XML 27 R8.htm IDEA: XBRL DOCUMENT v3.25.2
Cybersecurity
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Risk management and strategy
We recognize the need to manage cybersecurity risk and seek to embed data protection and cybersecurity risk management in our operations. We are in the process of establishing processes for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes.
As a foundation of our approach, we are implementing a data privacy and cybersecurity governance structure to help assess, identify and manage data privacy and cybersecurity risks. Our privacy and cybersecurity policies encompass incident response procedures, information security and vendor management. In order to help develop these policies and procedures, we monitor the privacy, data protection, artificial intelligence and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business (including LGPD, GDPR, CCPA, CPRA, and the EU AI Act) as further described in “Item 3.D. Key Information—Risk Factors“ and “Item 4.B. Information on the Company—Business Overview— Regulatory Overview,“ as well as proposed privacy, data protection, artificial intelligence and cybersecurity laws, regulations, guidance and emerging risks.
As described in “Item 3.D. Key Information—Risk Factors,” our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, privacy and cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business the Company faces regular privacy and cybersecurity risks which may cause regular adverse operational effects. The Company had no material privacy or cybersecurity incident during the 2024 fiscal year.
The sophistication of cybersecurity threats, including through the use of artificial intelligence, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including testing our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency may further expose our computer systems to the risk of privacy or cybersecurity incidents.
Cybersecurity Risk Management Processes Integrated [Text Block] We are in the process of establishing processes for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Governance
As part of our overall risk management approach, we prioritize the identification and management of privacy and cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our audit committee oversees the Board’s responsibilities relating to operational risks, including privacy, cybersecurity, information technology, business continuity and data security risks of the Company. Our audit committee is informed of such risks through quarterly reports from our Chief Information Officer (CIO).
In 2025, the Company plans to create a privacy and cybersecurity committee composed of members of management to support processes related to assessing privacy and cybersecurity risk, and possibly also to provide summary reports on its activities, which the CIO would communicate as appropriate to the audit committee.
At the employee level, we maintain an experienced information technology team tasked with implementing our privacy and cybersecurity program and support the CIO in carrying out reporting, security and mitigation functions. We also hold employee onboarding trainings on privacy and cybersecurity, as well as records and information management, conduct phishing tests and generally seek to promote awareness of privacy and cybersecurity risk through communication and education of our employee population.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our audit committee oversees the Board’s responsibilities relating to operational risks, including privacy, cybersecurity, information technology, business continuity and data security risks of the Company.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our audit committee is informed of such risks through quarterly reports from our Chief Information Officer (CIO).