On request the controller must give the data subject the full text of the clauses used for the transfer (standard or specific clauses or global corporate rules), respecting commercial and industrial secrets, within 15 days unless ANPD regulation sets another period. It must also publish on its website a document in Portuguese, in simple, clear, precise and accessible language, covering at least the form, duration and specific purpose of the transfer, the destination country, the controller's identity and contacts, shared use and its purpose, the responsibilities of the agents and the security measures adopted, and the data subject's rights and how to exercise them, including an easily accessible channel and the right to petition the ANPD; the document may sit on its own page or prominently within the privacy policy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.