Privacy Policy

• Our systems are contracted by companies. There is no public sign-up: access is granted only after a contract is signed.
• The data your company enters in the ERP belongs to your company. We process it only to provide the contracted service and according to your instructions.
• We don't sell data, use client information for advertising or build user profiles.
• We use encryption, role-based access control, isolation between clients and backups to protect your information.
• Privacy questions and requests: contato@brunsolutions.com.br.

R BRUN DESENVOLVIMENTO DE SISTEMAS LTDA, trading as Brun Solutions (“Brun Solutions”, “we”), develops and licenses a modular ERP, custom systems, apps, web portals and cloud solutions for businesses.

Brazil's General Data Protection Law (Law No. 13,709/2018 — LGPD) assigns different roles depending on the situation:

• Controller: we are the controller of data about visitors to our website, people who contact us, and our clients' representatives in the commercial and contractual relationship.
• Processor: when your company uses the ERP or a system we host, your company is the controller of the data it enters there (customers, suppliers, employees, transactions, etc.) and we are the processor, handling that data on its behalf, according to its instructions and the contract.

Our free consumer apps, such as Brun Stickers and Anotações, have their own privacy policies, available on their websites.

The ERP and the systems we host are not open to the public and do not allow self sign-up. To get access, a company contacts our team, receives a proposal and signs a license or services agreement.

User accounts are then created by us or by an administrator appointed by the client, who also sets each user's permissions and can suspend or remove access at any time.

If you received access and don't recognize the company that created it, or you'd like to hire the service, write to contato@brunsolutions.com.br.

Website visitors:

• Technical access logs generated by the server and hosting provider, such as IP address, date and time, page visited, browser and operating system.
• The website has no sign-up forms and uses no advertising cookies or third-party tracking tools. Your theme preference (light or dark) is stored only in your browser.

Business contacts and clients:

• Name, email, phone number, job title and company of people who contact us, plus the content of their messages.
• Details of the client company and its representatives: legal name, tax ID (CNPJ), address, names, individual tax IDs (CPF) and contact details of the people in charge, and billing data.

ERP and system users:

• Account data: name, work email, job title or role, access profile and permissions.
• Credentials: passwords are stored only as irreversible hashes; we never have access to plain-text passwords.
• Usage and security logs: access dates and times, IP address, device and browser, and relevant actions taken in the system (audit trails).

Data entered by the client company:

• Information your company records in the ERP or system, such as customer and supplier records, financial and tax data, orders, inventory, production and, when the HR module is used, employee data.
• Some modules may involve sensitive personal data (for example, medical certificates in HR). In those cases the client, as controller, defines the legal basis and purpose; we apply the same security and confidentiality measures.

We process personal data only for legitimate, specific and disclosed purposes, based on article 7 of the LGPD:

• Answering inquiries, preparing proposals and negotiating contracts — pre-contractual steps and performance of a contract.
• Creating and managing accounts, providing the service, support, training the client's team and evolving the contracted modules — performance of a contract.
• Issuing invoices, billing and meeting accounting, tax and regulatory obligations — compliance with a legal obligation.
• Keeping application access logs for the period required by Brazil's Internet Civil Framework (Law No. 12,965/2014) — compliance with a legal obligation.
• Protecting our systems, preventing fraud and unauthorized access, investigating incidents and keeping the service stable and fast — legitimate interest and credit protection, where applicable.
• Defending our rights in judicial, administrative or arbitration proceedings — regular exercise of rights.

Data entered by the client company is processed solely to perform the contracted service. We don't use it for our own purposes, such as marketing, selling to third parties or profiling.

We know an ERP concentrates strategic information: revenue, margins, customers, suppliers and employees. That's why:

• Each client's data is logically isolated from every other client's data.
• Our team accesses a client's environment only when needed for support, maintenance, bug fixes, incident response or at the client's request, limited to the minimum necessary.
• Everyone with access is bound by confidentiality obligations.
• Specific confidentiality terms, service levels and data processing conditions can be set out in the contract or in a data processing agreement (DPA) with the client.

We don't sell or rent personal data. We share data only when necessary, with:

• Infrastructure and service providers (sub-processors), such as cloud, storage, backup, transactional email and monitoring providers, under security and confidentiality obligations.
• Integrations enabled by the client, such as banks, tax authorities, marketplaces, payment providers and other systems — in those cases data is sent at the client's direction and under its responsibility.
• Brun Solutions' own accounting, legal and collection service providers, as far as necessary.
• Public authorities, when required by law, court order or a request from a competent authority.
• In a corporate reorganization, merger or acquisition, data may be transferred to the successor, which will be bound by the same obligations.

Some of our cloud providers may store or process data on servers outside Brazil. When that happens, we rely on the mechanisms set out in article 33 of the LGPD and in the regulations of Brazil's National Data Protection Authority (ANPD), such as standard contractual clauses, and choose providers with recognized security standards.

If your company needs data to stay in a specific region, this can be addressed in the contract.

We take technical and organizational measures suited to the nature of the data, including:

• Encryption in transit (HTTPS/TLS) and encryption of stored data.
• Role-based access control and permissions, following the principle of least privilege.
• Hashed passwords and support for additional authentication methods where available in the contracted system.
• Audit logs, monitoring and security alerts.
• Regular backups with restore testing.
• Security updates and ongoing review of code and infrastructure.

No system is completely free of risk, but we work continuously to reduce it. Security also depends on the client: keep passwords private, review user permissions and remove access for people who leave the company.

If we identify a security incident that may affect a client's data, we will notify the client without undue delay, with the available information about what happened, the data involved and the measures taken.

We will also support the client, as controller, with any required notifications to the ANPD and data subjects, and will make those notifications ourselves where we are the controller, within the deadlines set by regulation.

• Data entered in the ERP and systems: for as long as the contract is in force. When the contract ends, the client may request an export of its data within the period set in the contract; after that, the data is deleted or anonymized.
• Backups: overwritten in periodic cycles, so copies may remain for a limited time after deletion, always protected.
• Application access logs: at least 6 months, as required by the Internet Civil Framework.
• Contract, tax and billing data: for the periods required by tax and accounting law and as long as needed to exercise rights.
• Business contacts that didn't lead to a contract: up to 2 years after the last contact, or sooner if you ask us to delete them.

On the website we don't use advertising or tracking cookies. We only keep your theme preference in your browser's local storage, which you can clear at any time.

In the ERP and systems we use strictly necessary cookies and storage to keep your session signed in, protect against unauthorized access and remember your preferences. Without them, the system won't work properly.

Under article 18 of the LGPD, you may request:

• Confirmation that we process your data, and access to it.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully.
• Data portability, as regulated.
• Information about who we share your data with.
• Withdrawal of consent, where consent is the legal basis, and information about the consequences of not giving it.
• Review of decisions made solely through automated processing.

If your data was entered in the ERP by a client company (for example, you are a customer, supplier or employee of that company), please send your request to that company, as it is the controller. If we receive the request directly, we will forward it to the client and help it respond.

In all other cases, send your request to contato@brunsolutions.com.br. We may ask for information to confirm your identity first. You may also file a complaint with the ANPD.

Our services are intended for businesses and their professionals and are not directed at children or adolescents. Any data about minors that a client records (for example, young apprentices in the HR module) is processed according to the client's instructions and applicable law.

We may update this policy to reflect changes in our services, the law or our practices. The current version will always be on this page, with the date of the last update. Material changes will be communicated to clients through the contact channels in their contract.

If this policy conflicts with the contract or data processing agreement signed with a client, the contract prevails.

To exercise your rights, ask about this policy or reach our data protection officer, write to contato@brunsolutions.com.br. We reply as soon as possible, within the legal deadlines.

R BRUN DESENVOLVIMENTO DE SISTEMAS LTDA (Brun Solutions) — brunsolutions.com.br