1. Introduction

Asksuite Tecnologia Ltda. (“Asksuite”, “we”) has developed an omnichannel automated service platform (“Platform”) used by companies in the tourism sector, such as hotels, inns, and resorts (“Clients”), through an artificial intelligence chatbot to answer the main questions of consumers (“Consumers”).

This Privacy Policy (“Policy”) explains how we collect, use, store, and protect the personal data of visitors, Client employees, and Consumers who interact with our Platform.

2. What is Asksuite’s role as a data processing agent?

Asksuite will act as a Personal Data Processor in relation to its Clients when they acquire the Platform, considering that most purposes for using personal data collected by the chatbot are under the Clients’ responsibility. In this case, Asksuite will process personal data on behalf of this controller and follow their instructions. In other words, we generally process data on behalf of Clients and fulfill the purposes they define.

In specific situations, such as for the development of new products and usage statistics, Asksuite acts as a controller, in which case the organization is responsible for decisions regarding personal data processing.

3. What data do we collect?

The amount and type of information collected by Asksuite varies according to how our Platform is used by the Client or Consumer. Most purposes for using personal data collected by the chatbot are under the responsibility of our Clients, who qualify as “controllers” of personal data. In other words, we generally process data on behalf of Clients and fulfill the purposes they define.

3.1 Website Visitor

3.2 Asksuite Client Employees

If you are an Employee of an Asksuite Client who uses our Platform – for example, an employee of a hotel or resort – we will use your personal data as shown below:

3.3 Asksuite Client Consumers

If you are a Consumer of an Asksuite Client (for example, a hotel guest), your personal data may be accessed directly on the Platform by the Client and their employees.

However, it is important to clarify that Asksuite does not control the manner and purpose of most information collected by Clients through our Platform. This data belongs to Asksuite’s Clients, who use, disclose, and protect it according to their respective privacy policies. In some cases, we may use the collected data for Asksuite’s own purposes, such as developing new products and services, as highlighted in the table below. In these cases, we assume the role of data controller.

In general, our Platform is used for the following purposes:

4. Do We Use Cookies?

We use cookies. Cookies are text files sent by the website and stored on your device (computer, mobile phone, for example). These files contain information related to page navigation.

Cookies usually have an expiration date. Some cookies are automatically deleted when you close the browser (so-called session cookies), while others may be stored on the device for longer until manually deleted (so-called persistent cookies).

Asksuite uses the following types of cookies on its platform and website:

• Persistent or permanent cookies: These are cookies that remain on your device for a specified period or until you delete them.
• Essential or necessary cookies: These are essential cookies that enable navigation in our applications and access to all resources with their features; without these, our services may perform poorly or not work.
• Functionality cookies: These are cookies that remember your preferences and choices (such as your username and preferred language, for example) for better website functionality.
• Analytical or performance cookies: These are cookies that optimize how our applications work via user experience, collecting anonymous information about pages accessed.
• Advertising and marketing cookies: These are cookies that target ads based on your interests and limit the number of times the ad appears.

The use of cookies is based on Asksuite’s legitimate interest. Therefore, if you wish to refuse the installation of these cookies on your device and/or opt for the removal of cookies, you can manage cookie usage in the following ways:

Cookie banner: you can choose to accept or not the use of cookies (manage your preferences in our cookie banner), except for those strictly necessary for the website to function.

Browser settings: you can adjust your browser settings to disable or delete cookies. To do so, simply click on the links below, according to the browser you use:

• Firefox
• Chrome
• Safari
• Internet Explorer or Edge

By disabling all cookies in your browser, some essential functions for the website to work may become unavailable.

It is important to clarify that Asksuite is not responsible for the use of cookies by third parties. Be aware that cookies installed by third parties may continue to monitor your online activities even after you have left our Platform. It is recommended that you clear your browsing data regularly.

5. With whom does Asksuite share your data?

Asksuite may operate together with other companies in a wide range of activities, including hosting, data storage, data analysis, among others. Therefore, we reserve the right to share your information, including personal data, as indicated below. Whenever possible, we will adopt mechanisms for anonymization and pseudonymization of this data and maintain strict clauses in our contracts to preserve your privacy to the maximum extent.

Thus, we may share your personal data in the following cases:

• Our Suppliers: We engage suppliers to operate our Platform and offer our services, some of whom handle personal data collected on behalf of the Client. For example, we use hosting services, data storage, and engage analytics services to analyze the use of our Platform. We strive to protect the privacy of your personal data, but unfortunately, we cannot guarantee the correct processing of personal data by third parties, who use, disclose, and protect it according to their respective privacy policies.
• Our Clients: For the proper development of the Platform and to fulfill the execution of the contract with the Client, we will share the information collected by our chatbot with the Client linked to you.
• Integration with other platforms: Asksuite offers software integration services through APIs (Application Programming Interfaces), as contracted by our Clients. Thus, we may integrate the information collected by our chatbot with third-party platforms, such as CRM services (customer relationship management) or online sales platforms (for example, room reservations).
• To safeguard and protect Asksuite’s rights: Asksuite reserves the right to access, read, preserve, and provide any data and information about you, including your interactions, if necessary to comply with a legal obligation or court order; to enforce or apply our Contracts and other agreements; or to protect the rights, property, or safety of Asksuite, as well as our employees and/or other users. For example, we may share certain information with the Public Prosecutor’s Office and/or Civil Police when requested by these agencies, only to the extent expressly requested.

6. What are the rights of data subjects?

You can always choose not to disclose your personal data to us; however, this data may be necessary for using some features available on our Platform. Regardless, you will always have rights regarding the privacy and protection of your personal data. In this case, we recommend that you, as a Consumer, contact the hotel, resort, or inn providing you with the service directly. If you are an employee of a hotel, resort, or inn, it is also recommended that you contact your employer directly if you wish to exercise your rights as a data subject.

Thus, explanations and examples of these rights are briefly described below:

• Access to your personal data: This right allows you to request and receive a copy of your personal data that Clients have about you.
• Rectification of your personal data: This right allows you, at any time, to request the correction and/or rectification of your personal data from Clients if you identify that it is incorrect. However, for this correction to take effect, it may be necessary to verify the validity of the data you provide us.
• Delete or cancel your personal data: This right allows you to request the deletion of your personal data from Clients, unless there is any other reason for its retention, such as any legal obligation to retain data or the need to preserve it to protect rights.
• Object to the processing of personal data: This right allows you to challenge where and in what context the Client processes your personal data for different purposes. In certain situations, the Client may demonstrate that it has legitimate grounds for processing your data that override your rights, if, for example, they are strictly essential for the Platform’s functionality.
• Portability: This right allows you to request the Client to deliver your personal data to you or to third parties of your choice, in a structured and interoperable format.
• Withdraw consent at any time: This right allows you to withdraw your consent; however, this will not affect the legality of any processing carried out before the withdrawal of your consent. If you withdraw your consent, certain services may be discontinued. If so, we will notify you.
• Review automated decisions: This right allows you to ask the Client to review decisions made solely based on automated processing of your personal data that affect your interests.

If you are a website visitor, we may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise your other rights). This is a security measure to ensure that personal data is not disclosed to anyone who does not have the right to receive it.

If you are a Consumer (guest, for example) or an employee of one of our Clients (hotels and resorts) and have questions about these issues or want to know how to exercise these rights, we recommend that you contact the Client to which you will be linked.

For any questions, contact us via email at the following address: dpo@asksuite.com

7. How long will data be stored?

We will retain your personal data only for as long as necessary to fulfill the purposes for which we collected it, including meeting any legal, contractual, accountability, or competent authority requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purpose of processing your data, and the possibility of achieving these objectives by other means, as well as applicable legal requirements. In general, data is processed during the term of the contract with our Clients.

After completing all the purposes that justified the processing of your data on our Platform, it will be deleted, observing available technical means and considering the Retention Schedule. Additionally, we may continue to process personal data if we have an adequate legal basis, especially to legally protect Asksuite.

8. How does Information Security work at Asksuite?

Asksuite adopts technical and administrative measures to protect your personal data against loss, unauthorized use, or other abuses. Data is stored in a secure operational environment, not accessible to the public.

To ensure the security of your personal data in our services, we adopt the best information security practices available, including:

• HTTPS protocol: We use the HTTPS protocol to transmit personal data over the internet, ensuring the confidentiality and integrity of information during transmission.
• Standard and market security methods: We adopt recognized and widely used market methods for the security of collected data, such as database access management and control and password encryption.
• Protection against unauthorized access: We implement technical and organizational measures to prevent unauthorized access to our systems.
• Preventive procedures against incidents: We adopt preventive and corrective procedures aimed at mitigating information security incidents.
• Continuous security analyses and tests: We conduct continuous information security analyses and tests on our systems, performed by internal and external teams.
• Training and awareness: We promote regular training on personal data protection and supervise the adoption of recommended practices.
• Controls based on international standards: We implement security controls aligned with NBR/ISO Standards 27001:2022, 27002:2013, and 27701:2019.

We strive to protect the privacy of your account and other personal data we maintain in our records, but unfortunately, we cannot guarantee total security. Unauthorized access or use of the account, hardware or software failures, and other factors may compromise the security of your personal data at any time.

Therefore, help us maintain a safe environment for everyone. In addition to adopting good security practices regarding your account and data, if you identify or become aware of anything that compromises the security of your data, please contact us.

9. International Transfers

It is possible that some of our systems may be hosted on servers located in other countries, characterizing international transfer of personal data.

In these cases, or in any situations where there may be international transfer, we reinforce our total commitment to ensuring that we will only carry out international transfers in accordance with Article 33, IX of the LGPD and ANPD Regulation No. 19.

Furthermore, we commit to evaluating our international partners and contracting companies that adhere to other data protection regulations, such as the European GDPR, and the American CCPA and CDPA.

10. Who is our Data Protection Officer and how to contact them?

If you have any other questions about how we use your data, comments, or suggestions related to this Policy, or if you believe your personal data has been used in a manner incompatible with this Privacy Policy or with your choices as a personal data holder, you can contact our Data Protection Officer (DPO):

• DPO: Data Guide (CNPJ No. 39.317.591/0001-60)
• Legal Representative: Taynara Rodrigues Bernardo
• Contact email: dpo@asksuite.com

11. Update and Review

Asksuite may update/revise this Policy periodically to reflect improvements in services or legal changes. The updated version will always be published on our website, and for your convenience, we indicate the date of the last update at the end of the document.

© Asksuite Tecnologia Ltda. — Privacy Policy (P-PP-001)