Terms of Use and Privacy Notice — Qualitech Management System

1. Purpose. These terms set the rules for using the Qualitech Management System ("system") by employees, service providers and authorized third parties ("you").

2. Access and credentials. Your login is personal and non-transferable. Sharing your password, an open session or a logged-in device, and using someone else's account, are prohibited. Use a strong password used only for this system. If you suspect someone knows your password, change it in My account and notify the system administrator.

3. Use exclusively for company purposes. The system and the information it contains must be used only in the activities of your role and for company purposes. Using them for personal or third-party purposes, copying, exporting, photographing or disclosing data outside these purposes, extracting data in bulk without authorization, and attempting to bypass access or security controls are prohibited.

4. Role-based access. Each screen is enabled according to your role. If you can see something you should not, do not use the information and notify the system administrator.

5. Confidentiality and sensitive information. All information in the system is confidential, including after your relationship with the company ends. Sensitive information includes, among others: personal data of employees (documents, salaries, payments, evaluations, certificates), client and supplier data, prices, proposals, contracts and financial information. Any sharing of sensitive information outside the company's purposes, by any means, is subject to the appropriate company measures, as set out in your contract, internal policies and the law.

6. Security and incidents. Notify the system administrator immediately if you notice unauthorized access, the loss of a logged-in device, a suspicious email asking for your password, or data exposed by mistake.

7. Non-compliance. Failure to comply with these rules may lead to access being blocked and to the appropriate company measures.

8. Electronic acceptance, validity and versions. Your acceptance is valid as an electronic signature. To prove it, we keep the version, the date and time, the IP address, the type of device and browser, the language and a verification code (hash) of the text shown. The acceptance is valid for 6 months. The system notifies you 15 days before it expires and, after that, asks for a new acceptance before it opens. A new version of these terms also requires a new acceptance. If you do not accept, you cannot use the system; in that case, talk to your manager or HR.

9. Personal data. The processing of your data follows Part B. This acceptance is not consent to process data: the processing relies on your contract and on the legal bases in Part B.

B1. Who is responsible. The party responsible for your data in this system is the Qualitech group company with which you have an employment or service relationship, in the country where you work. Privacy contact: the system administrator or HR at your base.

B2. What data we process.

• a) Account data: name, login email, job title and roles, bases, language and preferences, and your photo, uploaded by you or by HR (if any). They are required for you to use the system: without them there is no account.
• b) System technical records: logins, actions taken and screens accessed, with date, IP address and type of device and browser.

B3. What we use it for. To operate the system and control who accesses what, protect information, keep the traceability of operations required by clients, audits and quality standards, provide support and improve the system. We do not sell your data or use it for advertising.

B4. Legal basis.

• Europe (GDPR): performance of your contract (Art. 6(1)(b)); the company's legitimate interest in security, auditing and improving the system (Art. 6(1)(f)); compliance with a legal obligation (Art. 6(1)(c)), when the law requires a record to be kept.
• Mexico (Ley Federal de Protección de Datos Personales en Posesión de los Particulares): data necessary for the legal relationship with you does not require consent. Improving the system is a secondary purpose, and you may refuse it at any time (B7).
• United States (Texas): the state privacy law does not apply to data processed in an employment context. Even so, we apply the same rules of this notice to everyone.
• Brazil (LGPD), where applicable: performance of a contract (Art. 7, V), legitimate interest (Art. 7, IX) and compliance with a legal obligation (Art. 7, II).

B5. Who has access. Only authorized people, according to their role and the needs of the work. Any lookup of a specific person's records is recorded, with the reason.

B6. How long we keep it.

• Account data: for as long as the account exists. When it is closed, your name remains in historical records (who approved what) for as long as the company needs to keep those records by law, contract or audit.
• Login and security records: 365 days.
• Action records: for as long as the record of the operation they refer to exists.
• Records of screens accessed: up to 90 days. They are deleted together with your account.

B7. Your rights and how to exercise them.

• Your rights: you can request access to your data and a copy of it, correction, deletion, restriction of use and portability, and you can object to a processing; in Mexico, these are the ARCO rights, plus revocation and restriction of use.
• How to request: contact the system administrator or HR at your base. We respond within 15 days.

B8. Cookies and similar technologies. The system uses only essential cookies. There are no advertising, analytics or third-party cookies.

• Browser local storage: keeps screen preferences (columns, density, filters, open sections) and does not leave your device. It can be cleared in My account › Preferences.
• Turning them off: you can block or delete cookies in your browser settings. Without the session cookie, however, you cannot log in to the system.

B9. Security. We use encrypted connections, passwords stored irreversibly, sessions that expire, role-based access and audit records.

B10. Changes to this notice. When this notice changes, the version of the terms goes up and the system asks for a new acceptance, showing what changed.