Business Contingency and Continuity Plan

This document aims to present the planning and implementation of the Business Continuity Plan (BCP), identifying the procedures and alternative infrastructure to protect data, companies, people, reputation, values, and commitments to all related parties.

This plan is developed to assist in preventing the impacts of extreme events such as natural disasters, accidents, equipment failures, security breaches, service disruptions, and international actions that may potentially hinder the normal course of service provision.

Our plan controls the deployment, maintenance, and updating of the business continuity program within the internal areas of Go AdOpt, LLC.

It's like an insurance policy that we never want to activate.

However, it is a plan that becomes essential during moments of crisis and difficulties.

This plan enables AdOpt, LLC to always work with focus and full responsibility for the continuity of services, without causing any harm or additional effort to our clients.

We proceed with the listing of the areas involved in our Business Continuity Plan and their respective internal agents. The premise used is to involve all operational areas of the business with their key leaders and technical executors from Go AdOpt, LLC, thus meeting the operational needs, both ordinary and extraordinary, caused by potential extreme impacts.

2.1 - The company is divided into three areas with their respective fronts of action:

• 1. Management and Operations.
  • I. Strategy
  • II. Human Resources
  • III. Finance and Compliance
• 2. Information Technology
  • I. Product and User Experience
  • II. Front-end
  • III. Back-end
• 3. Communication and Customer Service
  • I. Internal and External Communication
  • II. Customer Relationship and Support

2.2 - The criteria used for the selection of internal agents are based on the satisfactory performance of six professional competencies:

• 1. Applied technical knowledge - Macro:
  • A thorough understanding of the legislation, mission, vision, and values of Go AdOpt, LLC, in relation to the company's responsibilities with its technology product and services to its clients and society.
• 2. Applied technical knowledge - Micro:
  • A comprehensive understanding of the market problem and solution offered by Go AdOpt, LLC's technology, including its technical applications in various niches, locations, and implementation environments.
• 3. Clear and effective communication:
  • The ability to communicate and interact with colleagues and clients in a clear and concise manner. Even when using metaphors and figures of speech, the professional's communication enables the understanding of technical and abstract aspects and their relevance to individuals from other areas.
• 4. Autonomy in day-to-day decision-making:
  • The ability to discern risk situations or opportunities in the daily operation. The professional makes decisions independently, always seeking improvements and corrections, reinforcing the company's mission, vision, and values.
• 5. Agility in delivering results under pressure:
  • The ability to complete and prioritize critical tasks, with flexibility in adjusting schedules, even at a personal level, in favor of an emergency solution.
• 6. Interdisciplinarity:
  • The ability to facilitate dialogue between various disciplines and departments within the company, demonstrating, through their actions, the clear connections between activities across departments and the shared risks or benefits to all.

• Adonis Batista - [email protected]
• João Bruno Soares - [email protected]
• Cristiano D'Avila - [email protected]
• Lucas Kenji - [email protected]
• Bruno Godoi - [email protected]
• Matheus Cavinato - [email protected]
• Pedro Victor Soares - [email protected]

3.1 Management and Operations - [email protected] / [email protected]

• 1. Strategy
  • Adonis Batista
  • João Bruno Soares
  • Cristiano D'Avila
• 2. Human Resources
  • Adonis Batista
  • João Bruno Soares
  • Cristiano D'Ávila
• 3. Finance and Compliance
  • Adonis Batista
  • João Bruno Soares
  • Cristiano D'Avila

3.2 Information Technology - [email protected]

• 1. Product and User Experience
  • Adonis Batista
  • Cristiano D'Avila
• 2. Front-end
  • Adonis Batista
  • Cristiano D'Avila
  • Matheus Cavinato
• 3. Back-end
  • Adonis Batista
  • Cristiano D'Avila
  • Lucas Kenji
  • Bruno Godoi

3.3 Communication and Customer Service - [email protected]

• 1. Internal and External Communication
  • Adonis Batista
  • João Bruno Soares
  • Pedro Victor Soares
• 2. Customer Relationship and Support
  • João Bruno Soares
  • Pedro Victor Soares
  • Fernanda de Lima

Following the same division of areas and their respective responsible agents, the key activities of each area are listed below, especially in the context of an extreme crisis. These activities are prioritized to ensure the minimum necessary to maintain the same quality in deliveries and processes, along with the maximum downtime and/or responsiveness for each of them.

It is worth noting that Go AdOpt, LLC is a 100% digital company where all professionals have been working remotely since its inception, often in an asynchronous manner. Therefore, excellent internal communication and diligence among agents are highly valued.

Department	Area	Priority	Activity	Response time / Hours
Management and Operations	Strategy	1	Maintenance of key partnership, client, and supplier contracts.	Up to 12 hours
Management and Operations	Strategy	2	Full compliance and adequacy of Go AdOpt, LLC's products and services to regulations and updates issued by regulatory agencies such as ANPD, ICO, among others.	12 hours for sizing and planning; 24 hours for action plan development; 3 days for documentation adjustments and internal training; 15 days for platform implementation and service flow testing
Management and Operations	HR	1	Full compliance with employment contracts, rights, and benefits.	Up to 12 hours
Management and Operations	HR	2	Maintenance of organizational climate and employee wellbeing.	Up to 12 hours
Management and Operations	Finance & Compliance	1	Balance and austere maintenance of cash and financial resources in the short, medium, and long term.	Up to 12 hours
Management and Operations	Finance & Compliance	2	Timely training and capacity building of professionals in response to updates issued by regulatory agencies.	Up to 12 hours
Management and Operations	Finance & Compliance	3	Access to emergency credit lines.	Up to 7 days
Information Technology	Product & UX	1	Speed and responsiveness of the platform and installed notices.	According to the Terms of Use: Service Level Agreement (SLA) requires AdOpt to maintain the AdOpt Platform available for access for a minimum of 99% (ninety-nine percent) of the time during the duration of the relationship between the parties, excluding the 1% (one percent) not covered by the SLA. Correction and technical support - SLA: 4 hours for Enterprise plans; 16 hours for Business plans; 36 hours for Starter plans
Information Technology	Product & UX	2	Issuance of reports and transactional messages.
Information Technology	Product & UX	3	100% delivery of requests from data subjects.
Information Technology	Product & UX	4	Accesses and credentials maintained securely.
Information Technology	Front end	1	Translation of the notice into the visitor's language.
Information Technology	Front end	2	Format adjustment based on legislation/localization.
Information Technology	Front end	3	Maintenance of custom classes and styles setup.
Information Technology	Back end	1	Encrypted registration and storage of consents.
Information Technology	Back end	2	100% responsiveness to API requests.
Information Technology	Back end	3	Manual, authenticated, and scheduled scanner.
Information Technology	Back end	4	Maintenance of journey events and platform usage.
Information Technology	Back end	5	Maintenance of integration between the system and communication tools.
Communication and Support	Internal & External Communication	1	Maintenance of internal communication channels.
Communication and Support	Internal & External Communication	2	Maintenance of automation tools and personalized message triggers.
Communication and Support	Internal & External Communication	3	Maintenance of internal system bots and alerts.
Communication and Support	Customer support and relationship	1	Maintenance of SLA via WhatsApp groups.
Communication and Support	Customer support and relationship	2	Maintenance of SLA via email.
Communication and Support	Customer support and relationship	3	Maintenance of SLA via chat.

As mentioned earlier, Go AdOpt, LLC is a 100% digital company that has had a team of professionals working remotely since its foundation. This fact tends to minimize some risk and emergency situations.

AdOpt's technology and its contingency within Azure - Infrastructure Cloud provider.

• 1. Availability guarantee: Microsoft Azure offers a 99.9% availability guarantee for its core services, such as virtual machines, storage, database, and networking.
• 2. Disaster recovery: Microsoft Azure provides various options for disaster recovery, including data replication across multiple geographic regions, data backup and recovery, and automated failover services.
• 3. Encryption: Microsoft Azure uses end-to-end encryption to protect data in transit and at rest. The platform is compliant with multiple compliance standards, including HIPAA, PCI DSS, and ISO 27001.
• 4. Monitoring and alerts: Microsoft Azure offers advanced monitoring and alerting capabilities to help detect and resolve issues quickly.
• 5. Technical support: Microsoft Azure provides 24/7 technical support via phone, email, and live chat.
• 6. Backup policy: Consent data backups are automatic and continuous, with redundancy in different geographic regions.

Our most critical services run on virtualized Kubernetes clusters, which self-manage to handle workload demands or software failures. We also maintain a redundant cluster in the Amazon Web Services (AWS) cloud, which takes over traffic after automatic failover in case of any issues in Azure. The redirection is done by a Load Balancer operating at the DNS level.

To deal with cyber attacks, our contingency plan includes:

• Identification of the breach
• Isolation of the threat
• Impact analysis
• Notification to relevant authorities
• Communication with clients and other stakeholders
• Data recovery
• Update of security measures
• Lessons learned analysis
• However, we acknowledge the following situations in order of severity that may trigger partial or full implementation of this plan:

Low and/or controlled risk

• Commuting accidents between home and workplace
• Strikes and public transportation disruptions
• Theft and loss of computers and peripherals during professional travel
• Pandemics/lockdowns/quarantines
• Equipment failures
• Employee strikes

Medium risk

• Security breaches
• Loss of services and international actions
• Cloud provider contingency and redundancy

High risk

• Invasion, hacking, and security breaches
• Internet network outage
• Computer failures
• Extinction of data protection laws
• Coup d'état or drastic government changes.