Privacy Statement

Executive summary

This privacy statement explains how Cavok collects, uses and protects personal data in its systems. We value your privacy and that of your users, and we adopt strict measures to ensure information security. Our commitment is to transparency and respect for your rights, always in accordance with Brazil’s General Data Protection Law (LGPD).

CAVOK PRIME LTDA, a private legal entity registered under Brazilian company registration number (CNPJ/ME) 47.439.798/0001-36, with its registered office at Rua Taquari, No. 183, Unit 52, Alphaville Graciosa, Pinhais/PR, postal code 83327-070, referred to as CAVOK, offers services for comprehensive management of the various areas of aviation and the nautical sector through web-based systems and their ancillary or complementary applications, whether its own or those of third parties, provided free of charge or for a fee, whose right of use is granted to the client as defined in a specific proposal or terms of use, where applicable.

This Privacy Statement for Cavok Systems applies to all Cavok software and was developed to explain how and for what purposes Cavok processes data, including data relating to natural persons identified or identifiable through its systems. This document also specifies how Cavok processes data relating to legal entities associated with Cavok systems, unless the terms of an individual system expressly provide otherwise.

The expressions “Cavok”, “we”, “our” and “us” refer to Cavok as defined above.

1. Our relationship with the client and our respective responsibilities

Our Systems are tools that you, our Client, use to manage your operations, which may include processing personal data. Understand how responsibilities are divided under the LGPD:

• Your role as personal data controller: When you, the client, use our systems to enter and manage data about your users, employees, suppliers or service providers, you are the personal data controller. This means that you decide which data will be processed, for what purpose, how it will be used and how permissions to access it within the systems will be granted.
• Your main responsibilities include:
  • Ensuring that the processing of this personal data has a valid legal basis and complies with the LGPD.
  • Obtaining the necessary authorizations and consent from data subjects, where applicable.
  • Being transparent with your own users about how their data is processed and shared with us.
  • Defining and managing access for your own users within the system, establishing the correct privileges and protecting their sensitive data. Improper access configuration by the client may compromise the security of information under the client’s responsibility.
• Cavok’s role as personal data processor: When you, the client, engage us, you appoint Cavok as a personal data processor. This means that we process the data you enter into the system on your behalf and under your instructions, in accordance with the service agreement. Our role is to provide the technology and secure environment for you to manage your data, without Cavok accessing or using its content for its own purposes other than operating, supporting, maintaining and securing the System.
• Cavok as controller in specific cases: Cavok also acts as a personal data controller in relation to information we collect for our own legitimate purposes, such as:
  • Registration and contact data of our clients’ representatives, for contract management, billing and direct communication with us.
  • Data about our own employees for human resources management,
  • Browsing data on our websites to improve our services.

2. Personal data processed and purposes

Cavok processes personal data that we collect in various ways, always with a clear purpose and a legal basis under the LGPD.

• Registration data of client representatives:
  • Examples: Full Name, Job Title, Phone Number, Email, Address, Brazilian individual taxpayer number (CPF).
  • Why we process it: To formalize the service agreement, create your initial access to our systems, ensure security, prevent fraud, improve our services and comply with legal obligations.
  • Legal basis: Performance of our agreement with the client, legitimate interest in managing our business relationship or compliance with a legal requirement.
• Contact data of client representatives:
  • Examples: Name, Email, Phone Number, Content of messages exchanged.
  • Why we process it: To communicate with the client, respond to requests and, in some cases, send information about new services.
  • Legal basis: Performance of the agreement, legitimate interest in maintaining business communications, and we may request your consent to send marketing communications that are not essential to the agreement.
• Browsing data when using our systems:
  • Examples: IP address, browser type, functions accessed, interactions and cookie data.
  • Why we process it: To improve use of and experience with our systems, collect usage statistics, ensure proper operation, assist technical support and comply with legal requirements such as Brazil’s Civil Rights Framework for the Internet.
  • Legal basis (Examples): Legitimate interest in improving our services and compliance with legal access-log requirements. For non-essential cookies, where applicable, we request your consent.
• Payment data:
  • Examples: Information relating to the purchase and payment of our services.
  • Why we process it: Issuing tax documents, processing refunds, conducting audits, preventing fraud and complying with legal obligations.
  • Legal basis (Examples): Necessary to perform the service agreement, comply with legal obligations and protect our credit interests.
• Personal data stored by the client in the system:
  • Examples: Data about your users, employees, suppliers and others that you enter into our System.
  • Why Cavok processes it as a processor: We operate the system, provide technical support, maintain the platform and ensure the security of the environment where this data is processed, always in accordance with the agreement with the client.
  • Legal basis: The primary legal basis for processing this data is your responsibility as controller. Our authority to process it derives from our service agreement with the client.

3. What Cavok does not do with your data

To provide the client with complete confidence, we make clear what Cavok DOES NOT DO with the personal data it collects and processes:

• We do not sell or rent your personal data to third parties for marketing purposes.
• We do not use your Personal Data for discriminatory, unlawful or abusive purposes.
• We do not enrich Clients’ databases with information that is not strictly necessary to provide the contracted service.
• We do not access or use the content of the data the client enters into our systems for Cavok’s own purposes other than platform maintenance, support or security, and always in accordance with the agreement.

4. How we manage your consent

When we rely on your consent to process personal data, especially for marketing or non-essential cookies, we ensure a clear and transparent process:

• Clear Collection: We collect the client’s consent freely, on an informed and unambiguous basis, for example through checkboxes in digital forms or specific consent terms, always explaining the purpose.
• Secure Record: We maintain a secure record of consent that can be audited.
• Easy Withdrawal: You may withdraw your consent at any time, simply and free of charge, through the contact channels provided in this Statement. On withdrawal, we will stop processing the data for that purpose unless another legal basis allows us to continue.

5. How we protect your data

At Cavok, we implement robust measures to protect our clients against unauthorized access, alteration, disclosure or destruction.

• Internal security measures: We adopt advanced controls such as encryption, regular penetration testing and security measures in our logical environments. Our practices are continually reviewed to ensure their effectiveness.
• Advanced Cloud Infrastructure: Our server infrastructure is hosted entirely by an external, globally recognized cloud infrastructure provider. This provider meets strict technical requirements and international security certifications, such as ISO 27001, SOC 2, HIPAA and PCI DSS, and is responsible for the physical security of its data centers and managing physical access to the facilities. Its infrastructure provides redundancy, logical resource isolation, encryption at rest and in transit, and advanced threat monitoring, strengthening our own security. Although we are not aware of clients’ specific content in our environments, we apply protections to our control and management layer.
• Strict Access Control: Access to the Personal Data under our responsibility is strictly limited to those who genuinely need it, with employees and contractors formally committed to confidentiality.
• Use of Removable Media (USB Drives, External Hard Drives, etc.):
  • We minimize the use of removable media for corporate data; when needed, it requires approval and antivirus checks.
  • We do not allow connections to untrusted devices.
  • Media containing corporate data is securely disposed of, ensuring that the data cannot be recovered.
• Risk Management: We systematically identify and assess privacy and security risks. For each risk, we define and implement mitigation actions, documented in our asset, risk and action spreadsheet and continuously monitored as part of our ISO 27001:2022 implementation.
• Your Responsibilities: You, the client, are responsible for obtaining and maintaining your own equipment, internet connection and auxiliary services to use our systems. You are also solely and exclusively responsible for defining and managing access for your own users within the System and protecting the sensitive data managed in it. Improper access configuration on your part may compromise information security under your responsibility.

6. How we store and delete your data

Personal data from client environments may be stored on our servers or those of third parties, in Brazil or abroad, using cloud computing technologies.

• Storage period: We store Data for as long as necessary to fulfill the purpose for which it was collected, or while Cavok has a legitimate interest. We may retain data for longer periods to comply with legal, regulatory or tax obligations, or to exercise rights in judicial, administrative or arbitration proceedings.
• End of processing: Cavok’s processing of Personal Data ends when:
  • The data is no longer necessary for the stated purposes.
  • The client, as data subject, requests deletion and there is no other legal basis justifying retention.
  • There is an order from Brazil’s National Data Protection Authority (ANPD) or another competent authority.
• Data and environment deletion process (Purging): When processing ends or the service agreement with the client terminates, we carry out a secure and definitive process to purge information and environments, following an internal procedure. The steps include:
  • Final backup: We create and provide a final backup to the client for their own retention. After delivery, this copy is deleted from our logical environment.
  • Cloud Environment Purging: The client’s dedicated environment is permanently deleted through the cloud console. Management of physical infrastructure and disk sanitization is the responsibility of the cloud provider.
  • Residual Data Removal: Any residual data is securely removed.
  • Verification and Record: We confirm deletion and document the entire process for auditing.
  • Communication: We formally inform the Client that purging has been completed.

7. Personal data and partner companies

We may share clients’ personal data with third parties whenever necessary and within business limits, respecting the LGPD:

• Public authorities: To comply with legal obligations or court orders, or protect our rights and security.
• Service providers and partners: Companies that help us operate, such as cloud services or payment processors, which are contractually bound by our privacy guidelines.
• Whenever possible, we anonymize personal data to protect the client’s privacy.

8. What to do in the event of a security incident

Cavok is prepared to respond to security incidents, preventing and mitigating impacts caused by data loss, alteration or improper access.

• If the incident involves data the client manages in our systems, where we act as processors, we undertake to assist the client by providing the information necessary for investigation and mitigation. Primary responsibility for notifying the competent authorities (ANPD) and data subjects of the incident lies with the client.
• In all cases, Cavok’s communications will be handled by our data protection officer (DPO), who is the official point of contact on these occasions.

9. How we process data about legal entities

In addition to natural persons’ personal data, Cavok processes data relating to legal entities, such as system usage telemetry and data about relationships between their entities, clients and orders.

• Why we process it: We use this data to improve the quality, performance and security of our Systems, for statistical analysis, to develop and offer new products and services, for credit assessment and fraud prevention.
• Your Choice: You may choose to restrict Cavok’s use of this transactional and relational data by contacting us at dpo@cavok.in. This restriction does not affect the use of other types of data essential to the contracted service or for statistical purposes.

10. Changes to this data privacy statement

Cavok may change this Statement at any time due to new technologies, changes in legislation or security adjustments. Changes will always be available at our official link: www.cavokaviacao.com/politica-de-privacidade/ and will be communicated to clients through our systems or their contact details.

11. Your rights as a personal data subject

The client has rights over their personal data, and Cavok undertakes to address them clearly and efficiently in accordance with the LGPD. The client may exercise their rights by contacting our DPO:

• Confirmation and access: Find out whether we process your data and access it.
• Correction: Request correction of incomplete, inaccurate or outdated data, except data controlled by the client, which is the client’s exclusive responsibility.
• Anonymization, blocking or deletion: Request anonymization, blocking or deletion of your data if it is unnecessary, excessive or processed in violation of the LGPD, respecting legal grounds for retention.
• Portability: Request transfer of your data to another service provider through viable and secure electronic means.
• Sharing information: Find out which public or private entities we share your data with.
• Consent information: Be informed about the possibility of withholding consent and the consequences of that choice.
• Withdrawal of consent: Withdraw your consent to processing at any time, which may affect the continuity of some services.
• Objection and deletion: Object to the processing of your data or request its deletion, where applicable.

Cavok undertakes to address all requests as quickly as possible and in accordance with ANPD deadlines.

Important for clients acting as controllers: If you are a client using our systems and the personal data concerned belongs to your own employees, clients or suppliers, for which you are the controller, you are responsible for responding directly to those data subjects. In such cases, data subjects must contact you, the client, directly to exercise their rights.

12. Contact

For questions or concerns about this privacy statement, or to submit a request, complaint, information request or exercise personal data subject rights under the terms provided here and in the LGPD, access Cavok’s privacy portal: https://www.cavokaviacao.com/politica-de-privacidade/

13. Approvals

Prepared by:

• Jonas Edinardo de Sousa – Data Protection Officer (DPO).

Reviewed by

• Rodrigo Zapulla – Information Technology Manager

Approved by

• Jonas Edinardo de Sousa – General Director

Change log

List of changes made to this document.