Data Classification and Protection Policy

1. Purpose

This Data Classification and Protection Policy establishes the guidelines adopted by Techaze to ensure the appropriate identification, classification and protection of the information under its responsibility, ensuring data confidentiality, integrity and availability.

2. Information Classification

Information is classified according to its level of sensitivity and the impact of unauthorized disclosure:

• Public: Information that may be disclosed without restrictions.
• Internal: Information for internal use, with access restricted to authorized employees.
• Confidential: Sensitive information, including personal and strategic data, with restricted and controlled access.
• Restricted: Critical information requiring enhanced security controls.

3. Data Protection

The company adopts appropriate technical and organizational measures to protect data, including:

• Encryption in transit: Use of TLS 1.2 or higher to protect data transmitted over the internet.
• Encryption at rest: Use of industry-recognized encryption standards, such as AES-128 or higher.
• Access control: Access granted based on the principle of least privilege.
• Monitoring and auditing: Logging and monitoring of access and relevant activities.
• Vulnerability management: Regular application of security updates and patches.

4. Compliance

The company complies with applicable data protection legislation, including the Brazilian General Data Protection Law (LGPD – Law No. 13,709/2018).

5. Policy Review

This policy is reviewed periodically to ensure it remains aligned with information security best practices and regulatory requirements.