Privacy and Personal Data Protection Policy

1. Purpose

CRUZIAPAY LTDA ("CruziaPay") is a payment facilitator that enables companies, in Brazil and abroad, to receive payments from Brazilian customers via Pix and other local methods, organizing the national and international reconciliation and settlement of operations.

Payment operations are carried out in partnership with institutions authorized to operate within the Pix arrangement. CruziaPay is not a financial institution nor an authorized payment institution, does not offer credit, does not open or manage payment or deposit accounts, and does not perform credit analysis.

This Policy formalizes the protection, privacy, and confidentiality guidelines applicable to the processing of personal data by CruziaPay and must be read in conjunction with the Terms of Use.

2. Definitions

Data Subject is the natural person to whom the personal data refers. User is the data subject who browses CruziaPay websites and platforms. Client is the company that contracts CruziaPay's services to receive payments. Payer is the person who makes a payment to a Client through the platform.

Personal data is information related to an identified or identifiable natural person. Sensitive personal data is data concerning racial or ethnic origin, religious conviction, political opinion, health, sexual life, genetic or biometric data. Processing is any operation performed with personal data, pursuant to Art. 5 of the LGPD.

Controller is CRUZIAPAY LTDA, who is responsible for decisions regarding the processing. Processor is the party that processes personal data on behalf of the controller. DPO (Encarregado) is the communication channel between the controller, data subjects, and the ANPD. Anonymization is the use of technical means that prevent the association of data with an individual.

3. Legal and Regulatory Basis

This Policy observes Law No. 13,709/2018 (LGPD), Law No. 12,965/2014 (Brazilian Civil Rights Framework for the Internet), Law No. 12,865/2013 and Central Bank of Brazil regulations on payment arrangements and the Pix arrangement, Law No. 9,613/1998 on Anti-Money Laundering, and Law No. 14,790/2023 when the Client operates in the fixed-odds betting sector.

4. Scope and Applicability

This Policy applies to all users accessing the cruziapay.com website and CruziaPay platforms, to representatives, partners, and ultimate beneficial owners of Clients during registration, to Payers whose data passes through the platform, and to all employees, third parties, and partners who process personal data on behalf of CruziaPay.

Regarding Payers' data, the Client acts as the controller, and CruziaPay processes such data to enable collection, settlement, and compliance with legal obligations for fraud and money laundering prevention.

5. Principles of Processing

CruziaPay and its processors observe the principles of Art. 6 of the LGPD: purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and accountability.

6. Collected Data and Purposes

Registration data of Clients and their representatives: corporate name, CNPJ or equivalent foreign registry, full name, CPF or identification document, date of birth, address, email, telephone number, and corporate structure, including ultimate beneficial owners.

Financial data: bank details for settlement, estimated volume, and transaction history.

Payer data: name, CPF, value, date, and identifier of the Pix transaction and, when provided by the Client, email and order reference.

Browsing data: IP address, access logs, device, operating system, browser, session identifier, and cookies, pursuant to the Cookie Policy.

Commercial contact data: name, company, corporate email, telephone, country, vertical, estimated volume, and message sent via the website form.

Card data: CruziaPay does not store the full card number or security code. The data is captured and tokenized by a PCI DSS certified partner institution, and CruziaPay processes only the token and the minimum transaction data.

These data are processed for Client identification and registration (KYC and KYB), processing, reconciliation, and settlement of payments, prevention of fraud, money laundering, and terrorism financing, compliance with legal and regulatory obligations, information security, customer service, and commercial communication when consented.

7. Processing Operations and Legal Grounds

All processing is linked to a legal basis under Art. 7 of the LGPD: compliance with a legal or regulatory obligation (item II), performance of a contract or preliminary procedures at the request of the data subject (item V), regular exercise of rights in judicial, administrative, or arbitration proceedings (item VI), legitimate interest, such as in fraud prevention and transaction security, provided that the data subject's rights do not prevail (item IX), and consent, for commercial communications and non-essential cookies (item I).

8. Sharing and Processors

CruziaPay shares data only for legitimate purposes and never sells or rents it. Sharing occurs with processors under processing and confidentiality agreements and, when required by law, with authorities such as the Central Bank of Brazil, COAF, ANPD, Federal Revenue, and the Judiciary.

The primary processors are: partner institutions authorized to operate in the Pix arrangement, for transaction processing and settlement; foreign exchange providers, for international settlement; hosting and database providers; KYC and document validation providers; and corporate email providers.

International transfer: part of the processing may occur in providers located outside Brazil and, in operations with foreign Clients, settlement data may be transmitted to institutions in other jurisdictions. CruziaPay adopts contractual clauses and technical measures ensuring protection compatible with the LGPD, pursuant to Art. 33.

9. Storage, Security, and Retention

Data is encrypted in transit (TLS 1.2 or higher) and at rest. Internal access is restricted by profile, with multi-factor authentication and audit logging of sensitive operations. Anti-fraud monitoring assesses collection and settlement patterns.

Application access logs are kept for at least 6 months, as per Art. 15 of Law No. 12,965/2014. Registration and transaction records are kept for at least 5 years after the termination of the relationship, as per Art. 10 of Law No. 9,613/1998. Commercial contact data without contracting are kept for up to 24 months or until consent is revoked. Once the periods expire, the data is deleted or anonymized.

10. Data Subject Rights

Pursuant to Art. 18 of the LGPD, the data subject may request confirmation of the existence of processing, access to data, correction of incomplete, inaccurate, or outdated data, anonymization, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with consent, information on sharing, and revocation of consent.

Requests must be sent to the DPO at privacidade@cruziapay.com.br and will be responded to within 15 days. Data whose retention is required by law will remain stored for the legal term, even after a deletion request.

11. Sensitive Data and Data of Minors

CruziaPay does not intentionally process sensitive personal data, except for biometric data eventually used in onboarding identity validation, subject to specific consent or under the hypotheses of Art. 11 of the LGPD. CruziaPay websites and platforms are not intended for individuals under 18 years of age.

12. Contact Channels and General Provisions

Privacy matters and exercise of rights: privacidade@cruziapay.com.br. Compliance and anti-money laundering matters: compliance@cruziapay.com.br.

This Policy may be updated at any time, with prior notice in case of relevant changes. CruziaPay reports suspicious operations to the competent authorities, pursuant to Law No. 9,613/1998. The courts of the District of Londrina/PR are hereby elected. This document is reviewed annually.