Privacy Policy

1. General Provisions and Purpose

A3A Engenharia de Sistemas, a private legal entity committed to the principles of transparency, information security and privacy protection, establishes this Privacy and Personal Data Protection Policy (the “Policy”) in order to inform, clearly, accurately and accessibly, how personal data processed in the course of its activities is collected, used, stored, shared and protected.

This Policy fully complies with the Brazilian General Data Protection Law – LGPD (Law No. 13,709/2018), as well as with recognised guidelines on information security, cybersecurity and data governance.

2. Scope

This Policy applies to:

• Visitors to the website www.a3aengenharia.com;
• Leads, clients, commercial and institutional partners;
• Suppliers and third parties holding a contractual or pre-contractual relationship with A3A Engenharia de Sistemas;
• Users who interact with A3A Engenharia de Sistemas by digital, physical or remote means.

This document must be read together with contracts, technical proposals, terms of use and other legal instruments entered into with A3A Engenharia de Sistemas.

3. DEFINITIONS

For the purposes of this Policy, the definitions set out in Article 5 of the LGPD apply, including but not limited to:

• Data subject: the natural person to whom the personal data refers;
• Personal data: information relating to an identified or identifiable natural person;
• Processing: any operation carried out with personal data;
• Controller: A3A Engenharia de Sistemas;
• Processor: the natural or legal person who processes data on behalf of the controller;
• Consent: a free, informed and unambiguous statement by the data subject.

4. PERSONAL DATA COLLECTED

A3A Engenharia de Sistemas may collect and process the following personal data, depending on the data subject’s interaction:

4.1 Data provided directly by the data subject

• First and last name;
• E-mail address;
• Telephone number;
• Company or institution represented;
• Position or role.

4.2 Data collected by digital means

• IP address;
• Date and time of access;
• Device and browser information;
• Approximate location data;
• Pages visited and interactions on the website.

4.3 Data from social media and institutional channels

• Public information made available by the data subject;
• Data provided in messages, forms or voluntary interactions.

5. USE OF COOKIES AND SIMILAR TECHNOLOGIES

The A3A Engenharia de Sistemas website uses cookies and similar technologies, subject to the user’s consent, in order to:

• Ensure the website functions correctly;
• Improve the browsing experience;
• Analyse usage and performance metrics;
• Support institutional communication and marketing strategies.

The data subject may, at any time, manage or withdraw consent for cookies through the browser settings.

6. PURPOSES OF PROCESSING

Personal data is processed exclusively for legitimate, specific purposes compatible with the data subject’s expectations, including to:

• Respond to requests and institutional enquiries;
• Send technical, commercial or institutional communications;
• Perform contracts and technical proposals;
• Comply with legal, regulatory and contractual obligations;
• Carry out institutional marketing activities, where authorised;
• Improve services, solutions and internal processes;
• Ensure information security and prevent fraud.

7. LEGAL BASES FOR PROCESSING

The processing of personal data by A3A Engenharia de Sistemas is based, as applicable, on the following legal bases set out in the LGPD:

• Consent of the data subject;
• Performance of a contract or preliminary procedures;
• Compliance with a legal or regulatory obligation;
• Regular exercise of rights in administrative or judicial proceedings;
• Legitimate interest, subject to the due balancing of rights.

8. DATA SHARING

Personal data is not sold by A3A Engenharia de Sistemas.

Sharing may occur only in the following circumstances:

• With authorised employees and service providers;
• With technical or commercial partners, where necessary to perform contracts;
• To comply with a legal or regulatory obligation or a court order;
• In corporate transactions such as mergers, acquisitions or business reorganisations.

All third parties involved are bound by contractual obligations of confidentiality and information security.

9. STORAGE AND RETENTION

Personal data will be stored in secure, controlled environments, whether physical or digital, for the period strictly necessary to fulfil the purposes stated, subject to:

• Legal and regulatory retention periods;
• The need for preservation in order to safeguard rights;
• The application of anonymisation techniques, where appropriate.

10. INFORMATION SECURITY

A3A Engenharia de Sistemas adopts technical, administrative and organisational measures aligned with market best practice, including:

• Access control and identity management;
• Data encryption, wherever applicable;
• Monitoring of security incidents;
• Cyber risk management;
• Governance of suppliers and third parties;
• Internal awareness and training.

11. RIGHTS OF DATA SUBJECTS

The data subject may, at any time, exercise the rights provided for in the LGPD, including:

• Confirmation that processing exists;
• Access to the data;
• Correction of incomplete or outdated data;
• Anonymisation, blocking or deletion;
• Portability;
• Withdrawal of consent.

Requests must be sent to:
[email protected]

12. CHANGES TO THIS POLICY

A3A Engenharia reserves the right to amend this Policy at any time in order to update, improve or bring it into regulatory compliance. Material changes will be duly communicated and, where required, fresh consent will be requested.

13. FINAL PROVISIONS

By using the channels, platforms and services of A3A Engenharia de Sistemas, the data subject declares that they are aware of and agree to the terms of this Policy.

This Policy takes effect on the date of its publication.