For customer

This is the Privacy Notice of EBANX LTDA., CNPJ 13.236.697/0001-46, headquartered at Rua Marechal Deodoro, 630, Praça San Marco, CEP 80010-010, Centro, Curitiba, PR, as well as of all companies of the EBANX economic group, represented herein by its headquarters ("EBANX"). This Notice is available through the https://www.ebanx.com website, where you can access information about all our services. The privacy of your Personal Data is a key priority for EBANX, and we are committed to your security throughout your browsing and use of our services.

This Notice explains how we collect, use, and share your personal data. It also tells you how you can access, update, and correct your Personal Data and exercise control over your information.

Glossary

• Controller: natural or legal person, under public or private law, who is responsible for decisions regarding the processing of Personal Data.

• Personal Data(s): any information relating to an identified or identifiable natural person.

• EBANX: all companies of the EBANX economic group, including, but not limited to, EBANX S.A. (Argentina), Zilver S.A. (Argentina), EBANX Bahamas Ltd., EBANX Instituição de Pagamentos Ltda. (Brazil), EBANX Brasil Holding Ltda., EBANX Holding de Pagamentos Ltda. (Brazil), EBANX Ltda. (Brazil), EBANX Pagamentos Ltda. (Brazil), Frontier Payments Brasil Ltda., EBANX Serviços Digitais Ltda. (Brazil), EBANX Holdings LLC, EBANX Chile Limited, Frontier Payments Chile S.p.A., EBANX Chile Local Payments SPA, EBANX Shanghai Technology Information Co. Ltd. (China), EBANX Colombia Local Payments S.A.S, EBANX Colombia S A S, Frontier Payments Colombia S.A.S, EBANX Costa Rica SRL, EBANX LLC (Egypt), EBANX de El Salvador S.A., EBANX Ecuador S.A., EBANX Guatemala S.A., EBANX India Private Limited, EBX Jamaica Limited, EBAKE Limited, EBANX de México S. de RL. de CV, FTR Payments, S.R.L de C.V (Mexico), EBANX Mexico Local Payments S.A. de C.V., E3X Pay Limited (Nigeria), EBANX Panama S.A., EBANX Paraguay S.R.L., EBANX Peru S.A.C., Frontier Payments Peru S.A.C., EBANX Dominican Republic SRL, EBANX PTE. LTD. (Singapore), EBANX South Africa, EBANX Uruguay S.A.

• Merchant: platforms or websites, national or international, that use EBANX as the means of processing payments. 

• Platform: the https://www.ebanx.com website https://www.ebanx.com/ and the EBANX API.

• Operator: natural or legal person, under public or private law, who processes personal data on behalf of the controller.

• Third: individuals or legal entities, of a public or private nature, that supply products or provide services to EBANX.

• Processing: is any operation carried out with Personal Data, such as those referring to the collection, production, reception, classification, use, access, reproduction, transmission, sharing, distribution, processing, filing, storage, elimination, evaluation or control of information, modification, communication, transfer, dissemination or extraction.

• You: any natural person who uses our services.

  
  

Summary

1. Commitment to the security of your personal data

2. EBANX's role with your personal data

3. Data collected by EBANX

4. How we use your personal data

5.  How we record your activities

6. Sharing and disclosure of personal data

7. Storage, retention and deletion of personal data

8. Your Rights, Choices, and Controls

8.1. Right to lodge a complaint with the data protection authority

9. International transfer 

10. Internet Security

11. Changes to the Privacy Notice

12. Contact Us

1. Commitment to the security of your Personal Data

EBANX protects your Personal Data when browsing, accessing, or using the platform. We are committed to the security of your Data throughout your experience with us. Therefore, your data will be kept strictly confidential and will not be sold, exchanged, or disclosed to any third party, except in the cases expressly established in this Notice.

2. EBANX's role when Processing your Personal Data

EBANX is considered both the "Controller" and "Operator" of your data. We are responsible for processing payments you make on our Merchants' websites or platforms. We act as the Operator of your personal data for the processing of payments on these websites. 

We may also act as a Controller in certain situations, such as taking preventive and reactive measures to identify, prevent, and remediate fraud and security threats.

3. Personal Data collected by EBANX

We may collect your Personal Data at different times: (i) when you access our website and browse through items made available; (ii) when you contact us through our communication channels; and (iii) when you make purchases from partners who have contracted our payment services.

In these scenarios mentioned above, EBANX may process some information, such as:

(1) Identity Data

• Full name;

• Tax identification number;

• Date of birth;

• Address;

• Email;

• Mother's name;

• Phone number;

• Document photo.

(2) Financial Data

• Payment details;

• Bank information (bank, account, branch); and

• Payment method used;

• Payment token.

(3) Technical Data

• IP address;

• Access time;

• Date of access;

• Data about the access device; and

• Cookies.

(4) Usage data

• Information about the purchases made (type of product, services, values); 

• Information about your behavior profile; and

• Transaction volume.

4. How EBANX Uses Your Personal Data

EBANX can use your Personal Data for specific purposes, as described below:

5. How EBANX records your activities

When you access our platform, we may record your activities to create logs (records of activities made on websites, applications, and products). These logs mark your IP address, access, and actions you take on the platform, including the date and time of each action performed and information about the device used, such as the operating system version of your smartphone, computer, and browser.

To help us in this process, we may use technologies to monitor the activities carried out on the platform, including:

• Cookies - Cookies are small text files that may be placed on your device by the websites or web services you use. Cookies can be used for many things, such as remembering your preferences and tracking your visits and activities related to the platform. The platform may also utilize locally stored objects to deliver specific content, such as video on demand, video clips, or animation. The cookies used cannot be disabled, removed, or blocked because if you try to disable or remove cookies, some parts of the platforms may stop working, and your ability to limit cookies will be subject to your browser settings and limitations.

• Analytics tools. These tools may collect information such as how you visit the platform, including which pages you visited and when, as well as other websites that were visited before, among others.

Rest assured! All technologies used by us will always abide by the terms and limits set forth in this Notice.

6. Sharing and disclosure of Personal Data

At times, it will be necessary to share your personal data. We may use, access, and share your personal data when necessary, always within the limits and for business purposes, respecting the applicable legislation.

We may share your Personal Data in specific situations, such as:

• Among the companies of the EBANX group, to offer you the best experience while using our payment services;

• With Third Parties, for the protection of EBANX's interests in the event of a conflict, including in lawsuits and in case of transactions and corporate changes involving EBANX. In this case, the transfer of data will be necessary for the continuity of the products and services offered;

• With Third Parties, for the protection of EBANX's interests in case of conflict, including in legal claims and in case of transactions and corporate changes involving EBANX, in which case the sharing of data will be necessary for the continuity of the products and services offered; 

• With the Central Bank of Brazil and other regulatory bodies, or financial institutions, payment institutions, and other applicable institutions, following legal requirements; and

• With judicial, law enforcement, government authorities, or other Third Parties to whom we are required by law, regulatory rule, or court order.

7. Storage, retention, and deletion of Personal Data

Your Personal Data will only be kept for as long as necessary to fulfill the purposes for which we collected it. Due to our operations' financial nature, EBANX is legally required to store some of your Personal and transactional Data even if we are no longer processing your payments. This data is restricted internally and accessed or processed only when absolutely necessary.

Deleting Personal Data that is no longer required by legal obligation is done automatically. Deletion methods include anonymization, purging and destruction, and secure hardware disposal.

Below, you will find the retention periods broken down by country for those data that we may need to keep to comply with legal obligations:

8. Your rights, options, and controls

You have rights and guarantees regarding your Personal Data. We provide mechanisms, detailed below, to ensure clarity and transparency in exercising your rights, depending on the country where the Personal Data is collected and/or processed.

South Africa

• Obtain confirmation that we have processed your Personal Data;

• Access your Personal Data that is processed by us;

• Request the correction of Personal Data that is incomplete, inaccurate, or out of date;

• Request the anonymization, blocking or deletion of Personal Data that is unnecessary, excessive or processed in violation of the law;

• Object at any time to the processing of personal information for direct marketing purposes;

• Request the portability of your Personal Data to another service or product provider, subject to our commercial and industrial secrets;

• Not be subject to automated decisions that entail legal consequences for the Data Subject.

Kenya

• Obtain confirmation that we have processed your Personal Data;

• Access your Personal Data that is processed by us;

• Request the correction of Personal Data that is incomplete, inaccurate, or out of date;

• Request the anonymization, blocking or deletion of Personal Data that is unnecessary, excessive or processed in violation of the law;

• Request the restriction of the processing of Personal Data in the cases provided for by law;

• Object to the processing of part of your Personal Data for a specific purpose or in a specific way;

• Revoke consent to Personal Data processed on this legal basis;

• Request the portability of your Personal Data to another service or product provider, subject to our commercial and industrial secrets;

• Not be subject to automated decisions.

Nigeria

• Obtain confirmation that we have processed your Personal Data;

• Access your Personal Data that is processed by us;

• Request the correction of Personal Data that is incomplete, inaccurate, or out of date;

• Request the anonymization, blocking or deletion of Personal Data that is unnecessary, excessive or processed in violation of the law;

• Request the restriction of the processing of Personal Data in the cases provided for by law;

• Object to the processing of part of your Personal Data for a specific purpose or in a specific way;

• Revoke consent to Personal Data processed on this legal basis;

• Request the portability of your Personal Data to another service or product provider, subject to our commercial and industrial secrets;

• Not be subject to automated decisions.

Bahamas

• Access your Personal Data that is processed by us;

• Request the correction of Personal Data that is incomplete, inaccurate, or out of date;

• Request the anonymization, blocking or deletion of Personal Data that is unnecessary, excessive or processed in violation of the law.

Brazil

• Obtain confirmation that we have processed your Personal Data; 

• Access your Personal Data that is processed by us; 

• Request the correction of Personal Data that is incomplete, inaccurate, or out of date; 

• Request the anonymization, blocking or deletion of unnecessary, excessive or processed Personal Data in non-compliance with the provisions of the LGPD; 

• Request the portability of your Personal Data to another service or product provider, subject to our commercial and industrial secrets; 

• Request the deletion of Personal Data processed based on your consent, except in the cases of retention of Personal Data provided for in the LGPD; 

• Request information about who we share your Personal Data with, such as the list of sub-processors used; 

• Request information about the possibility of not providing your consent and the consequences; 

• Revoke your consent to the processing of your Personal Data, in the event that there is processing based on your consent; 

• To express opposition to processing that violates the provisions of the LGPD.

Colombia

• Obtain confirmation that we have processed your Personal Data;

• Access your Personal Data that is processed by us;

• Request the correction of Personal Data that is incomplete, inaccurate, or out of date;

• Request the anonymization, blocking or deletion of Personal Data that is unnecessary, excessive or processed in violation of the law;

• Revoke consent to Personal Data processed on this legal basis.

Costa Rica

• Access your Personal Data that is processed by us;

• Request the correction of Personal Data that is incomplete, inaccurate, or out of date;

• Request the anonymization, blocking or deletion of Personal Data that is unnecessary, excessive or processed in violation of the law.

Ecuador

• Obtain confirmation that we have processed your Personal Data;

• Access your Personal Data that is processed by us;

• Request the correction of Personal Data that is incomplete, inaccurate, or out of date;

• Request the anonymization, blocking or deletion of Personal Data that is unnecessary, excessive or processed in violation of the law;

• Request the restriction of the processing of Personal Data in the cases provided for by law;

• Oppose the processing of Personal Data in the cases provided for by law;

• Revoke consent to Personal Data processed on this legal basis;

• Request the portability of your Personal Data to another service or product provider, subject to our commercial and industrial secrets;

• Not be subject to automated decisions.

Jamaica

• Obtain confirmation that we have processed your Personal Data;

• Access your Personal Data that is processed by us;

• Request the correction of Personal Data that is incomplete, inaccurate, or out of date;

• Request the anonymization, blocking or deletion of Personal Data that is unnecessary, excessive or processed in violation of the law;

• Oppose the processing of Personal Data in the cases provided for by law;

• Not be subject to automated decisions.

Mexico

• Obtain confirmation that we have processed your Personal Data;

• Access your Personal Data that is processed by us;

• Request the correction of Personal Data that is incomplete, inaccurate, or out of date;

• Object to the processing of Personal Data in the cases provided for by law.

Panama

• Obtain confirmation that we have processed your Personal Data;

• Access your Personal Data that is processed by us;

• Request the correction of Personal Data that is incomplete, inaccurate, or out of date;

• Request the anonymization, blocking or deletion of Personal Data that is unnecessary, excessive or processed in violation of the law;

• Request the portability of your Personal Data to another service or product provider, subject to our commercial and industrial secrets.

You may exercise your Data Subject rights – including the right to withdraw consent where this is the legal basis for processing – through our OneTrust Privacy Portal. To learn more, check out this link. 

Before we respond to any request to exercise the above rights, we will ask you for certain information to confirm your identity. After your identity has been validated, we will fulfill your request.

Please note that these rights are not absolute and may not apply in certain circumstances. For example, in certain cases, we may continue to process and maintain Personal Data regardless of your request for deletion, opposition, blocking, or anonymization to comply with legal, contractual, and regulatory obligations, safeguard, and exercise rights, including in judicial, administrative, and arbitration proceedings and in other cases provided for by law.

8.1 Right to lodge a complaint with the data protection authority

In South Africa, you also have the right to complain with the Data Regulatory Body by following the instructions in the form available at this link.

9. International transfer

Your Personal Data may be transferred to other countries while providing our services, either between EBANX representatives from different countries or to third parties. In such cases, we will take the steps required by law to ensure that your Personal Data remains protected and that such transfer is carried out per one of the transfer mechanisms provided for by applicable law, depending on the country.

10. Internet security

We strive to protect the Data we hold for our records, but we cannot guarantee its complete security. Factors such as unauthorized access or use and hardware or software failure, among others, may compromise the security of the Data.

However, it is necessary to remember that the transmission of Data over the Internet is not completely secure due to several factors, such as network and operation. Therefore, EBANX cannot guarantee the complete security of the transmitted Data. Although we do our best to protect your Data, we cannot guarantee the security of the network you use to access our platform. Any such transmission is at your sole risk, and by agreeing to this Notice, you expressly acknowledge and assume such responsibility.

Once received, we are committed to ensuring your safety. To prevent unauthorized access to or disclosure of your Data, we have put physical, electronic, and managerial procedures in place to ensure that the Data we collect is secure.

11. Changes to the Privacy Notice

We are always evolving, so it may be that the agreements in this Notice will also change. Therefore, we recommend that you access it frequently or whenever there are doubts to keep up with any updates. Changes will be communicated right here, on the page of this Notice.

If changes to this Notice imply changes in Personal Data processing practices that depend on your consent, you will be asked to consent to the new terms so that you can continue browsing our website or using our services.

12. Contact us

If you have any questions, suggestions, and/or complaints about the provisions in this Privacy Notice or if you want to submit any request regarding your Personal Data, you may contact us through the EBANX Privacy Portal. Your request will be handled by our Data Officer, Giovanna Michelato Almada, and her team within the time frame established by the privacy laws applicable to your country.