PSI – Information Security Policy

This PSI is aligned with the Mission, Vision and Values, as well as the goals and purpose of the Aoop an NTT Data Company Institution.

Aoop an NTT Data Company, via its Information Security and Privacy Policy, aims to establish:

• In a manner that is favorable, convenient, adequate, timely, and expedient to the purposes of this organization and its employees, Aoop an NTT Data Company establishes the set of guidelines, whose goal is to ensure protection of information against any threats that may harm directly or indirectly the integrity of personal data and, as a result, its students and operations.

• Ensure compliance with all its legal obligations, in order to meet the regulatory and contractual requirements relevant to its activities, as per the Brazilian General Data Protection Act (LGPD), Nº 13.709, dated as of August 2018.

• Ensure confidentiality, integrity and availability of the information of Personal Data holders, its employees and Aoop an NTT Data Company itself, safeguarding privacy of the data and of the information systems against improper access and unauthorized modifications.

• Ensure that only authorized personnel have access to the Aoop an NTT Data Company facilities, information and information systems.

• Bring awareness to people of possible consequences for Aoop an NTT Data Company, its employees and PD holders, of violating privacy or security policies, especially those related to PD processing.

• Ensure continuation of business, safeguarding critical processes against significant faults or disasters.

• Ensure continuous and updated training on the policies and information security and privacy procedures, emphasizing people’s obligations regarding information safety and privacy.

• Ensure that all responsibilities for the information security and privacy, including the Supervisor of Personal Data-PD processing, are clearly defined and that the appointed people are able to fulfill all assignments for information security and privacy.

• Continuously improve the Information Privacy Management System. This Policy is available for all relevant interested parties.

• Make available and maintain, in a transparent manner, accessible and documented, the updating of the Information Security and Privacy Policy for its employees and PD holders.

This policy enters into effect from the date of its approval and publishing, being valid for an indefinite period.