A Minha Empresa · MAQ
Security and privacy policies
Seven procedures for operating A Minha Empresa. These rules take effect on 9 October 2026; adoption does not demonstrate past execution or implementation of every control.
Information security
Protect information, credentials and service continuity.
Adopted procedure
- Marco Aurélio approves operational changes, records risks, verifies the change and defines recovery and backup measures where applicable.
- Credentials and customer information must not appear in public records, demonstrations or support tickets. Tests and examples must use synthetic or minimized data.
- Vulnerabilities are assessed by impact, assigned an owner and deadline, and resolved or recorded as an exception. Administrative access must be restricted; restores must be verified in an isolated environment.
Verified controls
Public access and official APIs use HTTPS. Access is scoped by company and role, with specific protection for integration tokens, passwords and sessions.
Under implementation: Broader encryption, key management, endpoint protection, MFA and monitoring require implementation and verification. This policy does not certify comprehensive coverage.
Access control
Give each person only the access needed for their role.
Adopted procedure
- Accounts are individual. An administrator approves the company, purpose and role; password and session sharing is prohibited.
- Administrative and other access must be reviewed quarterly and when roles change. Ended authorization or suspected compromise requires immediate suspension and assessment of affected sessions and integrations.
- Infrastructure access requires specific authorization. External administrative services must use MFA where available, and configuration must be verified.
Verified controls
The service validates company, role and suspension and restricts administrative functions. Sessions have a limited duration and can be ended.
Under implementation: The first documented access review and additional authentication safeguards form part of implementing this policy. Universal MFA is not claimed.
Classification and handling
Define the care required before sharing or disposing of information.
Adopted procedure
- Public information requires approval; internal information is shared only with authorized people; personal data, orders, results and copies are confidential; credentials and sensitive incident evidence have restricted access.
- Unclassified information is handled as confidential. Mixed content follows its most restrictive class; exports and reports must contain only what is necessary.
- Sensitive personal data is outside the product's normal purpose. If present in free text or attachments, access must be restricted and the need to retain it assessed.
Verified controls
The prepared TikTok flow limits the persisted projection to operational fields.
Under implementation: Classification of existing information and content review are operational procedures; automated detection or masking of all personal data is not claimed.
Incident response
Contain incidents, preserve evidence and protect affected people.
Adopted procedure
- Marco Aurélio coordinates recording discovery and awareness, containment, assessment of data and affected people, recovery and review. Evidence must have restricted access and minimized content.
- When acting as a data processor, MAQ informs the controller without undue delay and provides information for assessment. Applicable shorter contractual deadlines, including marketplace requirements, must be observed.
- For relevant risk or harm, the controller notifies ANPD and affected people within 3 business days of awareness that personal data was affected, subject to specific rules. A justified preliminary notice must be supplemented within 20 business days of notification where applicable.
- The decision whether to notify must be documented with reasons. Personal-data incident records are retained for at least 5 years from recording.
Verified controls
Health checks and operational records exist; they do not demonstrate an on-call security service.
Under implementation: Exercises, escalation and improved alerts must be documented. Round-the-clock surveillance or support is not promised.
Personal-data processing
Use information for defined purposes and record responsibilities.
Adopted procedure
- Each operation must be inventoried with category, source, purpose, applicable lawful basis, MAQ's role, recipients, location, retention and safeguards.
- MAQ decides purposes for managing its own service. For processing under a customer company's instructions, it acts as processor within the contracted scope; the customer determines the purposes and lawful bases for its data.
- New fields, integrations, vendors and international transfers require assessment before use. Order data must not be reused for sale, advertising, model training or enrichment without a specific assessment and applicable authorization.
Verified controls
Product categories and purposes are described in the privacy policy. The responsible person identified primary hosting as Hostgator in São Paulo, Brazil.
Under implementation: Completing the inventory per operation, reviewing vendor contracts and assessing copies and transfers are part of implementing this policy.
Privacy notice
Maintain accessible information about processing, rights and contact.
Adopted procedure
- The notice identifies MAQ, data protection officer Marco Aurélio and marco@alomaq.com.br, with categories, purposes, responsibilities, sharing, safeguards and retention.
- New purposes and material changes must be assessed, versioned and communicated before use. Content is reviewed quarterly and after an incident or material change.
- Disconnecting a store removes its local credential and preserves history. Erasure and marketplace authorization revocation are separate actions assessed according to the request and each party's responsibilities.
Verified controls
The privacy policy is available in Portuguese and English and linked to this policy set.
Under implementation: The notice must follow product changes and retention decisions without anticipating unverified controls or integrations.
Retention, erasure and rights
Keep only necessary information and provide reasoned responses.
Adopted procedure
- The need for accounts and history must be reviewed annually, at termination and upon request. Additional retention must record category, grounds, period or end criterion, and restricted access.
- Requests are received free of charge by email. The officer records scope, proportionately verifies identity or representation, identifies the controller and coordinates responses and authorized actions.
- Confirmation or access receives an immediate simplified response or complete statement within 15 days of the request under the applicable rule. Other rights are assessed individually with reasons for any impediment.
- Erasure or anonymization must address active data and relevant copies, with verified execution, communication to applicable parties, backup expiry and prevention of reintroduction following a restore.
Verified controls
Disconnecting removes local credentials and keeps history; session expiry and logout limit session use.
Under implementation: The definitive category retention schedule, technical erasure routine and backup lifecycle are under implementation. Automatic or immediate erasure of every copy is not promised.
Contact us about your data
Send rights requests, questions and incident reports free of charge to the data protection officer, Marco Aurélio:
Reviewed quarterly and after incidents or material changes. Next scheduled review: 9 January 2027.