Data Breach Notification Policy | Vision Makers Docs

How Vision Makers Technologies Inc. detects, manages and reports personal data breaches.

1 · What counts

A personal data breach is any breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data, whether accidental or deliberate, internal or external.

2 · Response process

Phase	Target	Actions
1 · Detect and report internally	Immediate	Any staff member or vendor who suspects a breach reports it at once to the security lead. No one is penalised for reporting in good faith.
2 · Contain	Within 24 hours	Isolate systems, revoke credentials, stop ongoing exposure, preserve evidence and logs.
3 · Assess	Within 72 hours	Determine categories and approximate number of individuals and records, likely consequences, and risk to rights and freedoms.
4 · Notify authorities	72 hours from awareness	Notify the competent supervisory authority where the breach is likely to result in a risk to individuals. Phased notification where full facts are not yet available.
5 · Notify individuals	Without undue delay	Where the breach is likely to result in a high risk, notify affected individuals directly and in plain language.
6 · Remediate and review	Ongoing	Fix root cause, document everything, review controls, update this Policy if needed.

3 · What we tell you

A notification to you will state, in plain language: what happened and when; what data was involved; the likely consequences; what we have done; what we recommend you do; and a contact point for questions.

4 · Breach register

All breaches are recorded, including those not notified, with facts, effects and remedial action, as required by GDPR Article 33(5). The register is available to supervisory authorities on request.

5 · What we will never do

Conceal a breach, or delay notification to manage reputation.
Tell you a breach is "not serious" without having assessed it.
Ask for your seed phrase or private key as part of breach response, no legitimate breach response ever requires them.

6 · Non-custodial scope

Because we hold no private keys and no user funds, a breach of our systems cannot result in loss of your crypto assets from your wallet. It could expose personal data: email addresses, KYC documents, wallet addresses and activity history. That is the risk this Policy addresses.

7 · Vendors

Sub-processors are contractually required to notify us without undue delay on becoming aware of a breach, and to assist with our obligations. See Sub-processors.

8 · Reporting a suspected breach

Email admin@visionmakers.io with subject "Data breach". If the issue is a technical vulnerability rather than an actual breach, use Responsible Disclosure.