Privacy Policy

Personal Data Collection

• We collect Personal Data directly from you when you register for an account, subscribe to our services, or interact with our Platform. We may also collect certain information automatically when you visit our website, such as IP address, browser type, and usage data.

Types/Categories of Personal Data that may be Processed

• Registration data: During account creation, we collect your name, email address, and phone number;
• Navigation data: IP address, access times, and cookie identifiers used to improve our service;
• Usage data: Information about how you interact with our platform.

Legal Bases and Purposes of Personal Data Processing

• All Personal Data is processed ethically, according to security and confidentiality standards applicable to our market and in accordance with applicable legislation. The main purposes include: - Compliance with legal and regulatory obligations;
• Execution of contracts and procedures related to them;
• Legitimate interest in risk analysis, fraud prevention, service improvement, and marketing activities;
• Defense of rights in judicial, administrative, or arbitral proceedings;
• Credit analysis and protection;
• Prevention of fraud and security of Data Subjects;
• Collection of consent for specific cases.

Sharing of Personal Data

• Respected legal limits, Personal Data we Process may be shared with: - Partners and Affiliates, for offering Solutions and Platforms, credit analysis, marketing activities, and fraud prevention;
• BCB-authorized institutions and payment market participants;
• Service providers, vendors, and commercial partners, in Brazil and abroad;
• Public authorities to comply with legal and regulatory obligations;
• New businesses in case of mergers or acquisitions.

International Transfer of Personal Data

To meet security and Personal Data protection standards compatible with our market, international transfer of your Personal Data may occur. We may use partners located abroad that offer technical infrastructure or international payment arrangements. In these cases, we will adopt measures in accordance with regulations and our policies, always observing principles, Data Subject rights, and the Personal Data protection regime.

Security and Confidentiality of Personal Data

We implement security measures to protect our systems and Personal Data databases according to international standards such as PCI-DSS, ABNT NBR ISO/IEC 27001, and NIST. Measures include: Personal Data encryption, access control, firewalls, internal security policies, periodic penetration testing, and vulnerability analysis. Despite our efforts, considering the nature of the internet, we cannot guarantee that malicious agents will not be able to access or misuse your Personal Data.

Personal Data Retention Period

Personal Data will be Processed for the time necessary for activity execution, observed the need and relevance for Processing purposes, security measures in our policies, and applicable Contract and regulatory provisions. Retention must be justifiable depending on the Processing purpose and observe regulatory retention periods.

Data Subject Rights

• When acting as Controllers, we ensure the exercise of your applicable rights: - Information and access to your Personal Data;
• Correction or updating of inaccurate data;
• Anonymization, blocking, and/or deletion;
• Portability;
• Information about sharing with public and private entities;
• Possibility of not providing consent;
• Revocation of consent;
• Opposition to Processing;
• Review of automated decisions. You may exercise your rights through our Privacy Portal.