Compliance Policy and Code of Conduct

1. Why this exists, and what it is

We are a small company in Cruzeiro do Sul, in the Brazilian Amazon, serving retail, industry and public bodies across the state of Acre. Companies our size tend to assume compliance is a multinational's concern — which is exactly how the problem arrives: a commitment nobody wrote down cannot be enforced on anybody. As long as "we don't pay bribes here" is something everyone assumes, there is no rule to point at when someone does otherwise.

This policy applies to partners, employees, interns and contractors acting on behalf of Nauas Tech. It does not replace the law or the employment contract; it adds to them.

2. Dealing with public bodies

This is the most important section, because it is where a mistake costs the most — for the public body, for the official and for the company. Law 12.846/2013 imposes strict liability on the legal entity: the company answers for acts done on its behalf, even if the partners did not know.

3. Gifts and hospitality

• With public officials: nothing. No seasonal gift, no lunch, no trip to a manufacturer's event. The rule is absolute because a rule with exceptions becomes an argument about the value of the gift.
• With private customers: branded items of token value (a pen, a calendar, a shirt) are acceptable. A gift that could be read as a trade of favours is not.
• Received from suppliers: manufacturer training and certification are welcome, because they are work. Travel, expensive gifts or personal benefits that would influence what we recommend to a customer are not.

4. Conflicts of interest

A conflict is not wrongdoing — concealing it is. Anyone in a position where a personal interest could influence a company decision tells management before deciding, and steps out of the decision. This covers:

• family or close relationships with a customer, supplier or public official involved in a procurement;
• an ownership interest in a competitor or supplier;
• outside work that uses Nauas Tech's knowledge, equipment or customers;
• recommending a supplier from which one stands to gain personally.

5. Competition

We compete on price, lead time and technical quality. We do not fix prices, do not allocate markets, and do not sell by disparaging competitors. When we point out a fault in a system installed by another company, it is with the equipment in front of us and the defect described — a technical criticism can be demonstrated; gossip cannot.

6. Customer data and confidentiality

Our work gives us access to things that are not ours: the cameras in a shop, the server in an office, the finances of whoever uses our software. That requires more than good manners.

• We access the minimum needed to resolve the ticket, and record the access in the work order.
• We do not copy, export or discuss with third parties any customer recording, file or information.
• We do not use what we saw at one customer to sell to another.
• Anyone with access to customer data signs a confidentiality undertaking, which survives the end of their employment.
• When someone leaves, every access is revoked the same day — password, biometrics, open sessions and mobile notifications.

The detail is in the Privacy and Data Protection Policy.

7. Records, money and documents

• Every sale and every service is recorded in the system, with an invoice where one is due.
• There is no off-the-books cash, no unrecorded payment and no expense without a document.
• Qualification documents — tax clearance certificates, financial statements, references — are always genuine and current. An expired certificate is a reason not to bid, never a reason to improvise.
• The validity of each document is tracked by a system that warns before expiry.

8. People

• We do not tolerate moral or sexual harassment, or discrimination on grounds of race, colour, gender, origin, religion, age, disability or sexual orientation.
• We do not employ children or young people outside what the law permits, nor contract suppliers who do.
• Occupational safety is an obligation, not a preference: anyone climbing a pole, a roof or a ladder uses protective equipment. A technician has the right to refuse work in unsafe conditions, and doing so carries no penalty.
• Working hours, pay, advances and deductions are recorded and available for the person concerned to consult.

9. Reporting channel

• Reports may be anonymous. An unsigned report is still investigated — what matters is whether the fact can be verified.
• No retaliation. Anyone reporting in good faith suffers no consequence for it, even if the report is not ultimately substantiated. Retaliation is itself a breach of this policy.
• Response. We acknowledge receipt within 5 working days and inform the outcome to anyone who identified themselves.

Being a small company, reports are investigated by management. If a report concerns management itself, the reporter may go directly to the competent authorities — the Public Prosecutor's Office, the Court of Accounts, or the ombudsman of the contracting public body. This document does not ask for silence about unlawful conduct, and could not.

10. Consequences of a breach

Depending on severity, and without the gradation preventing direct application of the most severe measure: recorded guidance, written warning, suspension, dismissal for cause and — where an offence has occurred — referral to the authorities. For a supplier or contractor: termination of the contract.

A breach by a partner or director is measured on the same scale. A policy that only binds those further down is not a policy.

11. Keeping this policy alive

• Everyone joining the team reads it and signs for receipt.
• It is reviewed at least annually, and whenever the law changes.
• It is published here, open to customers, suppliers and contracting bodies.
• The current version and its date appear at the top; previous versions are retained.