> For the complete documentation index, see [llms.txt](https://docs.visionmakers.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.visionmakers.io/legal/data-breach.md).

# Data Breach Notification Policy

Version 2.0 · Effective 24 October 2026

How **Vision Makers Technologies Inc.** detects, manages and reports personal data breaches.

## 1 · What counts

A personal data breach is any breach of security leading to accidental or unlawful destruction,
loss, alteration, unauthorised disclosure of, or access to personal data, whether accidental or
deliberate, internal or external.

## 2 · Response process

| Phase | Target | Actions |
| --- | --- | --- |
| **1 · Detect and report internally** | Immediate | Any staff member or vendor who suspects a breach reports it at once to the security lead. No one is penalised for reporting in good faith. |
| **2 · Contain** | Within 24 hours | Isolate systems, revoke credentials, stop ongoing exposure, preserve evidence and logs. |
| **3 · Assess** | Within 72 hours | Determine categories and approximate number of individuals and records, likely consequences, and risk to rights and freedoms. |
| **4 · Notify authorities** | **72 hours** from awareness | Notify the competent supervisory authority where the breach is likely to result in a risk to individuals. Phased notification where full facts are not yet available. |
| **5 · Notify individuals** | Without undue delay | Where the breach is likely to result in a **high risk**, notify affected individuals directly and in plain language. |
| **6 · Remediate and review** | Ongoing | Fix root cause, document everything, review controls, update this Policy if needed. |

## 3 · What we tell you

A notification to you will state, in plain language: what happened and when; what data was
involved; the likely consequences; what we have done; what we recommend you do; and a contact
point for questions.

## 4 · Breach register

All breaches are recorded, including those not notified, with facts, effects and remedial
action, as required by GDPR Article 33(5). The register is available to supervisory authorities
on request.

## 5 · What we will never do

- Conceal a breach, or delay notification to manage reputation.
- Tell you a breach is "not serious" without having assessed it.
- Ask for your seed phrase or private key as part of breach response, **no legitimate breach response ever requires them**.

## 6 · Non-custodial scope

Because we hold **no private keys and no user funds**, a breach of our systems cannot result in
loss of your crypto assets from your wallet. It could expose personal data: email addresses,
KYC documents, wallet addresses and activity history. That is the risk this Policy addresses.

## 7 · Vendors

Sub-processors are contractually required to notify us **without undue delay** on becoming aware
of a breach, and to assist with our obligations. See [Sub-processors](/legal/sub-processors).

## 8 · Reporting a suspected breach

Email [admin@visionmakers.io](mailto:admin@visionmakers.io) with subject **"Data breach"**. If the issue is a technical
vulnerability rather than an actual breach, use
[Responsible Disclosure](/legal/responsible-disclosure).