Information Security
and LGPD

Purpose of this policy

This Security & LGPD Policy presents the general guidelines adopted by Alis Tecnologia e Serviços Aeronáuticos LTDA for data protection, information security governance and the processing of personal data in compliance with applicable law.

This document complements the Privacy Policy, the Terms and Conditions and the specific contracts signed with customers.

LGPD and processing roles

The LGPD (Brazilian General Data Protection Law, Lei 13.709/2018) establishes rules for the processing of personal data and defines roles such as controller and processor. As a rule, for data entered by customers within the contracted modules, the customer tends to define the purposes and main decisions of the processing, acting as the controller; Alis acts as the processor when handling that data under contractual instructions.

In certain situations, Alis may act as the controller of its own data, such as commercial, administrative, customer service, billing, marketing and security data, user management and service improvement.

Data protection principles

Alis seeks to guide its processing activities by the principles of purpose, adequacy, necessity, transparency, security, prevention, accountability, data quality, free access and non-discrimination.

In practice, this means processing data for clear purposes, limiting access to what is necessary, preserving traceability, guiding users and adopting measures commensurate with the risks involved in digital operations.

Applicable security measures

Security measures may vary according to module, environment, contract, integrations and level of criticality. In general, Alis seeks to adopt practices such as:

• use of secure connections where applicable;
• backup and operational continuity according to the service architecture;
• monitoring of failures, technical events and attempts at improper access;
• review and updating of systems, libraries, permissions and internal processes;
• guidance for staff, customers and users on safe use of the platform.

Customer responsibilities

Platform security also depends on the practices of the customer and its users. It is up to the customer to:

• correctly define administrators, users, permissions and access profiles;
• revoke access for employees, contractors or users who should no longer access the system;
• maintain strong passwords, protected devices and secure email accounts;
• train users on confidentiality, data protection, operational records and responsible use of the platform;
• ensure an appropriate legal basis and purpose for the data entered;
• immediately report suspected improper access, loss of credentials or a security incident.

Security incidents

In the event of a security incident involving personal data, Alis will carry out an internal analysis to assess the nature, extent, impact, risks to data subjects, containment measures and the need for notification to the customer, data subjects or competent authorities, according to Alis's role in the processing and applicable law.

When Alis acts as processor, notification to the controller will be prioritized so that the controller can assess its obligations to notify data subjects and the competent authority, without prejudice to specific contractual obligations.

Sub-processors and vendors

Alis may use technology, infrastructure, communication, storage, database, support, analytics, email, automation, payment and other vendors necessary for the operation of the platform.

The engagement of vendors seeks to consider criteria of security, reliability, purpose, necessity and suitability for the service provided. Processing by third parties must take place in accordance with the applicable instructions, contracts, policies and requirements.

Aviation, operational and sensitive data

The platform may store operational and technical data relevant to aviation management, including flight, maintenance, training, SMS (SGSO), scheduling and rostering records and associated documents. Some of these records may contain personal data, professional data or business information that is sensitive for the customer.

The customer must assess which information is necessary and appropriate to enter into the platform, avoiding excessive data or data incompatible with the contracted purpose.

AI, automations and decisions

AI features, automations, risk analyses, summaries and recommendations are used as operational support and must not be treated as an autonomous or final decision, nor as a substitute for professional judgment.

Whenever automatically generated information is relevant to operational, technical, maintenance, safety or training decisions, the user must review, validate and supplement the analysis with official sources and professional judgment.

Exercising rights and contact

Data subjects may exercise the rights provided for in the LGPD through Alis's official channels or with the customer acting as controller, depending on the origin and purpose of the processing.

Requests relating to data administered by customers may depend on validation by the respective controller, especially when Alis acts as processor.

Continuous improvement

Alis may review this Security & LGPD Policy to reflect product evolution, new modules, legal changes, regulatory requirements, process improvements, adoption of new technologies or changes in the platform architecture.