Privacy Policy.

This Policy explains, in plain terms, what personal data Aston collects on this website, why we collect it, who we share it with and what your rights are — under the Brazilian General Data Protection Law (LGPD, Law No. 13.709/2018) and the Brazilian Internet Civil Framework (Law No. 12.965/2014).

1. Who processes your data

Everything described here refers to our corporate website (astontecnologia.com.br and equivalent domains). Access to the Vision PRO platform, restricted to clients and staff, is governed separately by the service agreement signed with each client.

2. Data we collect

2.1 Data you send us

When you fill in the contact form or request an assessment, we collect:

Data	Notes
Name	Identification of the requester.
Tax ID (CPF/CNPJ)	Required in Brazil to open the technical case and link the consumer units. Not requested on the international form.
Company	Required when the tax ID provided is a company registry (CNPJ).
E-mail and phone	So we can get back to you.
Segment and number of consumer units	To size the assessment.
Message	Free text written by you.
Attachments	Energy bills, contracts and documents you choose to send.

2.2 Data collected automatically

• Access logs — IP address, date and time, referring page and browser identification, kept as required by the Brazilian Internet Civil Framework.
• Attack protection — our infrastructure provider (Cloudflare) processes technical connection data to filter malicious traffic.

We do not use analytics tools, advertising pixels, remarketing or any behavioural tracking on this website.

3. Purposes and legal basis

What we use it for	Legal basis (LGPD)
Answering your request and preparing an assessment, proposal or quote	Preliminary steps to a contract — art. 7, V
Delivering the contracted service and providing support	Performance of a contract — art. 7, V
Keeping access logs and preventing fraud and attacks	Legal obligation (Internet Civil Framework) and legitimate interest — art. 7, II and IX
Meeting tax, accounting and regulatory obligations	Legal obligation — art. 7, II
Sending corporate communications when you ask for them	Consent — art. 7, I

We do not sell, rent or transfer your personal data to third parties for advertising purposes.

4. Who we share it with

We share only what is necessary, and only with those who take part in delivering the service:

• Infrastructure providers — hosting, CDN, attack protection and corporate e-mail, acting as processors and not allowed to use the data for their own purposes.
• Utilities and regulators — when the contracted service requires us to represent you before the distribution utility (for example, bill auditing or a review request), always with your authorisation.
• Public authorities — upon legal, judicial or regulatory request.

5. International transfers

Part of our infrastructure (network protection, content delivery and corporate e-mail) is operated by companies with servers outside Brazil. In those cases the transfer relies on art. 33 of the LGPD and on contractual clauses ensuring a level of protection compatible with Brazilian law.

6. How long we keep it

• Requests that do not become contracts — up to 24 months, for follow-up and commercial history.
• Client data — throughout the contractual relationship and afterwards for the legal retention periods (tax, accounting and statutes of limitation).
• Access logs — at least 6 months, under art. 15 of the Internet Civil Framework.

Once the period ends, data is deleted or anonymised.

7. Information security

• Traffic encrypted with HTTPS across the website and the platform.
• Platform access through individual credentials, with activity logging and permission profiles.
• Attachments stored outside the website's public folder, with no access by direct URL.
• Least-privilege principle: each staff member only accesses what their role requires.

No system is infallible. Should an incident pose relevant risk to data subjects, we will notify those affected and the Brazilian data protection authority (ANPD), under art. 48 of the LGPD.

8. Cookies and local storage

This website uses no advertising or analytics cookies. We only use:

• Essential security cookies, set by our network protection provider to tell legitimate visits from automated traffic.
• Local storage in your browser (localStorage), to remember your light or dark theme preference and the last case number generated. This data stays on your device and can be cleared at any time in your browser settings.

9. Your rights

The LGPD grants you confirmation, access, correction, anonymisation, portability, deletion, information about sharing and withdrawal of consent. We have gathered the steps to exercise each of them on the LGPD · Your rights page.

Data Protection Officer (DPO): João Almeida Jr. — [email protected].

10. Changes to this policy

We may update this Policy to reflect legal or operational changes. The effective date at the top of the page indicates the current version. Relevant changes will be announced through our official channels.