Nuveto Information Security Policy

Introduction

Nuveto, a leading company in consulting, development, and distribution of cloud software for customer experience and service, recognizes the importance of protecting our customers’ information and data. As Nuveto’s Data Protection Officer (DPO), I present this Information Security Policy with seriousness. It is designed to ensure that all information is handled securely, reliably, and in accordance with applicable regulations and laws.

Objective

The objective of this policy is to establish guidelines and standards to protect information from threats, both internal and external, deliberate or accidental.

Scope

This policy applies to all employees, suppliers, partners, and third parties who have access to Nuveto’s information systems. Fundamental Principles Confidentiality: Information should only be accessible to those authorized. Integrity: Information should be accurate and complete. Availability: Information should be available when needed.

Security Guidelines

1) Authentication and Access:

• All users must have unique identifiers (user IDs) to access information.
• Passwords should be strong and regularly renewed.
• Access should be based on the principle of least privilege.

2) Data Management:

• All data should be classified according to its sensitivity.
• Sensitive data should be encrypted during transit and at rest.
• Regular backups should be performed and tested regularly.

3) Network and Communication: • Networks must be protected by firewalls and intrusion detection/prevention systems.

• All communications, especially those containing sensitive information, must be encrypted.

4) Monitoring and Incident Response:

• Continuous monitoring should be conducted to detect suspicious activities.
• There should be a clearly defined incident response plan tested regularly.

5) Training and Awareness:

• All employees should receive regular training on IT security best practices.
• Awareness campaigns should be conducted periodically.

6) Evaluation and Review:

• Policies and procedures should be reviewed annually or whenever there are significant changes in the business or technology.

Responsibilities

Every employee is responsible for adhering to this policy and reporting any suspected violations. Managers are responsible for ensuring their teams are aware of and comply with this policy. The IT team is responsible for implementing and maintaining security measures.

Violations

Any violation of this policy may result in disciplinary action, including but not limited to warnings, suspensions, or even termination.

Conclusion

Information security is a shared responsibility. Through collaboration and adherence to this policy, Nuveto will continue to be a trusted leader in consulting, development, and distribution of cloud software for customer experience and service.

Nuveto Acceptable Use Policy

Introduction

Nuveto, a leader in consulting, development, and distribution of cloud software for customer experience and service, is committed to providing a secure environment efficient and productive for all its users. This Acceptable Use Policy (AUP) establishes guidelines for the proper use of the company’s technological resources and information systems.

Objective

To ensure that users understand Nuveto’s expectations regarding the responsible and ethical use of the technological resources provided by the company.

Scope

This policy applies to all employees, suppliers, partners, and third parties using the systems, networks, and devices provided by Nuveto.

Guidelines for Acceptable Use

1) Ethical and Legal Use:

• Technological resources must be used ethically, legally, and in compliance with applicable laws and regulations.

2) Professional Use:

• Resources are provided for professional purposes. Although occasional personal use is allowed, it should not interfere with work activities or resource availability.

3) Security:

• Do not share your access credentials with anyone.
• Avoid downloading unauthorized software or applications.
• Keep all devices updated with the latest security patches.

4) Prohibition of Inappropriate Content:

• Accessing, storing, or transmitting any offensive, obscene, defamatory, or illegal content is prohibited.

5) Respect for Intellectual Property:

• Do not copy or distribute software, images, music, texts, or other copyrighted material without proper authorization.

6) Responsible Use of Resources:

• Avoid wasting technological resources such as bandwidth, storage space, or processing capacity.

7) Communication:

• Use communication channels, such as email or instant messaging, in a professional and respectful manner.

8) Privacy:

• Respect others’ privacy. Do not attempt to access or monitor other users’ information without authorization.

Responsibilities

Users are responsible for their actions and activities when using Nuveto’s technological resources. Managers must oversee and ensure their team complies with this policy. The IT team must provide guidance, support, and training to help users understand and follow this policy.

Violations

Failure to comply with this policy may result in disciplinary action, including warnings, suspensions, contract terminations, or even legal action.

Conclusion

The Acceptable Use Policy aims to create a safe and productive working environment for all. Collaboration and commitment from each user are essential to achieving this goal.

Nuveto Risk Management Policy

Introduction

Nuveto, a leader in consulting, development, and distribution of cloud software for customer experience and service, understands that risk management is an integral part of decision-making and strategic planning. This policy establishes the company’s approach to risk management, with the goal of protecting its assets, reputation, and stakeholder interests.

Objective

To define a framework for identifying, assessing, treating, and monitoring risks systematically, ensuring that the company can achieve its strategic, operational, and financial objectives.

Scope

This policy applies to all operations, activities, processes, and decisions of Nuveto, encompassing all employees, partners, suppliers, and related third parties. Risk Management Principles 1) Value to the Organization: Risk management should add value to the organization by supporting the achievement of objectives. 2) Integral Part of Decision Making: Risk assessment and management should be integrated into the decision-making process. 3) Systematic Approach: Risk management should be conducted in a structured and consistent manner throughout the organization. 4) Continuous Improvement: Risk management approaches and processes should be continuously improved based on feedback and learning.

Risk Management Policy

1) Risk Identification:

• Systematic procedures should be used to identify potential risks associated with all Nuveto activities.

2) Risk Assessment:

• Identified risks should be assessed for their likelihood of occurrence and potential impact.
• A risk matrix should be used to prioritize risks and determine the need for treatment.

3) Risk Treatment:

• Strategies should be developed to address risks, whether through mitigation, transfer, acceptance, or avoidance.
• Specific action plans should be developed for high-priority risks.

3) Monitoring and Review:

• The organization’s risk profile should be regularly monitored and reviewed.
• Changes in the external or internal environment should be considered in risk reassessment.

4) Communication and Reporting:

• Risk communication should be transparent and involve all relevant stakeholders.
• Regular reports on risk management should be provided to senior management and, where appropriate, the board.

5) Culture and Awareness:

• A risk management culture should be fostered throughout the organization.
• Training and awareness should be provided to ensure all employees understand and participate in the risk management process.

Responsibilities

• Senior management is responsible for supporting and promoting this policy, ensuring adequate resources are allocated for risk management. All managers and team leaders are responsible for implementing risk management in their respective areas.• Each employee is responsible for identifying and communicating risks in their daily activities.

Conclusion

Effective risk management is fundamental to the sustainability and success of Nuveto. This policy provides a framework to ensure risks are managed proactively, protecting the company and its stakeholders from adverse impacts. Nuveto Employee Security Policy

Introduction

Nuveto, a leader in consulting, development, and distribution of cloud software for customer experience and service, is deeply committed to the safety and well-being of its employees. This policy highlights practices and guidelines aimed at creating a safe and secure working environment for all. Objective To ensure a safe working environment by promoting practices that prevent accidents, incidents, and health risks for employees, as well as establishing clear guidelines for responding to emergencies.

Scope

This policy applies to all employees, interns, service providers, and visitors at Nuveto facilities.

Employee Security Policy

1) Safe Working Environment:

• Nuveto will provide a safe working environment, complying with all applicable standards and regulations.
• All work areas must be kept clean, organized, and free from obstructions.

2) Personal Protective Equipment (PPE):

• When necessary, PPE will be provided, and its use will be mandatory. Employees are responsible for maintaining and correctly using this equipment.

3) Training and Awareness:

• All employees will receive adequate training on safe work practices and emergency procedures.
• Safety awareness will be regularly promoted through training, campaigns, and communications.

4) Prevention and Emergency Response:

• Clear procedures for evacuation, first aid, and emergency response will be established and communicated to all employees.
• Fire extinguishers and first aid kits will be maintained in strategic and easily accessible locations.

5) Incident Communication:

• All incidents, accidents, or risk situations must be immediately reported to management and the safety department.
• An analysis and investigation will be conducted for each incident to identify causes and implement corrective measures.

6) Health and Wellness:

• The company will promote healthy practices, offering wellness programs, regular check-ups, and health campaigns whenever possible.

7) Zero Tolerance Policy:

• Nuveto has a strict zero-tolerance policy towards any form of violence, harassment, or inappropriate behavior in the workplace.
• Any reports of such behaviors will be taken seriously and may result in disciplinary action, including contract termination.

Responsibilities

• Senior management and team leaders are responsible for ensuring the implementation and maintenance of this policy in their areas of responsibility.
• Each employee is responsible for following the safety guidelines, using protective equipment when necessary, and reporting any risk situations.
• The security department and human resources are responsible for providing training, monitoring compliance, and reviewing the effectiveness of this policy.

Conclusion

The safety of every employee is of utmost importance to Nuveto. This policy reflects the company’s commitment to providing a safe working environment, protecting the well-being and health of everyone involved.

Nuveto Communication Management Policy

Introduction

Nuveto, a leader in consulting, development, and distribution of cloud software for customer experience and service, recognizes the importance of effective communication for organizational success. This policy aims to establish standards, practices, and guidelines that promote clear, transparent, and strategic communication at all levels of the company.

Objective

To establish a framework to ensure that information is transmitted and received efficiently, accurately, and timely, strengthening collaboration, commitment, and trust among all stakeholders.

Scope

This policy applies to all forms of internal and external communication of Nuveto, involving all employees, suppliers, partners, and clients.

Communication Management Policy

1) Clear and Precise Communication:

• Information must be presented clearly, concisely, and without ambiguity.
• Avoid excessive use of jargon and ensure the message is understandable to the target audience.

2) Appropriate Communication Channels:

• Select the most suitable communication channels for each type of message or audience, whether email, meetings, newsletters, or digital platforms.

3) Feedback and Open Dialogue:

• Promote an environment where feedback is encouraged and valued.
• Establish mechanisms for employees to express their opinions and concerns.

4) Transparency and Integrity:

• Ensure all communications are transparent, honest, and fact-based.
• Avoid withholding information or conveying misleading messages.

5) Accountability:

• Respond promptly to inquiries and feedback, ensuring stakeholders feel heard and valued.

6) Privacy and Confidentiality:

• Respect individuals’ privacy and maintain the confidentiality of information, as established in the company’s privacy and information security policies.

7) Training and Development:

• Provide regular training on communication skills for employees, ensuring they are equipped to communicate effectively.

8) Monitoring and Evaluation:

• Regularly monitor and evaluate the effectiveness of communications, adjusting strategies as necessary.

Responsibilities

• The communication department is responsible for developing, implementing, and monitoring the company’s communication strategy.
• Team leaders and managers are responsible for ensuring effective communication within their teams and between departments.
• All employees are responsible for following this policy and communicating respectfully and constructively.
• Conclusion

Effective communication is fundamental to the cohesion, collaboration, and success of Nuveto. This policy reflects the company’s commitment to promoting high-quality communication practices that benefit all involved.

Nuveto Network Security Policy

Introduction

Network security is one of the fundamental pillars for protecting an organization’s digital assets. Nuveto, a leader in consulting, development, and distribution of cloud software for customer experience and service, understands that ensuring a secure network is vital for business continuity and protecting its customers’ information.

Objective

To define and establish guidelines and standards to ensure that Nuveto’s network infrastructure remains secure, resilient, and capable of protecting data and systems against threats and vulnerabilities.

Scope

This policy covers all components of Nuveto’s network infrastructure, including hardware, software, devices, connections, and all network-related activities.

Network Security Policy

1) Secure Network Architecture:

• The network must be designed and configured following security best practices, including network segmentation and the use of demilitarized zones (DMZ).

2) Access Control:

• Network access must be restricted to authorized users and devices. Strong authentication and control mechanisms, such as access control lists (ACLs), must be implemented.

3) Monitoring and Analysis:

• Network activity must be continuously monitored to detect and respond to anomalous or suspicious behaviors. Intrusion detection and prevention tools (IDS/IPS) should be used.

4) Device Management:

• All devices connected to the network, including routers, switches, and firewalls, must be regularly updated, configured according to security standards, and monitored.

5) Encryption and Data Protection:

• Communications passing through the network, especially sensitive data, must be encrypted. Secure protocols such as SSL/TLS and VPN should be used.

6) Defense in Depth:

• Multiple layers of security, such as firewalls, proxies, and anti-malware solutions, must be implemented to ensure network resilience.

7) Incident Response:

• In the event of a network breach or attack, an incident response plan must be immediately activated to mitigate impacts and restore services.

8) Training and Awareness:

• Employees should be trained on network security risks and how to follow security practices when accessing and using the network.

9) Redundancy and Continuity:

• Network architecture should consider redundancy to ensure business continuity. Solutions such as load balancing and failover should be implemented.Responsibilities
• The IT security team is responsible for developing, implementing, and maintaining network security.
• Management is responsible for ensuring the allocation of resources and necessary support for network security.
• All employees are responsible for using the network responsibly and reporting any suspicions or security incidents.

Conclusion

Network security is crucial for the integrity of data and uninterrupted operation of Nuveto’s services. This policy aims to ensure that the company’s network infrastructure is protected against threats and capable of securely supporting business demands. Nuveto Outsourcing Services Policy

Introduction

Outsourcing services is a common strategy in many organizations to optimize resources, obtain specialized expertise, and improve efficiency. Nuveto, a leader in consulting, development, and distribution of cloud software for customer experience and service, understands the importance of managing and controlling the relationship with outsourced service providers effectively and securely.

Objective

To establish clear guidelines for the selection, management, monitoring, and evaluation of third-party vendors and service providers, ensuring they meet Nuveto’s standards and expectations.

Scope

This policy applies to all vendors, service providers, and any other third-party entities that provide services or products to Nuveto.

Outsourcing Services Policy

1) Vendor Selection:

• Vendor selection must be based on clear and objective criteria, such as technical competence, market reputation, financial stability, and compliance with legal and ethical standards.

2) Contractual Agreements:

• All agreements with outsourced service providers must be formalized through written contracts, detailing scope, responsibilities, timelines, and aspects related to security and confidentiality.

3) Monitoring and Evaluation:

• The performance and compliance of outsourced service providers must be monitored and evaluated regularly based on criteria established in the contractual agreements.

4) Risk Management:

• Risk assessments must be conducted before hiring and during the relationship with the third party, ensuring that potential vulnerabilities are identified and addressed.

5) Confidentiality and Information Security:

• Vendors and service providers must adhere to Nuveto’s information security policies, ensuring the protection of data and confidential information.

6) Training and Awareness:

• When appropriate, vendors and outsourced service providers should receive training on Nuveto’s policies, procedures, and expectations.

7) Conflict Resolution:

• Clear mechanisms for conflict resolution and dispute resolution must be established in the contractual agreements.

8) Contract Review and Termination:

• At the end of each contract, a formal review should be conducted to evaluate the performance of the service provider and determine the continuity or termination of the relationship.Responsibilities
• The purchasing and contracting department is responsible for the selection, negotiation, and management of contracts with vendors and service providers.
• Project managers or team leaders are responsible for the direct monitoring and management of the relationship with service providers in their areas of operation.
• The legal team is responsible for reviewing and approving all contractual agreements.
• All employees are responsible for reporting any irregularities or concerns related to vendors or service providers.

Conclusion

Effective management of the relationship with outsourced service providers is fundamental to the success and integrity of Nuveto’s business. This policy seeks to establish clear and rigorous standards to ensure that all outsourced services are aligned with the company’s values, expectations, and standards.

Nuveto’s Application and Infrastructure Development Policy

Introduction

Nuveto, a leader in consulting, development, and distribution of cloud software for customer experience and service, continuously seeks innovation and excellence in the development of its applications and management of its infrastructure. This policy aims to establish clear and consistent guidelines for the development, implementation, and maintenance of technological solutions.

Objective

To ensure that application development and infrastructure management are conducted securely, efficiently, and in line with Nuveto’s quality standards and strategic needs.

Scope

This policy covers all activities related to software development, configuration, testing, implementation, and maintenance of applications and infrastructure. Nuveto’s Application and Infrastructure Development Policy 1) Development Standards:

• All applications must be developed following recognized coding standards and industry best practices to ensure efficiency, security, and scalability.

2) Testing and Validation:

• Applications must undergo rigorous quality testing, including unit, integration, load, and security testing, before being deployed in production environments.

3) Configuration Management:

• Configuration management tools and processes should be used to track and control changes in applications and infrastructure.

4) Security and Privacy:

• Development should incorporate security principles from the outset (Security by Design), ensuring that applications are resilient to threats and protect user data.

5) Documentation:

• All applications and infrastructure changes must be properly documented, including requirements, design, configuration, and operation procedures.

6) Training and Education:

• Developers and engineers should receive ongoing training to stay updated with the latest technologies, tools, and industry practices.

7) Monitoring and Response:

• Infrastructure and applications should be continuously monitored to detect and promptly respond to failures, degraded performance, or potential threats.

8) Backup and Recovery:

• Robust backup and recovery procedures and solutions should be implemented to ensure business continuity in case of failures or disasters.

9) Updates and Maintenance:

• Applications and infrastructure should be regularly reviewed and updated to fix issues, improve performance, and respond to changes in business needs.

Responsibilities

• The development team is responsible for following the guidelines outlined in this policy and ensuring the quality and security of the applications.
• The infrastructure team is responsible for managing, monitoring, and maintaining the technological infrastructure.
• The IT security team must review and approve all applications and infrastructure changes from a security standpoint.
• Senior management is responsible for providing resources, support, and strategic direction for application development and infrastructure management.

Conclusion

Efficient and secure application development and proper infrastructure management are essential for delivering high-quality solutions and satisfying Nuveto’s customers. This policy aims to ensure that all technological activities are conducted consistently, effectively, and in line with the company’s standards of excellence.

Nuveto’s Software Development Lifecycle (SDLC) Policy

Introduction

Software development is a complex activity that requires a structured approach to ensure the delivery of high-quality products. Nuveto, a leader in consulting, development, and distribution of cloud-based software for customer experience and support, adopts a Software Development Lifecycle (SDLC) to guide and standardize the entire process of creating and maintaining its solutions.

Objective

To define and establish guidelines and practices for the software development lifecycle, ensuring that all phases, from conception to decommissioning, are managed effectively, securely, and aligned with Nuveto’s strategic objectives.

Scope

This policy encompasses all activities related to the development, testing, implementation, maintenance, and eventual decommissioning of software at Nuveto.

Software Development Lifecycle (SDLC) Policy

1. Conception Phase:
   • Clear definition of project objectives, scope, and requirements.
   • Analysis of technical, economic, and operational feasibility.
2. Design Phase:
   • Software architecture design, interfaces, and components.
   • Consideration of usability, performance, and security aspects.
3. Development Phase:
   • Coding following standards and best practices.
   • Use of appropriate tools and methodologies to ensure quality and efficiency.
4. Testing Phase:
   • Execution of unit, integration, system, and acceptance tests.
   • Identification and correction of defects and vulnerabilities.
5. Implementation Phase:
   • Planning and execution of implementation in production environments.
   • Monitoring and post-implementation support.
6. Maintenance Phase:
   • Continuous monitoring of software in operation.
   • Corrections, updates, and improvements as needed.
7. Decommissioning Phase:
   • Planning and execution of software decommissioning or replacement.
   • Ensuring preservation and data migration, if applicable.
8. Risk Management:
   • Continuous evaluation of risks in all SDLC phases.
   • Implementation of mitigation measures as necessary.
9. Documentation:
   • Creation and maintenance of comprehensive and updated documentation in all phases.
   • Provision of documentation to relevant teams and stakeholders.

Responsibilities:

• The development team is responsible for following the guidelines of this policy and ensuring adherence to the defined SDLC.
• The testing team is responsible for ensuring the quality and security of the software before implementation.
• The operations team is responsible for the implementation, monitoring, and maintenance of the software in production environments.
• The senior management is responsible for providing resources, support, and strategic direction for the software development lifecycle.

Conclusion

The software development lifecycle is essential to ensure the delivery of robust, secure, and high-quality solutions. This policy aims to establish a clear and consistent structure to guide all software development activities at Nuveto, ensuring alignment with the company’s standards of excellence.

Nuveto’s Legal Regulation and Compliance Policy

Introduction

Nuveto, a leader in consulting, development, and cloud software distribution for customer experience and service, recognizes the importance of operating in full compliance with applicable laws, regulations, and standards. In this context, the company is committed to maintaining ethical and transparent business practices, ensuring legal compliance in all its processes and operations.

Objective

To establish clear guidelines to ensure that Nuveto operates in compliance with all relevant legal and regulatory obligations, minimizing risks and protecting the company’s reputation.

Scope

This policy applies to all operations, activities, employees, partners, and service providers of Nuveto. Legal Regulation and Compliance Policy

1. Awareness and Updates:
   • Stay informed about all applicable laws, regulations, and standards in the sector and Nuveto’s operations.
   • Monitor and quickly adapt to any changes in regulations.
2. Training and Awareness:
   • Provide regular training to employees on relevant legal and compliance requirements for their roles.
   • Promote a culture of compliance throughout the organization.
3. Monitoring and Auditing:
   • Conduct regular internal audits to verify compliance with applicable laws and regulations.
   • Promptly address any identified non-compliance.
4. Relations with Regulators:
   • Establish a transparent and cooperative relationship with regulatory bodies and government authorities.
   • Respond quickly to all requests and inspections from regulatory bodies.
5. Documentation and Records:
   • Maintain adequate documentation of all activities and operations to demonstrate compliance.
   • Ensure that records are securely stored and available for review when necessary.
6. Accountability and Oversight:
   • Promote a culture where compliance is everyone’s responsibility.
   • Take appropriate disciplinary actions in case of compliance violations.
7. Communication and Reporting:
   • Quickly inform senior management and stakeholders about significant compliance issues.
   • Ensure that any incidents of non-compliance are reported and addressed appropriately.

Responsibilities

The legal and compliance team is responsible for monitoring changes in legislation, interpreting legal requirements, and providing guidance to the company. Department leaders are responsible for ensuring that their teams are aware of and comply with all applicable regulations. All employees are responsible for following this policy and reporting any concerns or potential violations.

Conclusion

Legal and regulatory compliance is essential for Nuveto’s integrity and success. This policy aims to ensure that the company operates ethically, transparently, and in full compliance with all legal and regulatory obligations. Nuveto’s Information Management Policy

Introduction

In the digital age, information is one of the most valuable assets for any organization. Nuveto, a leader in consulting, development, and cloud software distribution for customer experience and service, understands the critical importance of managing, protecting, and effectively utilizing its information to maintain customer trust, comply with regulations, and achieve strategic objectives.

Objective

To define guidelines and practices for the proper management of information, ensuring its availability, integrity, confidentiality, and compliance throughout its lifecycle.

Scope

This policy encompasses all of Nuveto’s information, regardless of format or medium, including digital data, printed documents, and verbal communications.

Nuveto’s Information Management Policy

Introduction

In the digital age, information is one of the most valuable assets for any organization. Nuveto, a leader in consulting, development, and cloud software distribution for customer experience and service, understands the critical importance of managing, protecting, and effectively utilizing its information to maintain customer trust, comply with regulations, and achieve strategic objectives.

Objective

To define guidelines and practices for the proper management of information, ensuring its availability, integrity, confidentiality, and compliance throughout its lifecycle.

Scope

This policy encompasses all of Nuveto’s information, regardless of format or medium, including digital data, printed documents, and verbal communications.

Information Management Policy

1. Information Classification:
   • All information must be classified according to its level of sensitivity and importance to the organization.
   • Categories may include: Public, Internal, Confidential, and Restricted.
2. Storage and Backup:
   • Information must be stored in secure and appropriate locations, with regular backups performed to prevent data loss.
   • Backup solutions must be periodically tested to ensure effective data recovery.
3. Access and Control:
   • Access to information must be restricted based on the principle of least privilege. Only authorized individuals should have access to information according to their role and need.
   • Audit logs must be maintained for all access and modification activities.
4. Retention and Disposal:
   • Information must be retained for the period required by regulations and business needs.
   • After this period, information must be securely and irreversibly disposed of.
5. Security and Protection:
   • Appropriate security measures, including encryption, firewalls, and antivirus systems, must be implemented to protect information against threats and unauthorized access.
   • Incident response policies and procedures must be established to handle potential information security breaches.
6. Compliance and Audit:
   • Information management must comply with all applicable laws, regulations, and standards.
   • Regular audits must be conducted to ensure compliance and identify areas for improvement.
7. Training and Awareness:
   • Employees must receive regular training on the importance of information management and their responsibilities in this area.
8. Communication and Collaboration:
   • Appropriate tools and platforms must be used to facilitate effective communication and collaboration, ensuring the integrity and confidentiality of shared information.

Responsibilities

The information management team is responsible for developing, implementing, and monitoring related policies and practices. The IT security team is responsible for ensuring the protection and security of information. All employees are responsible for following this policy and protecting Nuveto’s information.

Conclusion

Effective information management is essential for the operation, reputation, and success of Nuveto. This policy aims to ensure that information is treated as a valuable asset, protected against threats, and used effectively to benefit the organization and its stakeholders.

Nuveto’s Change Management Policy

Introduction The ability to adapt and evolve is essential for the continued success of any modern organization. Nuveto, a specialist in consulting, development, and cloud software distribution for customer experience and service, understands the importance of managing changes in a structured and controlled manner, minimizing disruptions and maximizing benefits.

Objective

To establish clear guidelines and procedures for change management, ensuring that all modifications to Nuveto’s operations, systems, processes, or structures are implemented effectively, controlled, and aligned with the company’s strategic objectives.

Scope

This policy covers all changes that may impact Nuveto’s operations, systems, processes, organizational structures, or other aspects of the business.

Change Management Policy

1. Assessment and Justification:
   • All proposed modifications must be adequately assessed in terms of necessity, impact, risks, and benefits.
   • A clear justification for the change must be documented.
2. Planning and Design:
   • A detailed plan for change implementation must be developed, including schedules, resources, responsibilities, and contingency measures.
3. Communication:
   • Stakeholders affected by the change must be informed in advance, and their opinions and concerns must be considered in the planning process.
4. Approval:
   • All significant changes must undergo a formal approval process, involving relevant stakeholders and, when necessary, senior management.
5. Implementation and Monitoring:
   • The change must be implemented as planned and monitored to ensure successful execution and achievement of desired objectives.
6. Post-Implementation Review:
   • After implementation, a review must be conducted to assess the effectiveness of the change and identify lessons learned.
7. Documentation:
   • All changes and their associated details must be documented and archived for future reference.
8. Training and Education:
   • Where appropriate, training must be provided to ensure that employees are prepared and equipped to handle the change.

Responsibilities

• The project manager or leader is responsible for initiating, planning, and implementing the change.
• The change management team is responsible for overseeing the process, providing guidance, and ensuring policy compliance.
• All employees are responsible for cooperating and adapting to changes as necessary.

Conclusion

Effective change management is crucial to ensure that Nuveto remains agile, resilient, and capable of meeting the constantly evolving demands of the market. This policy aims to ensure a structured, transparent, and well-managed approach to all changes, maximizing benefits and minimizing risks.

Nuveto’s Privacy and Data Protection Policy

Introduction

Nuveto, a specialist in consulting, development, and cloud software distribution for customer experience and service, is committed to protecting the privacy and security of personal data of its customers, partners, employees, and users. This policy highlights our commitment to treating personal data with the utmost respect, transparency, and compliance with applicable laws and regulations.

Objective

To define clear guidelines on how we collect, use, store, and protect personal data, ensuring the rights of data subjects and maintaining the trust of all our stakeholders.

Scope

This policy covers all personal data processed by Nuveto, regardless of the medium or format.

Privacy and Data Protection Policy

1. Data Collection:
   • Personal data will be collected fairly, legally, and transparently, and only with the explicit consent of the data subject, unless otherwise required by law.
2. Use of Data:
   • Personal data will be used only for the purposes for which it was collected and in accordance with the consent provided by the data subject.
3. Purpose Limitation:
   • Personal data will not be processed in a manner incompatible with the purposes for which it was collected.
4. Data Minimization:
   • Only the necessary personal data for specific purposes will be collected and processed.
5. Security and Protection:
   • Appropriate technical and organizational measures will be implemented to protect personal data against loss, unauthorized access, alteration, and destruction.
6. Storage and Retention:
   • Personal data will be securely stored and only for the time necessary for the purposes for which it was collected or as required by law.
7. Data Subject Rights:
   • Data subjects have the right to access, correct, delete, port their data, and withdraw their consent at any time.
8. International Transfers:
   • Personal data will only be transferred to countries or territories that offer an adequate level of protection, in compliance with applicable laws and regulations.
9. Responsibility and Governance:
   • Nuveto is responsible for ensuring compliance with this policy and applicable laws and regulations, and will implement appropriate governance structures to oversee data processing activities.
10. Reviews and Updates:
    • This policy will be reviewed and updated periodically to reflect changes in laws, practices, and business needs.

Responsibilities

• Nuveto’s data protection team is responsible for monitoring compliance with this policy and applicable laws.
• All employees and partners of Nuveto are responsible for ensuring that personal data is handled in accordance with this policy.

Conclusion

Privacy and protection of personal data are fundamental to the trust and integrity of Nuveto. We are committed to respecting the rights of data subjects and maintaining the highest standards of compliance and security.

Nuveto Password Policy

Introduction

Information security is a priority for Nuveto, and proper protection of access credentials, including passwords, plays a fundamental role in this context. This policy establishes guidelines for the creation, management, and use of passwords at Nuveto, ensuring protection against unauthorized access.

Objective

To define standards and requirements for the creation, use, storage, and updating of passwords to ensure the security of Nuveto’s information and systems.

Scope

This policy applies to all employees, service providers, partners, and anyone accessing Nuveto’s systems and information.

Password Policy

1. Complexity:
   • Passwords must be at least 12 characters long and include a combination of uppercase letters, lowercase letters, numbers, and special symbols.
2. Expiry:
   • Passwords must be changed every 90 days. Temporary or reset passwords must be changed upon first access.
3. Password History:
   • The last five used passwords cannot be reused.
4. Storage and Transmission:
   • Passwords should never be stored in plaintext or transmitted through insecure means such as emails or text messages.
5. Multi-Factor Authentication:
   • Whenever possible, multi-factor authentication (MFA) should be implemented to add an additional layer of security.
6. Sharing:
   • Passwords are personal and non-transferable. They should never be shared or used by more than one person.
7. Access Logging:
   • All login attempts, as well as password changes, will be logged and monitored for suspicious activities.
8. Password Recovery:
   • Password recovery or reset processes must be secure and include identity verification measures.
9. Account Lockout:
   • After three failed login attempts, the account will be automatically locked, requiring administrator intervention or a recovery process to unlock.
10. Education and Awareness:

• Employees and partners will regularly receive training and information on the importance of password security and best practices.

Responsibilities

• Nuveto’s IT security team is responsible for ensuring the implementation and monitoring of this policy.
• All users are responsible for following the guidelines set forth in this policy and protecting their access credentials.

Conclusion

Passwords are one of the first lines of defense against unauthorized access. Proper password management is essential to ensuring the security and integrity of Nuveto’s systems and information.

Nuveto Security Incident Response Policy

Introduction

Nuveto, as a leader in cloud software consulting, development, and distribution for customer experience and support, understands that despite all prevention efforts, security incidents can occur. This policy defines procedures and responsibilities to effectively respond to such incidents and minimize potential damages.

Objective

To establish clear guidelines for identifying, managing, responding to, and learning from security incidents, ensuring quick and effective recovery while minimizing negative impacts.

Scope

This policy applies to all security incidents that may affect Nuveto’s systems, data, operations, or reputation.

Security Incident Response Policy

1. Detection and Reporting:
   • All systems must have incident detection mechanisms.
   • Any suspicion or identification of a security incident must be reported immediately to the responsible team.
2. Assessment and Prioritization:
   • Reported incidents will be assessed based on severity, impact, and urgency. They will be prioritized accordingly.
3. Containment:
   • Immediate measures will be taken to contain the incident and minimize damage. This may include isolating affected systems or revoking access.
4. Investigation and Analysis:
   • A detailed investigation will be conducted to understand the cause, nature, and extent of the incident.
5. Eradication and Recovery:
   • The root cause of the incident will be identified and eradicated. Affected systems will be restored and verified to ensure their integrity.
6. Communication:
   • Internal stakeholders will be informed about the incident. If necessary and according to applicable laws, customers, regulators, and the general public will be notified.
7. Documentation and Logging:
   • All incident details, including response, investigation findings, and decisions made, will be documented and archived.
8. Review and Learning:
   • The incident management team will conduct regular reviews to assess the effectiveness of the process, identify areas for improvement, and adapt to changes in the threat landscape.
9. Education and Training:
   • Employees will receive regular training on how to identify and respond to security incidents.

Responsibilities

• Nuveto’s incident response team is responsible for managing and responding to security incidents.
• All Nuveto employees and partners are responsible for immediately reporting any suspicion of a security incident.

Conclusion

The ability to respond quickly and effectively to security incidents is crucial for Nuveto’s resilience and reputation. This policy aims to ensure a structured and effective approach to managing and learning from security incidents.

Nuveto Vulnerability Management Policy

Introduction

Nuveto, renowned for its expertise in cloud software consulting, development, and distribution for customer experience and support, understands that vulnerability management is a critical component for maintaining information security. This policy establishes guidelines for the identification, assessment, and remediation of vulnerabilities that may affect the company’s resources.

Objective

To establish a structured and consistent process for identifying, assessing, prioritizing, and remediating vulnerabilities, ensuring the continuous protection of Nuveto’s systems, data, and operations.

Scope

This policy applies to all systems, applications, networks, and devices under Nuveto’s responsibility or ownership.

Vulnerability Management Policy

1. Identification:
   • Nuveto will use appropriate tools and techniques, including vulnerability scanners and penetration testing, to identify vulnerabilities in its systems and networks.
2. Assessment and Classification:
   • Identified vulnerabilities will be assessed based on their severity, potential impact, and known exploitation in the environment.
   • They will be classified as Critical, High, Medium, or Low.
3. Prioritization:
   • Vulnerability remediation will be prioritized based on their classification, with initial emphasis on critical and high-severity vulnerabilities.
4. Remediation:
   • Appropriate measures will be taken to remediate identified vulnerabilities, either through patches, configurations, or alternative solutions.
5. Verification:
   • After remediation, systems will be re-evaluated to ensure that vulnerabilities have been properly addressed and that there are no negative impacts resulting from the actions taken.
6. Communication:
   • Relevant stakeholders, including management and system owners, will be informed about identified vulnerabilities, their severity, and planned or taken actions.
7. Review and Learning:
   • The vulnerability management team will conduct regular reviews to assess the effectiveness of the process, identify areas for improvement, and adapt to changes in the threat landscape.
8. Education and Awareness:
   • Employees and collaborators will be regularly informed and trained on the importance of vulnerability management and their related responsibilities.

Responsibilities

• Nuveto’s vulnerability management team is responsible for coordinating and overseeing all activities related to the identification, assessment, remediation, and communication of vulnerabilities.
• System and application owners are responsible for ensuring that vulnerabilities in their respective domains are properly addressed and remediated.

Conclusion

Effective vulnerability management is essential for the continuous protection of Nuveto’s resources and operations. This policy aims to ensure a proactive, structured, and responsible approach to addressing and managing vulnerabilities.

Nuveto Risk Acceptance Policy

Introduction

Nuveto, specialized in cloud software consulting, development, and distribution for customer experience and support, acknowledges that decision-making in the business world inevitably involves facing risks. This policy establishes the parameters and procedures for the formal acceptance of risks that cannot be avoided, mitigated, or transferred.

Objective

To establish a structured process for evaluating, documenting, and accepting risks in an informed manner, ensuring that accepted risks are aligned with Nuveto’s strategy, risk appetite, and objectives.

Scope

This policy encompasses all risks associated with projects, operations, technology, or any other area of Nuveto’s activities that have been identified but not fully mitigated.

Risk Acceptance Policy

1. Identification and Assessment:
   • All identified risks that cannot be fully mitigated must be assessed in terms of probability, impact, and consequences for Nuveto.
2. Documentation:
   • Risks proposed for acceptance must be clearly documented, including details about their nature, causes, potential impacts, and reasons for acceptance.
3. Review:
   • Risk acceptance must be reviewed by a multidisciplinary team, including representatives from affected areas and risk management experts.
4. Approval:
   • Formal risk acceptance must be approved by a risk management committee or, depending on severity, by top management.
5. Communication:
   • Accepted risks and their justifications must be communicated to relevant stakeholders, ensuring transparency and understanding among all involved parties.
6. Monitoring:
   • Accepted risks must be regularly monitored to ensure they remain within acceptable parameters and to identify any changes that may require a review of the acceptance decision.
7. Periodic Review:
   • The policy and accepted risks must be periodically reviewed to ensure they are aligned with changes in the business environment, strategy, and risk appetite of Nuveto.

Responsibilities

• Nuveto’s risk management team is responsible for coordinating the risk acceptance process, including assessment, documentation, and communication.
• Department or project leaders are responsible for identifying risks in their areas, assessing them, and submitting them to the acceptance process when appropriate.

Conclusion

Informed and structured risk acceptance is crucial for innovation and sustainable growth. This policy aims to ensure that Nuveto does so responsibly, aligned with its vision and objectives.

Nuveto LGPD Compliance Policy

Introduction

Nuveto, serving as a leading figure in cloud software consulting, development, and distribution for customer experience and support, is committed to protecting the privacy and personal data of its customers, partners, employees, and users. In compliance with the General Data Protection Law (LGPD), this policy establishes clear guidelines to ensure the appropriate treatment and protection of personal data.

Objective

To define principles, guidelines, and practices to ensure the treatment and protection of personal data in accordance with the LGPD, promoting transparency, integrity, and confidentiality of data processed by Nuveto.

Scope

This policy applies to all personal data processing activities carried out by Nuveto, encompassing all operations performed in its systems, processes, and operations.

LGPD Compliance Policy

1. Data Treatment Principles:
   • Nuveto will follow the principles established by the LGPD, including purpose, adequacy, necessity, transparency, security, prevention, non-discrimination, and accountability.
2. Consent:
   • Personal data processing will only be carried out with the explicit consent of the data subject, unless legally provided otherwise.
3. Data Subject Rights:
   • Nuveto will guarantee data subject rights, including access, correction, deletion, portability, consent withdrawal, among others.
4. Transparency:
   • The right to clear and accurate information about data processing will be ensured, including purpose, manner, and duration, identification of the controller, and information about sharing.
5. Limitation of Use:
   • Personal data will be used only for the purposes informed to the data subject and according to the granted consent.
6. Security and Confidentiality:
   • Technical and administrative measures will be adopted to protect personal data from unauthorized access, losses, alterations, or any form of improper treatment.
7. Data Transfer:
   • The transfer of personal data to third parties, whether for processing or storage, will be carried out in accordance with the LGPD, ensuring the same level of protection.
8. Review and Update:
   • Processes and systems will be regularly reviewed and updated to ensure ongoing compliance with the LGPD and to adapt to any changes in legislation.
9. Responsibility and Governance:
   • Nuveto will establish a data governance structure, including the appointment of a Data Protection Officer (DPO), to oversee and ensure compliance with the LGPD.
10. Education and Awareness:
    • Ongoing training and awareness-raising activities will be conducted for all Nuveto collaborators regarding LGPD guidelines and obligations.

Responsibilities

• The Data Protection Officer (DPO) will be responsible for monitoring, guiding, and ensuring compliance with this policy and the LGPD.
• All Nuveto collaborators, partners, and service providers are responsible for ensuring the appropriate treatment of personal data and following the guidelines of this policy.

Conclusion

Protecting personal data and respecting privacy are fundamental values of Nuveto. This policy reaffirms our commitment to acting transparently, with integrity, and in full compliance with the LGPD.

Nuveto GDPR Compliance Policy

Introduction

Nuveto, established as a global leader in cloud software consulting, development, and distribution for customer experience and support, is committed to protecting the privacy and personal data of its customers, partners, employees, and users in all regions where it operates. In compliance with the European Union’s General Data Protection Regulation (GDPR), this policy establishes standards and guidelines to ensure the appropriate treatment and protection of personal data.

Objective

To establish a set of principles, guidelines, and practices to ensure the treatment and protection of personal data in accordance with the GDPR, promoting transparency, integrity, and confidentiality of data processed by Nuveto.

Scope

This policy applies to all personal data processing activities related to individuals in the European Union, encompassing all operations performed in its systems, processes, and operations.

GDPR Compliance Policy

1. Data Treatment Principles:
   • Nuveto will adhere to the fundamental principles of the GDPR, including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, and integrity and confidentiality.
2. Consent:
   • Personal data processing will only be carried out with the explicit and informed consent of the data subject, which can be withdrawn at any time.
3. Data Subject Rights:
   • Nuveto will recognize and facilitate the exercise of data subject rights under the GDPR, including access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, and objection.
4. Transparency:
   • The right to clear and accessible information about data processing will be ensured, including purposes, legal basis, and retention period.
5. Limitation of Use:
   • Personal data will be collected only for specific, explicit, and legitimate purposes and will not be processed in a manner incompatible with these purposes.
6. Data Protection by Design and by Default:
   • Nuveto will adopt a “data protection by design” approach in all its operations and developments, ensuring that privacy is integrated into all products, services, and processes from the outset.
7. International Transfers:
   • The transfer of personal data outside the European Union will be carried out in accordance with the provisions of the GDPR, ensuring an adequate level of protection.
8. Data Protection Impact Assessment (DPIA):
   • For processing operations that may result in a high risk to the rights and freedoms of individuals, a DPIA will be conducted to assess and mitigate these risks.
9. Responsibility and Governance:
   • Nuveto will establish a data governance structure, appointing a Data Protection Officer (DPO) for the European Union region, responsible for overseeing and ensuring compliance with the GDPR.
10. Data Breaches:
    • In the event of a personal data breach, Nuveto will notify the supervisory authorities and the affected individuals, as required by the GDPR.

Responsibilities

• The Data Protection Officer (DPO) will be responsible for ensuring compliance with this policy and the GDPR.
• All Nuveto collaborators, partners, and service providers involved in the processing of data of individuals in the European Union are responsible for following this policy and the GDPR guidelines.

Conclusion

Respecting and protecting the privacy rights of individuals is a priority for Nuveto. This policy reaffirms our commitment to GDPR compliance and the protection of personal data of our customers, partners, and users in the European Union.

Review and Update

The policies described in this document will be reviewed and updated periodically to ensure their ongoing compliance with regulations, market adherence, customer needs, as well as to reflect Nuveto’s best practices and strategic changes. The policies take effect immediately and will remain in force until further review or update.