Privacy Policy

1. Who is responsible for processing personal data

For personal data processing activities carried out through this website and the institutional contact channels made available through it, the responsible entity is:

A2AS WEB TECNOLOGIA EM INFORMAÇÃO LTDA
CNPJ: 43.372.690/0001-12
Brazil

For matters related to privacy and personal data protection:

Email: privacidade@a2astecnologia.com.br

This contact information will be updated before the final publication of this Policy.

2. What data may be collected

When users submit the contact form available on this website, the following personal data may be provided:

• name;
• organization or company;
• country;
• municipality or city;
• state, province, or region;
• email address;
• telephone number, when voluntarily provided;
• WhatsApp number, when voluntarily provided;
• subject of the inquiry;
• content of the message submitted.

The telephone and WhatsApp fields are optional.

A2AS seeks to limit the collection of personal data to what is necessary to understand and respond to the request received.

3. How personal data is collected

Personal data may be provided directly by the data subject when they:

• complete and submit the contact form;
• contact A2AS by email;
• establish institutional or commercial communication through other official channels made available by the company.

Completing the contact form is voluntary. However, some fields are mandatory because they are necessary to properly identify the request and enable A2AS to provide a response.

Checking the field relating to the Privacy Policy on the contact form indicates that the user has acknowledged this Policy and understands how the personal data provided will be used. It does not, by itself, constitute general consent for any and all processing of personal data.

4. Purposes for which we use personal data

The personal data provided may be used to:

• identify and respond to the person who initiated the contact;
• understand the nature of the request;
• respond to requests for proposals or quotations;
• provide information and presentations about the solutions offered;
• respond to support-related requests;
• handle inquiries related to public procurement and bidding processes;
• respond to questions and other institutional communications;
• continue commercial or institutional discussions initiated by the interested party;
• comply with legal or regulatory obligations, when applicable;
• protect the lawful rights and legitimate interests of A2AS and third parties, subject to applicable legal requirements.

Personal data provided through the contact form will not be used for purposes incompatible with those described in this Policy without an appropriate legal basis and, where required, without additional notice to or action by the data subject.

5. Legal bases for processing

Personal data may be processed on the legal grounds provided for under the LGPD, depending on the nature and context of each interaction.

Depending on the circumstances, applicable legal bases may include:

• procedures preliminary to entering into a contract, when carried out at the request of the data subject;
• compliance with a legal or regulatory obligation;
• the exercise of legal rights;
• legitimate interests of A2AS or third parties, where applicable and subject to the fundamental rights and freedoms of the data subject;
• consent, when required by law or when consent is specifically the appropriate legal basis for the processing activity.

The applicable legal basis must be assessed according to the specific purpose and context of the processing. Simply accessing the website or acknowledging the Privacy Policy will not be treated as general consent.

6. Contact form submission and storage

The contact form is designed to forward the information submitted directly to the A2AS corporate email account.

The website does not use its own database to store messages submitted through the contact form.

After submission, however, the message and the personal data it contains may remain stored in the corporate email inbox and within the technological infrastructure of the providers involved in website hosting and email services, as necessary to respond to the request, maintain security and continuity of communications, and comply with applicable obligations.

Therefore, the fact that the website does not store messages in its own database does not mean that a message is immediately deleted after it is submitted.

7. How long personal data is retained

Personal data will be retained only for as long as necessary to fulfill the purposes for which it was collected and used, including for:

• responding to and following up on requests;
• maintaining a commercial or institutional relationship, where applicable;
• complying with legal or regulatory obligations;
• the exercise of legal rights;
• resolving potential disputes.

When personal data is no longer necessary and there is no legal basis for retaining it, it may be deleted or, where applicable, anonymized.

Retention periods may vary depending on the nature of the communication and the obligations applicable to each specific case.

8. Sharing of personal data

A2AS does not sell personal data.

Personal data may be accessed or processed by service providers that are necessary for the operation of the infrastructure used by the company, including, for example:

• website hosting providers;
• corporate email providers;
• technology infrastructure and security providers;
• service providers that require access to personal data to perform activities on behalf of A2AS, where applicable.

Personal data may also be shared when necessary for:

• compliance with a legal or regulatory obligation;
• compliance with a court order or request from a competent authority;
• the exercise of legal rights;
• protection against fraud, abuse, or security incidents.

When third parties process personal data on behalf of A2AS, they must do so for the applicable purposes and in accordance with relevant legal and contractual obligations.

9. International data transfers

Some technology infrastructure, hosting, email, or digital service providers may operate servers or infrastructure located outside Brazil.

Where processing involves an international transfer of personal data, A2AS will seek to comply with the requirements established by Brazilian data protection legislation and applicable regulations.

The use of international service providers does not change the purposes described in this Policy.

10. Information security

A2AS seeks to adopt technical and administrative measures appropriate to the nature of the personal data processed in order to reduce the risks of:

• unauthorized access;
• improper alteration;
• loss;
• disclosure;
• destruction;
• inappropriate or unlawful use of personal data.

No system connected to the internet can be considered completely immune to risk. For this reason, security measures are monitored and may be improved as technology evolves and new risks are identified.

11. Sensitive personal data

The contact form on this website does not intentionally request sensitive personal data.

Users are therefore asked not to voluntarily include personal data in the message field that is unnecessary for responding to their request, particularly information relating, for example, to health, racial or ethnic origin, religious beliefs, political opinions, trade union membership, sex life, or genetic or biometric data.

If information of this nature is received without being necessary, A2AS may take measures to restrict its processing or delete it, subject to any applicable legal obligations.

12. Data relating to children and adolescents

The website and contact form are intended for institutional and commercial communications and are not specifically directed at children or adolescents.

A2AS does not seek to intentionally collect personal data from children through this form.

If a situation involving personal data relating to children or adolescents is identified, the processing will be assessed in accordance with applicable legal requirements.

13. Cookies and tracking technologies

In its current configuration, the A2AS website does not intentionally use behavioral advertising or audience analytics tools, such as Google Analytics, Meta Pixel, or equivalent technologies.

At present, there is also no planned use of cookies for advertising profiling or behavioral tracking of website visitors.

Certain strictly technical records or resources may nevertheless be generated by the hosting, security, or service infrastructure where technically necessary.

If cookies or additional technologies for analytics, measurement, advertising, or personalization are introduced in the future, this Policy will be updated and, where required, appropriate mechanisms for notice and user choice will be made available.

14. Automated decision-making and profiling

At present, personal data submitted through the contact form is not used for exclusively automated decision-making or automated profiling of individuals.

Requests received are intended for institutional, commercial, or technical handling by A2AS.

If this situation changes in the future, this Policy will be updated accordingly.

15. Links to third-party websites

This website may contain links to websites or services operated by third parties.

When users access an external environment, any personal data processing carried out in that environment becomes subject to the practices and policies of the relevant third party.

A2AS recommends that users review the privacy policies of any external websites they access.

This Policy applies to personal data processing activities carried out under the responsibility of A2AS and does not govern the independent practices of third parties.

16. Rights of data subjects

Under the LGPD and subject to the legal requirements applicable to each situation, data subjects may request, among other rights:

• confirmation of whether personal data is being processed;
• access to personal data;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed in violation of applicable legislation, where applicable;
• data portability, subject to the conditions established by applicable regulations;
• information regarding public and private entities with which personal data has been shared, where applicable;
• information about the possibility of withholding consent and the consequences of doing so, when processing is based on consent;
• withdrawal of consent, when consent is the applicable legal basis;
• objection to processing in the circumstances provided for by law;
• filing a petition with the Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados — ANPD), subject to applicable procedures.

The existence of a request does not necessarily mean that all personal data must be immediately deleted, as certain information may need to be retained to comply with legal obligations, for the exercise of legal rights, or on another lawful basis that justifies its retention.

17. How to exercise your rights

Requests relating to privacy, personal data protection, or the exercise of rights provided for under the LGPD may be submitted to:

Email: privacidade@a2astecnologia.com.br

To protect data subjects and prevent fraudulent requests, A2AS may take reasonable steps to verify the identity of the requester before providing information or carrying out certain requests.

Additional information will only be requested when necessary for this verification.

18. Changes to this Privacy Policy

This Policy may be updated to reflect:

• changes in laws or regulations;
• changes to website functionality;
• adoption of new technologies;
• changes in personal data processing activities;
• changes to service providers or the infrastructure used;
• improvements to privacy and security practices.

The current version will be made available on this website together with the date of its most recent update.

Material changes may also be communicated through additional channels where appropriate.

19. Contact

If you have any questions about this Policy or about personal data processing carried out by A2AS, please contact:

A2AS WEB TECNOLOGIA EM INFORMAÇÃO LTDA
CNPJ: 43.372.690/0001-12
Email for privacy matters: privacidade@a2astecnologia.com.br