Privacy Policy
DEFINITIONS
All capitalized terms in this Policy shall have the meanings listed below:
"Affiliate" means, in relation to ATTRUS, any Subsidiaries, Parent Companies, companies under common control and other companies that are part of its economic group;
"ANPD" means the National Data Protection Authority;
"BCB" means the Central Bank of Brazil;
"Customer" means the natural person contracting the Products and Services;
"Employee" means any and all individuals or legal entities that hold a position, function, position, corporate, employment, professional, contractual or trust relationship with ATTRUS;
"Control" when used in relation to a person, means, (i) the ownership (direct or indirect) of rights of partner, shareholder or quotaholder, held individually or jointly with a group of persons bound by a voting agreement (or relationship of any nature) or under common control, which ensure, directly or indirectly, on a permanent basis, the majority of votes in the resolutions of the general meeting or similar deliberative body of a particular person; and (ii) the power to elect the majority of the members of the board of directors, the executive board or other superior deliberative body, or to define the voting orientation within the scope of any person, whether by virtue of equity interest, by contract or any other means. Derived terms of Control, such as "Subsidiary" and "Parent", shall have the meaning analogous to Control;
"Personal Data" means all information related to an identified or identifiable natural person, according to article 5, item I, of the General Data Protection Law, including, for the purposes of this Policy, for example, registration, biometric, contact, banking and financial, transactional and means of payment, location and internet browsing data;
"Person in charge" means the person appointed by the controller and operator to act as a communication channel between the controller, the data subjects and the ANPD, as indicated in section 15 below and in article 5, item VIII, of the General Data Protection Law;
"ATTRUS" means ATTRUS Instituição de Pagamento S/A., ATTRUS US LLC, FPay Internacional S.A. de CV., FPay Colombia S.A., FacilitaPay Chile SPA, together or individually;
"General Data Protection Law" means Law Nº 13,709, of August 14, 2018, as amended;
"Partners and Service Providers" means individuals or legal entities that provide services of any nature to ATTRUS, commercial or not, paid or unpaid, on an occasional or permanent basis, including, but not limited to, participants in payment arrangements and other service providers in general;
"PEPs" means: (i) the holders of elective mandates of the Executive and Legislative Branches of the Union; (ii) the occupants of a position, in the Executive Branch of the Union, of: (a) Minister of State or equivalent; (b) Special or equivalent nature; (c) president, vice-president and director, or equivalent, of indirect public administration entities; and (d) Superior Management and Advisory Group (DAS), level 6, or equivalent; (iii) the members of the National Council of Justice, the Federal Supreme Court, the Superior Courts, the Federal Regional Courts, the Regional Labor Courts, the Regional Electoral Courts, the Superior Council of Labor Justice and the Federal Justice Council; (iv) the members of the National Council of the Public Prosecutor's Office, the Attorney General of the Republic, the Deputy Attorney General of the Republic, the Attorney General of Labor, the Attorney General of Military Justice, the Deputy Attorneys General of the Republic and the Attorneys General of the States and the Federal District; (v) the members of the Federal Court of Accounts, the Attorney General and the Deputy Attorneys General of the Public Prosecutor's Office at the Federal Court of Accounts; (vi) the presidents and national treasurers, or equivalent, of political parties; (vii) the Governors and the Secretaries of State and of the Federal District, the State and District Deputies, the presidents, or equivalent, of state and district indirect public administration entities and the presidents of Courts of Justice, Military Courts, Courts of Accounts or equivalent of the States and the Federal District; (viii) the Mayors, the Councilors, the
Municipal Secretaries, the presidents, or equivalents, of entities of the indirect municipal public administration and the Presidents of Courts of Auditors or equivalents of the Municipalities; (ix) persons who, abroad, are: (a) heads of state or government; (b) politicians of higher echelons; (c) occupants of government positions of higher echelons; (d) general officers and members of higher echelons of the Judiciary; (e) senior executives of public companies; or (f) leaders of political parties; and (x) the directors of senior levels of public or private international law entities;
"ATTRUS Platform" has the meaning given in section 2 below;
"Privacy Policy" or "Policy" means this privacy and personal data protection policy;
"Products and Services" means the following products and services: (i) offering a prepaid payment account to Customers (residents and non-residents) that provides payment transactions based on such account, including instant transactions through the PIX payment arrangement; (ii) issuance of prepaid and virtual cards, for general use, which can be used by Customers in closed payment arrangements established by ATTRUS and/or open payment arrangements established by payment arrangement institutions; (iii) provision of payment services or international transfers (eFX) to Clients, enabling (a) the acquisition of goods and services, in Brazil or abroad, which occurs in (1) personhood; or (2) through a payment solution offered by ATTRUS and integrated with the e-commerce platform; (b) unilateral transfers limited to US$10,000.00 (ten thousand US dollars) or its equivalent in other currencies; (c) transfer of funds between an account in Brazil and an account abroad of the same ownership, limited to US$10,000.00 (ten thousand US dollars) or its equivalent in other currencies; or (d) withdrawal in Brazil or abroad; (iv) Clients' ready foreign exchange operations of up to US$100,000.00 (one hundred thousand U.S. dollars) or the equivalent in other currencies, except for transfers related to the trading of derivative instruments abroad; and (v) [automated billing system;
"Terms and Conditions" have the meaning given in section 2 below;
"Data Subjects" means the Customers and/or legal representatives of legal entities that have contracted Products and Services, to whom the Personal Data that is the object of Processing refers, according to article 5, item V, of the General Data Protection Law, which allows us access to their Personal Data and/or who provides their Personal Data through relationship channels or public access, including but not limited to email, telephone, video conferences, apps, or social media; and
"Processing" means any operation carried out with Personal Data, such as those referring to the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, elimination, evaluation or control of information, modification, communication, transfer, dissemination or extraction, according to article 5, item X, of the General Data Protection Law.
INTRODUCTION
ATTRUS, through this Privacy Policy, clarifies to the Data Subjects who have Personal Data subject to Processing on its electronic platform made available via website and/or mobile application ("ATTRUS Platform"), the aspects associated with said Personal Data Processing, in accordance with the applicable legislation and regulations.
Among other provisions, this Privacy Policy discusses the purposes, forms and duration of the Processing, the responsibilities of the institution, the rights of the Data Subjects and ATTRUS's contact channels.
By accessing and/or making any use of the ATTRUS Platform or still benefiting from any activities performed by ATTRUS that require the Processing of your Personal Data, you fully agree in a free, informed, unequivocal manner and without any defect of consent, with the provisions of this Privacy Policy.
You have the right not to provide your consent to the processing of your Personal Data. If you do not provide your consent, as a consequence you will not have access to and/or be able to use the ATTRUS Platform and will not be able to benefit from any activities performed by ATTRUS that require the Processing of Personal Data.
Therefore, we kindly request that you carefully read this Privacy Policy, together with our general terms and conditions of use (available online at "www.ATTRUS.com") ("Terms and Conditions"). For more information about ATTRUS, please visit the following website: "www.ATTRUS.com".
References in this Privacy Policy to "we", "us" and "our" mean a reference to ATTRUS. References to "systems", "application", "platform", or "website" mean a reference to a service provided through our systems, including web and mobile, or any other online services provided by us and all data managed, displayed, or transmitted from such services. References to "you", "your" means a reference to a Data Subject.
Words, expressions and abbreviations with the initial capital letters, singular or plural, shall have the same meaning given to them in the Terms and Conditions, except as otherwise defined in this Privacy Policy.
SCOPE
This Privacy Policy is applicable and must be fully complied with, as applicable, by ATTRUS, all its Employees, Partners and Service Providers, as well as by the Data Subjects.
This Privacy Policy is available on our website for reading and analysis by the Data Subjects. ATTRUS undertakes to disclose in relationship channels and on its website, as applicable, the content of this Privacy Policy or mechanism to access it.
PERSONAL AND PROCESSING DATA
ATTRUS, as a fintech with an exclusively online presence specialized in the offer of Products and Services, carries out the Processing of Personal Data in the context of its activities, including, without limitation, in the scope of the collection, transportation, processing of information and settlement of transactions.
Within the scope of its performance as a payment institution issuing electronic money, in order to initiate the relationship with ATTRUS, the Card Holder registers on the ATTRUS Platform and becomes the holder of a payment account at ATTRUS. In this context, the following Personal Data are Processed:
email address used to log in to the ATTRUS Platform;
access password chosen to log in to the ATTRUS Platform;
full name;
registration number in the National Registry of Individuals of the Ministry of Finance ("CPF/MF");
contact phone number;
Date of birth;
marital status;
nationality;
profession;
copy of personal documents (identity card, national driver's license, proof of residence, documents proving that the legal representative has powers to represent the contracting company);
annual income (declaratory);
bank account details;
information regarding activities carried out on the ATTRUS Platform;
responses to questionnaires suggested or requested by ATTRUS;
declaration as to its classification as a PEEP; and
geolocation of the Client at the times when he accesses the ATTRUS Platform, as well as when using ATTRUS in the app mode in the background.
As you use the ATTRUS Platform, Personal Data about you may be Processed by ATTRUS, along with other additional information, such as your IP address, browser used, cookie information, type and brand of mobile device, mobile device identifiers, operating system version, installed applications, network information, Internet connection provider used, configuration of devices, software data, communications made through the ATTRUS Platform and communications made between you and ATTRUS through our service channels.
When you complete the registration on the ATTRUS Platform and create a prepaid payment account in your name, you will need to add money to your wallet. If you want to transfer the balance of your payment account to a bank account, we will need the account details, the destination bank, account number, branch and the information regarding the type of account.
In addition to the above, other information (including Personal Data) required by applicable law or regulation or at the discretion of ATTRUS may be required and required for the analysis of Customers' profiles or for the purposes of formalizing the commercial relationship with ATTRUS and/or for the correct provision of Products and Services.
ATTRUS may also Process Personal Data that originates from safe and reliable sources, including public and private databases, as well as from any third parties, Affiliates, Partners and Service Providers, such as:
data collected for the purposes of fraud prevention and compliance with regimes and information (PEPs lists, OFAC, etc.);
credit data obtained from databases, credit risk centers and/or publicly accessible sources, in accordance with applicable regulations and legislation; and
data that serves to validate the identity of Customers obtained from public agencies, Partners and Service Providers or other specialized business partners.
ATTRUS does not Process Personal Data of children or adolescents. If you fall into one of these hypotheses, do not provide us with Personal Data or contact us (as provided in this Privacy Policy) so that we can assess your situation and take the necessary measures.
STORAGE
Personal Data by ATTRUS may be stored on servers located in Brazil or abroad, at the sole discretion of ATTRUS. You declare to understand and agree that other countries may have different levels of protection for Personal Data than Brazil. Notwithstanding, your Personal Data that may be stored in other countries will be subject to security measures at least equivalent to those provided for in this Privacy Policy.
SHARED PROCESSING OF PERSONAL DATA
The access of third parties to the Personal Data collected by ATTRUS due to the offer of Products and Services will occur exclusively to meet the purposes described in this Privacy Policy and within the limit necessary for the offer, operationalization and provision of such Products and Services in the normal course of ATTRUS's business. The main third parties with whom ATTRUS may share your Personal Data are:
ATTRUS Affiliates;
Establishment of payment arrangements and other participants in such payment arrangements;
Partners and Service Providers that have tools, algorithms and systems aimed at credit analysis;
Electronic funds transfer networks;
Clearing and settlement banks;
Partners and Service Providers who perform commercial and/or information processing operations for ATTRUS;
Independent auditors;
Credit analysis agencies (such as Serasa Experian and boavista), credit protection services and the like; and/or
Competent regulatory bodies, such as the BCB.
In addition, ATTRUS may share Personal Data in aggregate form, publicly and/or with its Partners, as long as such information is not personally identifiable. For example, you may publicly share information to demonstrate trends about the general use of ATTRUS's products and services.
In the event that it is necessary to disclose the Personal Data of Data Subjects, whether due to compliance with the law, judicial order or competent body supervising the activities developed by ATTRUS and/or third parties, such Personal Data shall be disclosed only under the strict terms and within the limits required for its disclosure, and the Data Subjects, To the extent possible and feasible, they will be notified of such disclosure, so that they can take appropriate protective or remedial measures.
Whenever the Processing of Personal Data by ATTRUS is necessary for purposes other than those defined in this Privacy Policy or that expressly authorized by the Holder, ATTRUS will inform the Holder of Personal Data about this new purpose and, when necessary, will collect a new authorization to carry out the specific Processing in this regard.
POSSIBLE SPECIFIC PURPOSES FOR THE PROCESSING OF YOUR PERSONAL DATA
By accepting this Privacy Policy, you consent that ATTRUS may use your personal data for the following specific purposes:
verify and validate your identity;
register in our systems;
comply with legal and regulatory obligations, including, without limitation, the performance of and procedures for the prevention of money laundering and fraud;
perform the analysis of your credit risk;
contact him on the necessary occasions;
provide support to you;
communicate and send information to Data Subjects;
generate statistical analyses and reports on the operation and operation of the ATTRUS platform, Products and Services, for the benefit of ATTRUS, its Affiliates, Partners and Service Providers;
provide and improve security and monitoring mechanisms of the ATTRUS Platform and/or the Products and Services;
detect and protect ATTRUS and/or its Clients against fraud, abuse or illegal acts;
detect and prevent the use of applications and programs for fraudulent purposes or that have the purpose of altering the functionalities of the ATTRUS Platform and the Services and Products provided by ATTRUS;
develop new products, services, activities and/or functionalities;
provide the Products and Services, as well as specific benefits that are contracted or requested by the Data Subjects;
keep a record of the transactions and foreign exchange operations carried out, as well as inform you about them and carry out appropriate follow-up;
consult and report to credit protection agencies, carry out commercial and/or credit risk verification tasks, analyse the feasibility of maintaining a commercial relationship and prepare profiles for credit analysis purposes;
conduct research;
correct and/or update data;
perform risk control;
execute any provision contained in the Terms and Conditions, considering the activities carried out, and the Products and Services offered by ATTRUS;
performance of one or more of ATTRUS's activities by other companies that make up its economic group;
carrying out transactions involving ATTRUS (including, without limitation, corporate transactions such as acquisition, incorporation, merger of shares, merger and/or spin-off) and requiring audits;
to contact Data Subjects through different channels, such as email, text messages (SMS), for advertising and/or promotional purposes of ATTRUS Products and Services; and
for the fulfillment of any order of a competent authority, as well as for the defense of rights in judicial, administrative or arbitration proceedings.
You specifically consent that ATTRUS may carry out the international transfer of your personal data in accordance with the General Data Protection Law for the specific purposes set forth in this Policy, including, without limitation, for the purpose of contracting third parties that provide technical, systemic and/or operational infrastructure to ATTRUS and/or as a result of entering into exchange operations within the scope of the offer of Products and Services.
Your Personal Data will not be processed by ATTRUS for purposes other than those provided for in this Privacy Policy and/or are legally authorized, as indicated in sections 6 and 7 above and in the General Data Protection Law. ATTRUS will not share Personal Data in order to obtain remuneration by virtue of such sharing.
RESPONSIBILITIES AND MEASURES ADOPTED BY ATTRUS
ATTRUS adopts security, technical and administrative measures in order to protect the Personal Data of the Holders from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication or any form of inappropriate or unlawful Processing, including after the end of the processing of such Personal Data, in accordance with the legislation in force.
In this context and aiming at the security of the Personal Data provided by the Data Subjects, ATTRUS has physical, logical, technical and administrative security processes compatible with the sensitivity of the information collected, whose efficiency is periodically evaluated by an independent audit. ATTRUS implements new procedures and continuous technological improvements to protect all Personal Data collected from Data Subjects.
Notwithstanding the security measures adopted above, ATTRUS is not responsible for losses arising from the violation of the confidentiality of Personal Data due to the occurrence of any fact or situation that is not directly attributable to it.
In the treatment of the information collected, ATTRUS uses structured systems in order to meet the requirements of security and transparency, the standards of good practices and governance, and the general principles established in the General Data Protection Law and in the market.
Administrators, Employees and third parties related to ATTRUS must observe and ensure compliance with this Privacy Policy and, when necessary, call the Person in Charge for consultation on situations involving conflict with this Policy and upon the occurrence of situations described therein.
The compliance area and the Person in Charge shall (i) keep this Privacy Policy up to date, in order to ensure that any regulatory and/or legal changes to the guidelines and general rules established herein are observed; (ii) be responsible for clarifying doubts regarding this Privacy Policy and its application; (iii) analyze complaints and communications from the Personal Data Subjects, provide clarifications and adopt measures; (iv) receive communications from the ANPD and adopt measures; (v) guide ATTRUS's Employees and Third Parties, as applicable, regarding the practices to be taken in relation to the protection of Personal Data; (vi) adopt initiatives to share information on incidents containing Personal Data with the ANPD and with the data subjects, when necessary; and (vii) clarify doubts regarding the relevant legislation and regulations.
ATTRUS will keep a record of the processing of your Personal Data, in compliance with the provisions of the General Data Protection Law.
ATTRUS requires all Employees and Service Providers to maintain the confidentiality of the Personal Data shared with them or that they have access to by virtue of the exercise of their activity, as well as to use such information exclusively for the purposes expressly permitted. ATTRUS will not be responsible for the improper use of such information, whether by third parties or by their employees, due to non-compliance with this Privacy Policy and the contractual obligations assumed by such third parties with ATTRUS through its own instruments.
YOUR RIGHTS
Without prejudice to other rights expressly provided for in this Privacy Policy, subject to the existence of a law in force to that effect, you have the right, in relation to your personal data, at any time and upon request to ATTRUS:
to confirm the existence of Processing of your Personal Data;
to access your Personal Data collected by ATTRUS;
to anonymize, block or delete data that is unnecessary, excessive or processed in non-compliance with the provisions of applicable law;
to require, upon express and specific request, the portability of Personal Data to another service or product provider, as applicable, in accordance with applicable regulations;
deletion of personal data processed with the Client's consent, except in the event of (i) compliance with a legal or regulatory obligation by ATTRUS, (ii) study by a research body, ensuring, whenever possible, the anonymization of personal data, (iii) transfer to a third party, provided that the processing requirements provided for in the applicable legislation are respected, or exclusive use by ATTRUS, its access by third parties is prohibited, and provided that the data is anonymized;
to obtain information from the public and private entities with which ATTRUS shared Personal Data;
information about the Client's failure to provide consent and consequences of its refusal; and
to revoke your consent.
CORRECTION OF PERSONAL DATA
In addition to the provisions of the section above, you have the right, upon request to ATTRUS, to obtain the correction of Personal Data proven to be incomplete, inaccurate and/or outdated.
REVOCATION OF CONSENT AND DELETION OF PERSONAL DATA
If you wish to revoke the consent granted under this Privacy Policy or delete your Personal Data from ATTRUS's database, you must request the revocation of consent or the deletion of your Personal Data directly from ATTRUS. Uninstalling the application (when using the ATTRUS Platform in its app mode) is not sufficient to revoke your consent and/or delete your Personal Data from ATTRUS's database.
ATTRUS will store your request for revocation and/or deletion and, after the end of the period of Processing of your Personal Data, will provide for the destruction or anonymization, at the sole discretion of ATTRUS, of the information capable of identifying you, without prejudice to the possibility of the retention and use of your Personal Data for legal and regulatory purposes by ATTRUS. Additionally, in the event that ATTRUS is acting exclusively as a Personal Data operator, the above rights must be exercised directly with the controller, i.e., the natural or legal person, under public or private law, who is responsible for decisions regarding the Processing of Personal Data.
OTHER WAYS OF PROCESSING YOUR PERSONAL DATA
Notwithstanding any provision to the contrary herein, upon acceptance of this Privacy Policy and other Terms and Conditions, you acknowledge that ATTRUS or one of its Affiliates may Process your Personal Data in any manner provided for by law, provided that for the specific purposes provided for in this Privacy Policy and/or by law, including, without limitation, in the cases provided for in article 7, items V and X of the General Data Protection Law.
PERIOD AND END OF THE PROCESSING OF YOUR PERSONAL DATA
The Processing of your Personal Data will have as a period of time between: (i) the date of acceptance of this Policy and the Terms and Conditions, and (ii) (a) the date on which ATTRUS has received the revocation of your consent in relation to this Privacy Policy or (b) in the event that ATTRUS has received the revocation of your consent but there are still outstanding amounts owed by you to ATTRUS as a result of the Products and Services, on the date on which ATTRUS has effectively received all amounts owed by you.
CONSENT TO THE PROCESSING OF YOUR PERSONAL DATA
You consent, in a free, informed, unequivocal manner and without any defect of consent, to the collection, storage, use, processing, association, sharing, disclosure and other forms of Processing of your personal data for any and all purposes provided for in this Privacy Policy.
By accepting this Privacy Policy, you acknowledge that you have perfectly and clearly understood the possible specific purposes that may support the processing of your personal data by ATTRUS.
DATA PROTECTION OFFICER
ATTRUS has a Person in Charge of the Processing of Personal Data, as established in the General Data Protection Law. The identity and contact information of the Person in Charge are described on the ATTRUS website, which is: "www.ATTRUS.com".
The DPO may be contacted by the means indicated above.
CHANGES TO THIS PRIVACY POLICY
We may update or change this Privacy Policy from time to time to comply with applicable law or to adapt it to our business changes. Any relevant changes to this Privacy Policy will be previously informed on the ATTRUS Platform. By continuing to use the ATTRUS Platform after being notified, you agree to remain bound by the most up-to-date version of the terms and conditions of this Privacy Policy.
Certain changes to this Privacy Policy may require your consent in accordance with applicable law. If you do not agree with such changes, you have the right to withhold your consent in accordance with the provisions of this Privacy Policy.
OTHER IMPORTANT CLAUSES
The nullity or invalidity of any of the provisions of this Privacy Policy will not affect the validity and effectiveness of its other clauses and/or any clauses of the Terms and Conditions. If any judicial decision pronounces on the invalidity or ineffectiveness of any of the provisions of this Privacy Policy, ATTRUS will replace the inquiled rule with another that, if lawful, allows the practical results initially intended to be achieved, to the greatest extent possible.
All disclaimers, indemnities, and exclusions in this Privacy Policy will survive the termination of the agreement between us for any reason.
We may, in whole or in part, compromise, waive or postpone, in our absolute discretion, any liability assumed by you to us or right granted to us in this Privacy Policy, without in any way prejudice or affect our rights under this Privacy Policy.
You and ATTRUS acknowledge that: (i) the failure by either of them to exercise or delay in exercising any right granted to them hereunder or by law shall not constitute novation or waiver of such right, nor shall it prejudice the eventual exercise of such right, at any time; and (ii) the waiver, by either party, of any of the rights or powers provided for herein shall only be valid if formalized in writing.
ATTRUS may assign, transfer, novate or not exercise any of its rights arising from this Privacy Policy, by itself or through any legal entity and/or other legal entity that is or will become under the control or shareholding of ATTRUS.
This Privacy Policy is governed by the laws of the Federative Republic of Brazil.
***** ***** *****