Privacy Policy — Arrivo Apps

Effective from November 4, 2026

This policy explains which personal data the Arrivo Client and Arrivo Tech apps collect, why, for how long, and what your rights are.

1. Who we are and who this policy applies to

This policy applies to the Arrivo Client and Arrivo Tech apps (the “Apps”), offered by the INconnet group: INconnet Global LLC (USA), INconnet Serviços e Soluções em TI e Telecomunicações Ltda, CNPJ 16.575.266/0001-00 (Brazil), and the other group companies (“INconnet”, “we” or “us”). It complements the Arrivo Apps Terms of Use and does not apply to the INconnet websites, which have their own policy.

Who uses the Apps:

• Arrivo Client: employees of INconnet client companies, authorized by their own company.

• Arrivo Tech: technicians, employees and partners accredited by INconnet.

Who decides about the data (roles under the LGPD and the GDPR):

When the client company is the controller, requests about your data can be sent to it or to INconnet, which will forward them and support the response.

2. Data Protection Officer (DPO) and contact channel

• Data Protection Officer (DPO): [email protected]

• Channel for data subject requests: [email protected], with a reply within 15 days (the LGPD deadline for a full statement), or sooner when local law requires.

3. Data we collect and why

The Apps collect only what is needed to open, carry out and document IT support requests. Nothing is sold or used for advertising.

We do not collect: contacts, calendar, SMS, browsing history, advertising ID, health data, biometrics (fingerprint or face unlock is handled by the device itself and INconnet never receives the biometric data) or financial data.

4. Location

Arrivo Tech (technicians)

1. Location collection only starts when the technician taps “On the way” on a ticket assigned to them.

2. While it is active, a persistent notification is visible on the device.

3. The position is sent in real time and shown only to the client of that ticket and to the INconnet service desk.

4. Collection stops when the technician taps “Arrived” or cancels the trip.

5. The app does not collect location in the background outside the trip, during breaks or outside working hours.

6. Location is not used for disciplinary evaluation based solely on the route.

Arrivo Client (clients)

• Location is optional and is used only to suggest the service address.

• It is not shared with third parties or kept beyond the address entered on the ticket.

• The client sees the technician’s position only while the technician is on the way to their ticket.

Location permission can be denied or revoked at any time in the device settings.

5. Device permissions

Notifications show only generic notices (for example, “Your ticket was updated”) and do not display ticket content.

6. Who we share data with

We do not sell personal data or share it for advertising. Sharing happens only in the cases below.

Within the service:

• the technician sees the name, contact phone, address and description of the ticket they are handling;

• the client sees the technician’s name, profile photo, average rating and length of service, and their position while on the way;

• client company managers see the tickets and reports of the company and its branches.

Service providers (processors/sub-processors), hired under confidentiality and data protection obligations:

The ticketing system and the Apps’ servers are operated by INconnet itself.

Other cases: compliance with the law, a court order or a request from a competent authority; defense of INconnet’s rights in legal proceedings; and corporate transactions (merger, acquisition), with the same protections maintained.

7. International transfers

Data may be processed in Brazil, in the United States (home of INconnet Global LLC) and in the countries where the providers in section 6 are located. Each transfer uses the mechanism required at the origin:

• Brazil: ANPD standard contractual clauses (Resolution CD/ANPD 19/2024) or another basis under art. 33 of the LGPD, such as performance of a contract with the data subject;

• European Union/EEA: European Commission Standard Contractual Clauses or the EU-US Data Privacy Framework, when the recipient is certified;

• United Kingdom and Switzerland: IDTA, the UK Addendum or an instrument recognized by Switzerland;

• other countries: the mechanism of local law, such as a transfer impact assessment (Vietnam), a standard contract (China) or conditions set by the Indian government.

Where local law requires certain data to stay in the country, INconnet only enables the Apps after a prior assessment. A copy of the safeguards can be requested through the channel in section 2.

8. Security

• All communication between the Apps and the servers uses an encrypted connection (HTTPS/TLS).

• In Arrivo Tech, the schedule, the day’s details and the checklist are stored encrypted on the device for offline use, and are deleted when signing out or when access is revoked.

• The Apps can be protected by the device’s biometrics or passcode.

• Internal access to data is restricted to those who need it for the service, with profile-based controls.

• INconnet’s processes follow the good practices of ISO/IEC 27001 and 20000.

In the event of a security incident with relevant risk or harm, we will notify the authorities and the affected data subjects within the legal deadlines (for example, 3 business days for the ANPD and 72 hours for European authorities).

9. How long we keep data

The periods below are the standard and may be adjusted by the contract with each client company.

How to request deletion. Send an email to [email protected] with the subject “Data deletion — Arrivo”, stating your name, the email used in the app and the company (for clients). We confirm your identity and reply within 15 days. We will delete the account and the personal data that do not need to be kept by law or contract; the client company’s service records are kept for the period above, with personal data anonymized whenever possible.

10. Your rights

You can exercise the rights below through the channel in section 2. For your security, we may ask you to confirm your identity. The service is free of charge.

Technicians and client employees have the same rights. When the client company is the controller (section 1), some requests may depend on it, and INconnet will help with the response.

11. Children, automated decisions and advertising

• Children and teenagers: the Apps are intended for people aged 18 or over and do not knowingly collect data from minors. If that happens, the data will be deleted.

• Automated decisions: the Apps do not make decisions with legal or similarly significant effects based solely on automated processing. Route order and average ratings are informational; decisions about technicians are made by people.

• Advertising and tracking: the Apps do not show ads, do not use the device’s advertising ID and do not track users across other apps or websites.

12. Changes and contact

We may update this policy. The current version is published on this page, with the date of the last update. Relevant changes will be announced in the Apps or by email before they take effect. If versions in different languages differ, the Portuguese version prevails, unless local law requires otherwise.

Contact: [email protected] · +55 11 4114-9454 · inconnet.global

Last updated: November 4, 2026