Privacy Policy

1. Identification of the responsible company

Alliance Consultoria may act, depending on the context and the contract signed with the client, as a personal data processor, when processing data on behalf of the contracting client, or as a controller, when it determines the purposes and means of processing data related to commercial, administrative and contractual management, support, security and user relationships. The ANPD recognizes the distinction between controller, processor and data protection officer in its guidance materials on processing agents.

2. Application of this Notice

This Notice applies to the processing of personal data carried out in the context of TaxSphere, including:

1. access to and use of the solution by authorized users;
2. integration of the solution with the client's corporate environments, systems and databases;
3. authentication, access control and profile management;
4. execution of tax routines, reconciliations, assessments, reports and automated processes;
5. provision of technical support, maintenance, monitoring, continuous improvement and security of the solution;
6. administrative, technical, operational and commercial communications related to the solution.

This Notice does not replace the contract signed between Alliance Consultoria and the contracting client. In the event of a conflict between this Notice and the specific contract, the contractually agreed conditions will prevail, subject to applicable legislation.

3. About TaxSphere

TaxSphere is a tax solution integrated with SAP environments through the SAP Business Technology Platform (SAP BTP), designed to support processes related to the assessment, reconciliation, control, automation and tax management of IBS, CBS and other information related to the contracting company's tax operation.

The solution may include features such as:

1. integration with SAP solutions and corporate systems;
2. extraction, receipt, organization and processing of tax data;
3. calculation, assessment, reconciliation and credit control;
4. identification of discrepancies between internal data and information from government platforms;
5. generation of reports, dashboards and tax evidence;
6. identification of tax triggers for the issuance of debit or credit notes;
7. integration with issuance processes through the Nota Fiscal Writer, where applicable;
8. recording of logs, audit trails and usage events.

4. Personal data that may be processed

TaxSphere is a solution primarily focused on processing tax, accounting, financial, transactional and business data. However, depending on the configuration of the client's environment and the information integrated into the solution, certain personal data may be processed.

The personal data processed may include:

1. user identification data: name, work email, login, user identifier, company, area, role and access profile;
2. authentication and security data: access records, authentication logs, IP address, date and time of access, device, browser, session events and access attempts;
3. operational and usage data: features accessed, activities performed, change records, approvals, queries, exports, filters used and audit trails;
4. data present in tax documents or business transactions: names, CPFs, CNPJs, addresses, tax registrations, data of suppliers, customers, carriers, representatives, internal responsible parties, commercial contacts or other data that may appear in tax documents, registrations or integrated transactions;
5. support data: name, email, phone, role, company, description of incidents, evidence, screenshots, technical logs, attachments and information provided during support;
6. contractual and administrative data: contacts of those responsible for the contract, billing, governance, technical management, tax management, project management and commercial relationship.

TaxSphere is not intended to process sensitive personal data. Should sensitive data be inserted, integrated or shared by the client improperly or exceptionally, processing will be limited to what is necessary to perform the contracted activity or to adopt the appropriate technical and legal measures.

5. Purposes of processing

Personal data may be processed for the following purposes:

1. to allow secure access to the solution by authorized users;
2. to authenticate users and apply access control rules;
3. to enable integration between TaxSphere, SAP solutions, corporate systems and authorized external platforms;
4. to execute tax processes, assessments, reconciliations, controls, validations and automations provided in the solution;
5. to generate reports, dashboards, evidence, audit trails and management information;
6. to identify inconsistencies, discrepancies, exceptions or relevant tax events;
7. to support automated tax document issuance processes, where applicable;
8. to provide technical support, maintenance, sustainment and continuous improvement of the solution;
9. to monitor the performance, availability, security and integrity of the application;
10. to prevent fraud, improper access, security incidents and inappropriate use of the solution;
11. to comply with legal, regulatory, tax, accounting and contractual obligations;
12. to manage the commercial, contractual and administrative relationship with the client;
13. to handle requests from data subjects, clients, competent authorities or applicable legal obligations.

6. Legal bases for processing

Depending on the context, personal data may be processed on the basis of the following legal bases set out in the LGPD:

1. performance of a contract or preliminary procedures related to a contract, to provide, operate, maintain and support the solution;
2. compliance with a legal or regulatory obligation, especially due to the tax, fiscal, accounting and regulatory nature of the information processed;
3. the regular exercise of rights, including in administrative, judicial or arbitration proceedings;
4. legitimate interest, for security, fraud prevention, improvement of the solution, support, governance, audit, client relationships and protection of operations;
5. consent, where applicable and required for specific situations.

When Alliance acts as a processor, the legal bases applicable to the processing carried out in the client's environment will be defined by the contracting client itself, in its capacity as data controller.

7. Role of Alliance and of the contracting client

In the operation of TaxSphere, the definition of the controller and processor roles will depend on the context of the processing:

1. Contracting client as controller: as a rule, the contracting client will be the controller of the personal data contained in its systems, tax documents, SAP databases, master data, transactions, tax information and business records integrated into TaxSphere.
2. Alliance as processor: Alliance will act as a processor when processing personal data on behalf of the contracting client, in accordance with the contractual, technical and operational instructions received.
3. Alliance as controller: Alliance may act as a controller with respect to the data used for user management, administration of the solution, security, support, billing, commercial relationships, fulfillment of its own obligations and improvement of its services.
4. Joint controllership: in specific situations, there may be joint controllership, where Alliance and the client jointly determine certain purposes and means of processing. Where applicable, responsibilities will be defined in a contract or supplementary document.

8. Integration with SAP environments and SAP BTP

TaxSphere uses an architecture based on SAP BTP to enable integration, authentication, connectivity and communication with SAP solutions and systems authorized by the client.

Depending on the contracted architecture and the technical configuration, the solution may use resources such as:

1. integrated authentication;
2. identity and authorization management;
3. APIs and integration services;
4. connectors and secure communication mechanisms;
5. storage, processing and monitoring services;
6. technical logs, event records and audit trails;
7. encryption mechanisms, environment segregation and access control.

Integration with the client's environment will be carried out in accordance with the technical parameters, permissions, access profiles, security policies and responsibilities agreed between the parties.

9. Sharing of personal data

Alliance may share personal data only when necessary for the execution of the solution, compliance with legal obligations or fulfillment of the legitimate purposes described in this Notice.

Sharing may occur with:

1. companies of the economic group or technical partners involved in providing the services;
2. providers of infrastructure, hosting, security, connectivity, monitoring, support and technology;
3. SAP, when necessary due to the use of SAP BTP, integrations, associated services or technical support;
4. professional service providers, such as consultants, auditors, lawyers and advisors, when necessary;
5. tax, regulatory, administrative or judicial authorities, when there is a legal obligation, valid order or legitimate request;
6. the contracting client and the users authorized by it.

Alliance does not sell personal data and does not share data for purposes incompatible with the provision of the solution.

10. International data transfer

Depending on the services used, the contracted infrastructure, the location of the data centers, the providers involved and the technical architecture defined, personal data may be processed or stored outside Brazil.

When there is an international transfer of data, Alliance will adopt measures compatible with the LGPD, including contractual safeguards, security controls, protection mechanisms and assessment of the providers involved.

11. Information security

Alliance adopts technical, administrative and organizational measures intended to protect personal data against unauthorized access, loss, alteration, destruction, improper disclosure or any form of inappropriate processing.

These measures may include:

1. access control based on profiles and need-to-use;
2. integrated authentication and authorization mechanisms;
3. encryption in transit and, where applicable, at rest;
4. logical segregation of environments and clients;
5. logging and audit trails;
6. monitoring of availability, events and security;
7. vulnerability management and security updates;
8. backups and recovery routines, where applicable;
9. contractual confidentiality with employees, partners and suppliers;
10. internal security, privacy and acceptable-use policies;
11. restriction of access to production data, according to technical need and contractual rules.

The security measures adopted by Alliance seek to observe market best practices and the guidance of the National Data Protection Authority (ANPD), which provides guidance materials on information security and data protection.

12. Security incidents

If a security incident is identified that may result in relevant risk or harm to data subjects, Alliance will adopt the appropriate measures for containment, investigation, mitigation, documentation and communication, in accordance with applicable legislation and the responsibilities assumed in the contract.

When Alliance acts as a processor, it will notify the controller client in accordance with the applicable contractual deadlines and procedures, so that the client can assess the necessary measures before data subjects and competent authorities.

13. Data retention and disposal

Personal data will be kept for the period necessary to fulfill the purposes described in this Notice, perform the contract, meet legal, tax, accounting, regulatory, audit, information security obligations and the regular exercise of rights.

Retention periods may vary according to:

1. the nature of the data;
2. the purpose of the processing;
3. applicable legal or regulatory obligations;
4. tax, fiscal, accounting and corporate requirements;
5. statute-of-limitations periods;
6. instructions from the contracting client, when Alliance acts as a processor;
7. internal and contractual retention policies.

At the end of the contractual relationship, the data may be deleted, anonymized, returned to the client or retained for the legally necessary period, as provided in the contract and in applicable legislation.

14. Data subjects' rights

Under the LGPD, data subjects may request, where applicable:

1. confirmation of the existence of processing;
2. access to the data;
3. correction of incomplete, inaccurate or outdated data;
4. anonymization, blocking or deletion of unnecessary, excessive data or data processed in non-compliance;
5. data portability, subject to the applicable regulation;
6. information on the sharing of data;
7. information on the possibility of not providing consent and the consequences of refusal;
8. withdrawal of consent, when processing is based on that basis;
9. review of decisions taken solely on the basis of automated processing, where applicable.

When Alliance acts as a processor, data subject requests related to the contracting client's data must be directed to the controller client itself. If Alliance receives such a request directly, it may forward it to the responsible client or instruct the data subject to contact them.

15. Automated decisions

TaxSphere may perform automated processing to identify inconsistencies, tax triggers, discrepancies, events, calculation rules, classifications, statuses, alerts and operational recommendations.

This processing has a tax, operational and management-support purpose, and is not intended to produce legal effects directly on data subjects without appropriate validation or governance by the contracting client.

Should any future feature involve automated decisions with relevant effects on data subjects, Alliance will adopt the transparency and rights-fulfillment mechanisms provided in the LGPD, as applicable.

16. Data of children and adolescents

TaxSphere is not directed at children or adolescents and is not intended to process personal data of this audience.

Should data of children or adolescents be included in tax documents, registrations, records or databases integrated by the client, processing will occur incidentally and limited to the applicable contractual, legal, tax or regulatory purposes, under the responsibility of the controller client.

17. Cookies and similar technologies

Where applicable, TaxSphere may use cookies, session identifiers or similar technologies to:

1. enable authentication and maintenance of the user session;
2. ensure access security;
3. record technical preferences;
4. improve performance and usability;
5. generate operational metrics and usage logs;
6. prevent improper access and fraud.

Cookies strictly necessary for the operation of the solution may be used regardless of consent, in accordance with applicable legislation. Other cookies or technologies with analytical, functional or similar purposes may be configured according to the architecture of the solution and the applicable policies.

18. Responsibilities of the contracting client

The contracting client is responsible for:

1. ensuring that it has an adequate legal basis for the data integrated, sent or made available to TaxSphere;
2. informing data subjects, when necessary, about the processing carried out in its environments and processes;
3. configuring the profiles, accesses and permissions of authorized users;
4. maintaining the quality, accuracy and updating of the data sent to the solution;
5. avoiding sending unnecessary, excessive personal data or data incompatible with the contracted purpose;
6. complying with its own legal, regulatory, tax and data protection obligations;
7. notifying Alliance of requests, restrictions, incidents or specific requirements that may impact the operation of the solution;
8. carrying out internal governance over the use, export, sharing and validation of the information generated by the solution.

19. Responsibilities of Alliance

Alliance is responsible for:

1. processing personal data in accordance with this Notice, the contract signed with the client and applicable legislation;
2. adopting reasonable security measures to protect the processed data;
3. limiting access to the data to professionals, partners and suppliers who need that information to perform the services;
4. instructing employees and authorized third parties on confidentiality and data protection;
5. supporting the contracting client, where applicable, in meeting obligations related to data protection;
6. communicating security incidents in accordance with contractual and legal responsibilities;
7. keeping reasonable records and evidence of relevant processing, security and support activities, where applicable;
8. reviewing and updating this Notice when necessary.

20. Use of production environments

Alliance adopts as good practice the restriction of direct access to clients' production environments. When access is indispensable for diagnosis, support, maintenance or operation of the solution, it must observe:

1. prior authorization from the client;
2. profiles compatible with the purpose of the access;
3. preference for read-only access, when sufficient;
4. logging and recording of evidence;
5. temporal and functional limitation of access;
6. the client's security and governance policies;
7. specific contractual rules.

21. Confidentiality

Alliance will keep confidential the technical, tax, accounting, commercial, strategic, operational and personal information accessed by reason of providing the services, except when sharing is necessary for contractual performance, compliance with a legal obligation, the regular exercise of rights or with the client's authorization.

The confidentiality obligations will remain valid even after the end of the contractual relationship, as provided in the contract and in applicable legislation.

22. Sub-processors and suppliers

Alliance may engage suppliers, technical partners or sub-processors to support the provision, hosting, integration, support, monitoring, security or maintenance of TaxSphere.

Whenever applicable, these third parties will be subject to contractual obligations of confidentiality, information security and data protection compatible with the nature of the services provided.

23. Changes to this Notice

This Notice may be updated periodically to reflect legal, regulatory, technical, operational or commercial changes or evolutions of the solution.

The current version will be made available on Alliance's official channels or in the environment designated for publishing TaxSphere. Relevant changes may be communicated to contracting clients through the available relationship channels.

24. Contact channel

Questions, requests or communications related to privacy and personal data protection may be sent to:

Email: suporte@allianceconsultoria.com.br

Privacy channel: suporte@allianceconsultoria.com.br

Data Protection Officer/DPO: [insert name or responsible area, if applicable]

Address: [insert full address]

When the request involves data processed on behalf of a contracting client, Alliance may direct the request to the respective controller or request additional information for proper validation and forwarding.

25. Jurisdiction and applicable law

This Notice will be governed by the laws of the Federative Republic of Brazil, especially by the Brazilian General Data Protection Law — Law No. 13,709/2018.

Any disputes related to this Notice will be resolved in accordance with the jurisdiction and conditions provided in the contract signed between Alliance Consultoria and the contracting client. In the absence of a specific contractual provision, the competent jurisdiction will be observed in accordance with applicable legislation.