Data Controller:
The management of the website https://oceanfilms.com.br/ (hereinafter, the “Website”) entails that OCEAN MEDIA PRODUÇÕES LTDA, whose contact details are set out below, shall act as controller of your personal data.
| OCEAN MEDIA PRODUÇÕES LTDA CNPJ: 00.287.834/0001-20 Address: Rua Henrique Vera do Nascimento, 240, Sala 02 Ático, 88062-020, Florianópolis, Santa Catarina, Brazil Tel.: +55 628 844 155 E-mail: privacy@twentyfoursevengroup.xyz |
The Controller forms part of the 24/7 Group, which is dedicated to the provision of audiovisual production services and associated services for advertising campaigns and creative projects at international level.
Where you provide your data to any entity within the 24/7 Group or enter into a contract with any of them, that entity shall act as controller of your personal data.
A full list of the entities comprising the 24/7 Group and their contact details is available here.
Details of data processing:
Below you will find a summary of the categories of personal data we process about you, the purposes for which they are processed, the legal basis on which we rely, and the sources from which we collect such data.
| Purpose | Categories of personal data | Legal basis | Source | Recipients |
|---|---|---|---|---|
| Responding to and handling enquiries, questions and/or requests submitted | Identification and contact data such as name, surname(s), e-mail address, telephone number, and any other information included by the user in their enquiry or message. | Art. 7, V LGPD – performance of a contract or preliminary procedures related to a contract, at the request of the data subject | Directly from you. | Competent public authorities or bodies, where there is a legal obligation to disclose personal data.Service providers, both internal and external, who may require access to personal data in order to provide their services, including: IT, hosting, communications, and support services. |
| Managing newsletter subscriptions, including sending communications about our activities, events, and related content | Identification and contact data: name, surname(s), e-mail address. | Art. 7, I LGPD – consent of the data subject | Directly from you. | Competent public authorities or bodies, where there is a legal obligation to disclose personal data.Service providers, both internal and external, who may require access to personal data in order to provide their services, including: IT, hosting, communications, and support services. |
| Ensuring the correct technical operation of the website and system security | Browsing data such as IP address, device information, browser type, language, access dates and times, and data relating to browsing behaviour and use of the website. | Art. 7, IX LGPD – legitimate interests of the controller, in ensuring the security and usability of our website | Directly from you, via cookies or similar technologies, in accordance with our Cookie Policy. | Competent public authorities or bodies, where there is a legal obligation to disclose personal data.Service providers, both internal and external, who may require access to personal data in order to provide their services, including: IT, hosting, communications, and support services. |
| Where you are a client, sending you communications about our activities, events, or services similar to those previously contracted | Identification and contact data: name, surname(s), e-mail address. | Art. 7, IX LGPD – legitimate interests of the controller in direct marketing and the sending of promotional content | Directly from you. | Competent public authorities or bodies, where there is a legal obligation to disclose personal data.Service providers, both internal and external, who may require access to personal data in order to provide their services, including: IT, hosting, communications, and support services. |
| Sharing your personal data with other entities within the 24/7 Group for internal administrative purposes, including the organisation and coordination of projects and/or events | Identification and contact data: name, surname(s), e-mail address.Browsing data such as IP address, device information, browser type, language, access dates and times, and data relating to browsing behaviour and use of the website. | Art. 7, IX LGPD – legitimate interests of the controller in ensuring the proper provision of services and management of internal resources | Directly from you. | Entities within the 24/7 Group. |
| Managing the whistleblowing channel, investigating reported matters, and complying with applicable legislation | Identification and contact data, and any other data related to the matters reported, both of the reporting person and of any third parties involved, to the extent necessary for the management, investigation, and resolution of reports. | Art. 7, II LGPD – compliance with a legal or regulatory obligation | Directly from you, through third-party reporters, or by means of investigations carried out. | Competent public authorities or bodies, where there is a legal obligation to disclose personal data.Service providers, both internal and external, who may require access to personal data in order to provide their services, including: IT, hosting, communications, and support services. |
| Complying with official control, supervision, and audit obligations, including official reporting and notification obligations, as well as commercial or tax legal obligations | Identification and contact data: name, surname(s), e-mail address.Browsing data such as IP address, device information, browser type, language, access dates and times, and data relating to browsing behaviour and use of the website. | Art. 7, II LGPD – compliance with a legal or regulatory obligation | Directly from you. | Competent public authorities or bodies, where there is a legal obligation to disclose personal data.Service providers, both internal and external, who may require access to personal data in order to provide their services, including: IT, hosting, communications, and support services. |
| In specific cases, processing your data for the establishment, exercise, or defence of legal claims | Identification and contact data: name, surname(s), e-mail address.Browsing data such as IP address, device information, browser type, language, access dates and times, and data relating to browsing behaviour and use of the website. | Art. 7, VI LGPD – regular exercise of rights in judicial, administrative, or arbitration proceedings | Directly from you. | In the context of the processing described herein, the following recipients may have access to your data:LawyersConsultantsCourtsMediators |
Where you provide your data in the “Work with us” section, the processing of your personal data will be governed by the specific Privacy Policy for candidates.
For further information about these processing activities, including the relevant balancing test conducted in relation to our legitimate interests, please contact us at privacy@twentyfoursevengroup.xyz.
Retention period:
The data collected will be retained for as long as necessary to fulfil the purposes for which it was collected. As a general rule, data will be retained for the duration of the relationship with the user and, once that relationship has ended, for the periods necessary for the establishment, exercise, or defence of legal claims, as well as to comply with legal and contractual obligations, during which time it will be duly blocked.
Where processing is based on consent (such as for newsletter subscriptions), data will be retained until the user withdraws their consent or requests its deletion.
In relation to the whistleblowing channel, data will be retained only for the time strictly necessary to decide whether to initiate an investigation and, in any event, in accordance with the time limits established under applicable legislation, and may thereafter be retained in blocked form for the purpose of complying with legal obligations or for legal defence purposes.
International transfers of personal data:
Some of the entities within the 24/7 Group are located outside Brazil, including within the European Union and in other countries such as the Dominican Republic and Chile. Accordingly, access to personal data by those entities may entail the making of international transfers of personal data, subject to the requirements of Articles 33 to 36 of the Lei Geral de Proteção de Dados (Law No. 13,709/2018, the “LGPD”) and the applicable regulations issued by the Autoridade Nacional de Proteção de Dados (“ANPD”).
Transfers of personal data to entities located within the European Union or the European Economic Area are carried out on the basis of the adequacy decision adopted by the ANPD through Resolution CD/ANPD No. 32/2026, which recognises the European Union as providing a level of personal data protection equivalent to that of the LGPD. No additional transfer safeguards are required in respect of those transfers.
For transfers to other entities within the 24/7 Group located outside the European Union, the 24/7 Group has an intra-group data processing agreement in place between its entities. That agreement incorporates the Standard Contractual Clauses approved by the ANPD pursuant to Resolution CD/ANPD No. 19/2024, which provide appropriate safeguards for the protection of personal data.
The 24/7 Group may also engage information technology, hosting, and marketing service providers located outside Brazil. In such cases, international transfers of personal data are carried out subject to appropriate safeguards in accordance with the LGPD and applicable ANPD regulations, including, where required, the execution of ANPD-approved Standard Contractual Clauses.
Beyond the cases described above, no international transfers of personal data are made. Should the 24/7 Group engage new service providers located outside Brazil, it will ensure that the processing of personal data is covered by appropriate safeguards in accordance with applicable legislation, and will duly inform data subjects accordingly.
For further information about international transfers of personal data, please contact us at privacy@twentyfoursevengroup.xyz.
Rights:
In accordance with Article 18 of the LGPD, you have the following rights in relation to your personal data:
Right to confirm the existence of processing: you may ask the 24/7 Group whether it is processing your personal data.
Right to access your personal data: you may obtain access to the personal data held about you.
Right to request rectification of inaccurate, incomplete, or out-of-date data.
Right to request anonymisation, blocking, or deletion of unnecessary or excessive data, or data processed in non-compliance with the LGPD.
Right to request the deletion of personal data processed on the basis of your consent, where consent is revoked.
Right to data portability: you may request that your personal data be transferred to another service or product provider, in accordance with ANPD regulations.
Right to information about public and private entities with which your personal data has been shared.
Right to information about the possibility of withholding consent and the consequences of doing so.
Right to object to processing: the 24/7 Group will cease processing your personal data, unless processing must continue on legitimate grounds or for the establishment, exercise, or defence of legal claims.
Where you have given your consent for a specific purpose, you may withdraw such consent at any time without affecting the lawfulness of processing carried out prior to its withdrawal.
To exercise any of your rights, please contact us in writing at privacy@twentyfoursevengroup.xyz.
You are also entitled to lodge a complaint with the national supervisory authority, the Autoridade Nacional de Proteção de Dados (ANPD), at www.gov.br/anpd.
Last updated: June 2026