ISMS · ISO/IEC 27001

Information Security Policy

RainbowTec information security and privacy guidelines: access control, personal data protection, monitoring, auditing and continuous improvement.

DO-DIR-007 · Rainbow Tecnologia e Consultoria Ltda

1 - Purpose

The information security policy of our company aims to protect the integrity, confidentiality, and availability of data belonging to our clients, partners, and employees, ensuring a safe and reliable environment for all operations.

2 - Commitment to Security

We are committed to implementing and maintaining rigorous information security practices at all stages of development, implementation, and support of our access control and third‑party management systems.

3 - Responsibilities

All employees, contractors, and partners are responsible for following and promoting the established information security guidelines, contributing to the protection of data against internal and external threats.

4 - Access Control

We implement robust access controls to data, ensuring that only authorized individuals have access to the information necessary to perform their duties.

5 - Personal Data Protection

We are committed to complying with all applicable laws and regulations related to the protection of personal data, ensuring the proper and secure processing of such information.

6 - Monitoring and Auditing

We perform continuous monitoring and periodic audits to ensure the effectiveness of information security measures and to identify potential vulnerabilities or security incidents.

7 - Education and Awareness

We promote employee education and awareness on safe data‑handling practices, offering regular training and resources to increase awareness of information security.

8 - Continuous Improvement

We are committed to the continuous improvement of our information security processes, systems, and policies, adapting to technological developments and emerging security threats.

9 - Compliance and Responsibility

We strictly comply with internal and external standards related to information security, taking full responsibility for protecting the data entrusted to us as data processors.

Approved by Senior Management.