General Privacy Notice for Suppliers

This Privacy Notice is directed to:

  • our suppliers and service providers who are individuals (such as self-employed workers);

  • the representatives or contact persons of our suppliers and service providers who are legal entities; and

  • any other visitors to our facilities.

For this Privacy Notice, "Águas Azuis" refers to Águas Azuis Construção Naval SPE Ltda., registered at Rua Eugênio Pezzini 355, room 5, Cordeiros, Itajaí-SC, CEP: 88.311-045, which is the entity processing your data.

Águas Azuis is responsible for processing your data, as it decides why and how it processes them, thus acting as the "controller." In this Privacy Notice, "we" or "us" refers to Águas Azuis.

We invite you to read this Privacy Notice carefully, which outlines the context in which we are processing your data and explains your rights and our obligations.

If you have any questions regarding processing your data, we invite you to contact us at: privacy.office@aguasazuis.com.br.

1. What information do we have about you?

You or our supplier or service provider (i.e., the legal entity you work for) may provide this information directly. We may collect various types of personal data about you, including:

  • your general and identification information (e.g., name, surname, gender, email and/or postal address, landline and/or mobile phone number);

  • your role (e.g., job title, position, and company name);

  • for individuals acting as suppliers or service providers, financial information (e.g., bank account details); and

  • your electronic identification data, when necessary, to provide products or services to our company (e.g., badge number and image, IP address, online identifiers/cookies, logs, access and connection times, CCTV footage).

2. For what purposes do we use your data and why is this justified?

Legal basis for processing

We will not process your data unless we have an appropriate legal justification. Therefore, we will only process your data if:

  • we have obtained your prior consent;

  • the processing is necessary to fulfill our contractual obligations to you or to take pre-contractual measures at your request;

  • the processing is necessary to comply with our legal or regulatory obligations; or

  • the processing is necessary for our legitimate interests and does not unduly affect your interests or fundamental rights and freedoms.

Purposes of processing

We always process your data for a specific purpose and only process the relevant personal data to achieve that purpose. In particular, we process your data for the following purposes:

  • participation in the qualification process as a potential supplier to Águas Azuis, within the scope of its Compliance rules and procedures;

  • managing our suppliers and service providers throughout the supply chain;

  • organizing proposals, implementing preparatory tasks, or executing existing contracts;

  • monitoring activities at our facilities, including compliance with applicable policies and health and safety standards in place;

  • managing our IT resources, including infrastructure management and business continuity;

  • preserving the company's economic interests and ensuring compliance and reporting (such as complying with our policies and local legal requirements, taxes and deductions, managing cases of alleged misconduct or fraud, conducting audits, and defending litigation);

  • managing mergers and acquisitions involving our company;

  • archiving and record-keeping;

  • billing, invoicing, and payments in favor of the supplier;

  • conducting surveys and statistics and internal reports;

  • sending communications related to sustainability and compliance; and

  • any other purposes imposed by law and authorities.

3. Who has access to your data and to whom are they transferred?

We will not sell, share, or otherwise transfer your data to third parties beyond those indicated in this Privacy Notice.

In the course of our activities and for the same purposes as listed in this Privacy Notice, your data may be accessed or transferred to the following categories of recipients on a need-to-know basis to achieve such purposes:

  • our personnel (including employees, departments, or other companies within the thyssenkrupp and Embraer group);

  • our independent agents and consultants (if any);

  • our other suppliers and service providers who provide us with services and products;

  • our IT systems providers, cloud service providers, database providers, and consultants;

  • any third party to whom we assign or renew any of our rights or obligations; and

  • our external advisors and lawyers in the context of selling or transferring any part of our business or its assets.

The above third parties are contractually obligated to protect the confidentiality and security of your data, by applicable legislation.

Your data may also be accessed or transferred to any regulatory, supervisory, public body, or national and/or international court where we must do so by law or applicable regulation or at their request.

The personal data we collect from you may also be processed, accessed, or stored in a country outside of Brazil. If we transfer your data to external companies in other jurisdictions, we will ensure to protect your data by (i) applying the level of protection required by applicable local data privacy protection laws in Brazil, (ii) acting under our policies and standards, or (iii) any other requirement set out in Chapter 5 of Article 33 of the LGPD.

4. How do we protect your data?

We have implemented appropriate technical and organizational measures to provide security and confidentiality for your data. These measures consider:

  • the state of the art of technology;

  • the costs of implementation;

  • the nature of the data; and

  • the risk of processing.

The aim is to protect it against accidental or illegal destruction or alteration, accidental loss, unauthorized disclosure or access, and other illegal forms of processing.

Additionally, when handling your data, we: 

  • collect and process only personal data that is adequate, relevant, and not excessive, as required to meet the above objectives; and

  • ensure that your data remains up-to-date and accurate.

For the latter, we may ask you to confirm the personal data we hold about you. You are also invited to inform us spontaneously whenever there is a change in your circumstances so we can ensure that your data is kept up-to-date.