project involving personal information from a client's operations, we act as a service provider and follow the client's instructions and our contract.

The details are in our Privacy Policy. To ask for access, correction or deletion, or to exercise another right, use the Your privacy rights page.

7. Governance as a system

Nobody checks a manual at the moment of a decision. That is why the governance we stand for is the kind that works inside systems: a rule counts when it is configured as a validation, a permission, an approval limit, an automation or a control in the data flow.

Every policy has a named owner, a record that shows whether it is being followed and a review date. A policy without an owner, evidence or review is an intention, not governance.

It is the same method we apply in our clients' projects, and the standard we expect to be judged by.

8. Reporting concerns

If you know of or suspect conduct by GVC, by a member of our team or by anyone acting on our behalf that breaches these commitments or the law, email contato@goldenvalleyc.com with the subject line Integridade (Portuguese for "integrity").

Describe what happened, when, who was involved and any evidence you have. You do not need to be certain to report.

• We handle every report in confidence and limit access to the people needed to look into it.
• We do not tolerate retaliation against anyone who reports in good faith.
• We look into every report and, if you identify yourself, we let you know when it is closed.

Questions about personal information can also be sent to our privacy officer, [PRIVACY OFFICER NAME], at the same address.

9. Review of this page

We review these commitments periodically and whenever our services, our providers or the applicable law change. The date of the current version appears at the top of this page.