Folder permissions

Hello! I developed an application using CI3. In this application, I upload files to /localhost/application/files.
I use GroceryCrud to list download links to the files. Everything OK, I can download with "force_download" function.

But, when I try to embed the file in a view (PDF files) I get :

You don't have permission to access /ci/application/files/03-020-00001-ENC.pdf on this server.

from Apache server (WAMP running on Windows).

I'm looking for advice on how to solve this. Is it unsafe to store files out of "Application" folder?. Is it a best practice?. How can I set permissions to allow my view to get the PDF file?.

Regards.