Privacy Policy — Salus

Effective from November 4, 2026. Last updated: November 4, 2026.

This Policy complements the Salus Terms of Use.

1. Who we are and who this Policy applies to

This Policy describes how INconnet (INconnet Serviços e Soluções em TI e Telecomunicações Ltda, CNPJ 16.575.266/0001-00, headquartered at Av. Nova Cantareira, 2014, 10º andar, cj. 103/104, Tucuruvi, São Paulo/SP, CEP 02330-003, Brazil) and the other group companies (INconnet Global LLC, in the USA, and INconnet in Paraguay) process personal data on the Salus platform.

It applies to users of the operations console (INconnet staff), users of the client portal (authorized contacts of client companies) and the data of managed devices and the people associated with them.

Roles. When INconnet processes data by its own decision (for example, access accounts and Platform security), it acts as controller. When it processes data of the client company’s employees and devices to provide the service, it acts as operator (LGPD) or processor (GDPR), and the client company is the controller.

2. Data we process

Account and access data:

• name, email and user identifiers for the console and the portal;

• authentication (including MFA) and session logs.

Managed device data:

• inventory (device name, operating system, hardware, installed software, network identifiers and IP);

• performance and availability telemetry (CPU, memory, disk, network, uptime);

• security posture (pending updates, hardening, antivirus/EDR status, vulnerability findings, security and maturity scores);

• the user account signed in to the device and security-relevant event logs.

Operations and support data:

• logs of remote access sessions and support actions;

• credentials stored in the vault (encrypted), used to operate the client’s systems;

• the audit trail of actions taken on the Platform.

Salus is not intended to collect sensitive personal data. If such data exists in client files or systems accessed during support, it is processed only to the extent needed for the service and under a duty of confidentiality.

3. What we use the data for (purposes)

• to provide, operate and document the contracted IT services;

• to manage access, security and compliance of the devices and of the Platform itself;

• to produce reports, metrics and support history for the client company;

• to detect, investigate and respond to security incidents;

• to meet legal, contractual and audit obligations.

We do not sell personal data or use it for advertising. Platform notifications do not show sensitive ticket content.

4. Legal bases

We process personal data on the basis of (LGPD arts. 7 and 11; GDPR art. 6):

• performance of a contract and of preliminary procedures at the request of the data subject/client company;

• compliance with a legal or regulatory obligation;

• legitimate interest in information security, fraud prevention and service delivery, always balanced against the data subject’s rights;

• consent, when required by law for a given purpose.

5. Who we share data with

• INconnet group companies (Brazil, USA and Paraguay), to operate the service;

• Sub-processors and providers needed for the service — cloud, authentication (for example, Microsoft/Entra), EDR and the ticketing system;

• Competent authorities, when required by law or for the regular exercise of rights.

The current list of sub-processors and destination countries can be requested at [email protected]. We do not share data with third parties for their own purposes.

6. International data transfers

Data may be processed in Brazil, in the United States (INconnet Global LLC) and by providers located in other countries. Every international transfer uses a valid mechanism at the origin:

• Brazil: ANPD standard contractual clauses (Resolution CD/ANPD 19/2024), performance of a contract or another basis under art. 33 of the LGPD;

• EU/EEA: European Commission Standard Contractual Clauses or an adequacy decision (including the EU-US Data Privacy Framework, when the recipient is certified);

• United Kingdom and Switzerland: IDTA, the UK Addendum to the Standard Clauses or an instrument recognized by Switzerland;

• other countries: the mechanism required by local law.

7. How long we keep data (retention)

• Account and access data: for as long as the user’s access lasts and for the period needed after it ends, in line with legal and contractual obligations.

• Device, security and report data: for the term of the contract and for the period required for audit, security and evidence purposes.

• Audit trail and remote access logs: for the retention period defined in the policy and in the applicable obligations.

When the period ends, the data is deleted or anonymized, unless the law requires it to be kept longer.

8. Information security

INconnet adopts technical and organizational measures to protect data, including: encryption in transit, two-factor authentication, permission-based access control, an encrypted credential vault, an audit trail and processes aligned with ISO standards (27001, 20000, 9001, 22301, 45001). No system is completely immune to risk; that is why we maintain monitoring and incident response (section 11).

9. Data subject rights

Under the LGPD, the GDPR and local laws, data subjects may request, among others: confirmation of processing; access to the data; correction of incomplete or outdated data; anonymization, blocking or deletion of unnecessary data; portability; information about sharing; and withdrawal of consent, when that is the basis used.

How to exercise them. Requests can be made at [email protected]. When the data is processed on behalf of a client company (as processor), we will forward the request to the controller or handle it according to its instructions. We may ask for information to confirm the requester’s identity.

10. Cookies and session data

The Salus portal and console use only cookies and local storage that are strictly necessary for them to work — authentication, keeping the session and preferences such as language. We do not use advertising cookies or third-party tracking cookies for marketing purposes.

11. Security incidents

If there is an incident that may cause relevant risk or harm to data subjects, INconnet:

• contains the incident and investigates the cause;

• notifies the competent authorities within each law’s deadline (for example, 3 business days for the ANPD, under Resolution CD/ANPD 15/2024, and 72 hours for European authorities, under the GDPR);

• informs the affected data subjects and client companies, with guidance on what to do;

• records the incident and the measures taken.

12. Data Protection Officer (DPO) and contact

Data Protection Officer (DPO): [email protected]. General privacy contact: [email protected] — INconnet, Av. Nova Cantareira, 2014, 10º andar, cj. 103/104, Tucuruvi, São Paulo/SP, CEP 02330-003, Brazil.

13. Global coverage and laws by region

This Policy observes the LGPD (the law of the headquarters) and, when applicable and more protective, the law of the user’s country, including the GDPR in the EU/EEA and the United Kingdom and equivalent local laws. If the law of the user’s country guarantees a right not provided here, that right prevails.

14. Changes to this Policy

We may update this Policy. The current version is published on the INconnet websites, with the date of the last update. Relevant changes will be announced in Salus or by email at least 30 days in advance, unless they result from law or security.