Privacy Policy (Local Account)
This Privacy Policy is between you and ATLAS BRASIL ARQ INSTITUIÇÃO DE PAGAMENTO LTDA., a limited liability business company, registered with the CNPJ/MF under No. 27.126.513/0001-08, incorporated and existing under the laws of Brazil, with headquarters in the City of São Paulo, State of São Paulo, at Avenida Brigadeiro Faria Lima, no 4055, 1st Floor, Room/Suite no 01-110, in the city of São Paulo, State of São Paulo, CEP 04538-133 (“ATLAS BRASIL”) and D.A. Sociedade Prestadora de Serviços de Ativos Virtuais LTDA., a company registered under CNPJ No. 61.469.681/0001-26, headquartered at Avenida Brigadeiro Faria Lima, no 4055, 1º Andar, Sala/Conjunto no 01-110, CEP 04538-133 (“SPSAV"), jointly referred to as (“Arq Brasil"). Arq Brasil is committed to protecting the privacy of our customers and stakeholders. Therefore, we take our data protection responsibilities very seriously.
This privacy policy (“Policy”), available here and on the Platform, explains to the personal data subject (“You”) how Arq Brasil processes your personal data.
This Privacy Policy defines what Personal Data we collect, how we process it, and for how long we generally retain it, in addition to details about your rights as a data subject.
Each capitalized term used in this Policy is a defined term and has the meaning assigned to it in the Policy or in the applicable Terms and Conditions.
If you are a customer or user of our services, this Privacy Policy will apply together with the Terms and Conditions and/or other contractual documents, including, but not limited to, contracts we may have with you. Arq Brasil reserves the right to publish separate policies relating to other relevant audiences, such as our employees and/or business partners.
If you are not an interested party, customer, or user of our services, but are using our website, this Privacy Policy also applies. If you do not accept these Policies, you must immediately stop using our website.
In this Policy, “Personal Data” means any information related to you as an identified or identifiable individual; an identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.
For clarification, Personal Data does not include data by which you cannot be identified (which is simply called data, non-personal data, anonymous data, or unidentified data).
In this Policy, “processing” means any operation or set of operations performed on Personal Data or sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
1. How We Collect Personal Data
We collect Personal Data about you when you:
Visit our Application;
Contact us through the Application or other electronic means of direct communication;
Interact with us or our Services;
Provide us with instructions related to your account with us; and/or
Enter into a contract with us (such as for the use of our Services);
Establish any other relationship with us or interact with us or our services.
Data we collect from third parties:
Information about credit history during the use of the Platform, including the use of products provided by other entities of the corporate group.
Score generated by credit bureaus, including data related to credit history and fraud prevention, as well as scores provided by credit agencies and third parties.
Data on financial restrictions, such as negative records, amounts owed, due dates, number of inquiries, among others.
We may collect information about you that is publicly available or that has been made public by you.
Data and information on indications of fraud shared by other financial institutions, payment institutions, and other institutions authorized to operate by the Central Bank of Brazil, in accordance with applicable regulations.
2. Types of Personal Data We Collect
By using our services, you are aware that you must provide only true, current, and accurate Data, and must not, in any way, misrepresent your identity or financial information when accessing and using the Platform and Services. You will be solely responsible for any false, excessive, or inaccurate information provided through the Platform and for any direct or indirect damages caused to Arq Brasil or third parties. The Processed Personal Data is segmented into several categories, such as:
2.1. Browsing Information
We may collect data during your access to the Application, even if you are not registered or logged in:
Assigned IP address;
Your (approximate) location;
Device geolocation data, if you authorize collection from your device (if authorized, we will access your location to validate if transactions or new device sessions are legitimate);
Your login information;
Date and time of access to the Platform and other traffic-related data;
APIs;
Visited pages;
Unique device identifiers;
Type of browser used;
Operating system and/or platform used;
Search engine and keywords used to find the Application;
Other similar identifying information to communicate with the Application.
2.2. Registration Information
We may collect your Data during the use or registration on the Application, such as:
Name;
Physical address;
Email address;
Phone number;
Date of birth;
Nationality;
Identity card or Passport;
Tax identification number and/or any other government-issued identification number;
Employment details or business activity;
Financial information, including salary, income, and employer details;
Source of income;
Device geolocation. These data will be collected if you authorize collection from your device (if authorized, we will access your location to validate, among other things, if transactions or new device sessions are legitimate);
Crypto wallet address;
Biometric data;
Electronic signature;
Any public key you share with us;
Communications;
2FA recovery codes;
Names of family beneficiaries; and/or
Information on how you use our website or any other information required by applicable laws.
We may also ask you to provide proof of identity, for example, requesting a copy of your Passport, Driver's License, Proof of Residence or Income, or any relevant identification document issued by a non-prohibited jurisdiction. We are required to request this information to comply with anti-money laundering (AML) legislation, such as the Crime Products Act 13.106/2015, to protect ourselves against suspicious activities and report them.
2.3. Biometric data:
We may collect your biometric data, such as a photograph of your face, your fingerprint and/or facial biometrics to unlock via the device (fingerprint, Touch ID, and Face ID), and facial recognition for authentication purposes, all used for your own security, especially to prevent suspicious attempts to access your account. We will not disclose any biometric data to anyone, except to our identity verification providers or when required by applicable laws and regulations, or by court order. We will never sell, assign, commercialize, or obtain any benefit from your biometric data.
3. How We Process Your Personal Data
We process your Personal Data for the following purposes and legal bases that authorize such processing:
(i) Provision of Services and legal obligations:
To provide you with information, products, and Services that you requested from us;
To complete any transaction you carry out with us;
To collect any outstanding debts you may have with us;
To fulfill a contractual obligation we have with you; and/or
To prevent fraud and ensure the security of your account.
Credit protection, including credit granting and limit increase.
To comply with legal or regulatory obligations inherent to a Payment Institution in Brazil, for example, to keep your registration updated or meet legal and/or regulatory obligations applicable to Arq, including Know Your Customer (KYC), Anti-Money Laundering and Counter-Terrorism Financing, and anti-fraud rules.
(ii) Service Improvements:
To ensure that the content of our Application is presented to you in the most efficient way possible;
To manage our Application and for internal business administration, including troubleshooting, data analysis, testing, research, statistical and research purposes;
To contact you for customer service or for any other reason we deem necessary;
To notify you about changes to our services; and/or
As part of our efforts to keep our website secure.
(iii) Targeted Marketing:
To provide you with information about other services we offer that are similar to those you already have or have inquired about;
To provide you with other marketing materials; and/or
To send marketing communications, such as promotions and campaigns.
If you do not wish your personal information to be used for marketing purposes, please feel free to unsubscribe from marketing emails via the link available at the footer of all sent messages.
By default, the personalized ads option in your app may be activated for targeting and displaying directed advertising.
You may disable this functionality at any time using the control button (“toggle”), opting out of personalized advertisements. After deactivation, the User will stop receiving targeted ads based on this sharing, and it may take up to 3 (three) days for the exclusion to be fully processed across all relevant systems.
In particular, we may share some of your data with advertising platforms. Before transmission, this data is anonymized. The main purpose of this sharing is to exclude our active users from seeing ads, avoiding unnecessary spending on advertising directed at people who already use our Services. You may object to this sharing at any time by disabling the personalized ads option in the app or by contacting us through the channels indicated in this Policy.
4. How We Share Your Personal Data
We may share your Personal Data with third parties (including entities within our corporate group) if we believe that sharing your Personal Data is in accordance with or required by any contractual relationship with you or with us, applicable law, legislation, or legal process.
We may also be required by law or a court to disclose certain information about you or any engagement we may have with you to regulatory, law enforcement, and/or other relevant authorities. We will disclose information about you to public authorities to the extent we are legally obligated to do so. We may also need to share your information to enforce or apply our legal rights.
In addition, we may share some of your Personal Data with third parties specifically contracted by us for advertising and marketing purposes, whether inside or outside the country. This practice aims to personalize and improve the effectiveness of the ads displayed to users, according to their interests and behaviors. The shared data will be strictly limited to what is necessary for this specific purpose. In these circumstances, Arq Brasil undertakes to implement all security measures, such as information encryption. Under no circumstances will we disclose sensitive Personal Data that we hold.
By accepting the terms of this Policy, you authorize that your identification data, as well as information regarding transactions carried out in your account, be shared with authorities and other institutions supervised by the Central Bank of Brazil. The purpose of this sharing is to allow the processing and exchange of data related to possible indications of fraud, as provided for in Joint Resolution No. 6/2023.
Furthermore, your Personal Data may also be shared and processed by us and/or other subsidiary or affiliated members of our corporate group, agents, suppliers, consultants, or service providers, as well as any other third-party service providers who perform certain services on our behalf (for example, third-party service providers, external lawyers, financial institutions, etc.). These third parties will have access to your Personal Data exclusively for the purpose of performing the services specified in the applicable contract or for complying with applicable laws, and not for any other purpose.
These third parties are not authorized to use your personal information for their own purposes, and we require these third parties to adopt security measures consistent with the protections specified in this Privacy Policy and applicable laws.
Thus, we may share and disclose your Personal Data in the following ways or for any other purpose disclosed at the time of collection:
5. Automated Decision-Making
We do not use automated decision-making methods (including profiling), but we may flag our customers with a risk profile in compliance with applicable anti-money laundering laws. This means that decisions are not made by robots or computers and are therefore not "automated". However, some third parties may use certain automated decision-making tools or software. We are not responsible for the privacy practices of third parties and will take appropriate steps to alert you to such automated decision-making, but we recommend that you familiarize yourself with the privacy practices of third parties with whom you have agreements.
6. How Long Do We Retain Your Personal Data?
We retain your Personal Data only for as long as necessary for the purposes for which we process the information, as described in this Policy. Records may be kept in a variety of media formats (physical or electronic), but always ensuring that any retention of personal data is appropriate and precise.
Retention periods are determined based on the type of record, the nature of the record, and the activity of the legal or regulatory requirements applicable to those records. Generally, personal data collected in compliance with our legal obligations (such as AML) is retained for 5 years. However, we may retain your Personal Data for a longer period when such retention is necessary to comply with a legal obligation to which we are subject, or when we have a legitimate purpose for the processing.
7. Security Measures
We have adopted appropriate physical, technical, and administrative security measures to prevent your information from being accidentally lost, used, accessed, altered, or disclosed without authorization. We take substantial precautions to ensure the security of your data. Additionally, we limit access to your Personal Data to employees, agents, contractors, and other third parties who have a business need to know. They will only process your Personal Data according to our instructions and are subject to confidentiality obligations and data protection procedures. We have implemented procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
8. Your Rights
You have certain rights under applicable legislation, in particular under the General Data Protection Law (Law No. 13.709, of August 14, 2018). We explain these rights below:
a. Reliable Information and Your Right of Access: You have the right to be informed about the processing of your Personal Data, and this Policy aims to provide the necessary information. You also have the right to access the information we hold about you. We will be happy to provide details of your Personal Data that we hold or process. To protect your Personal Data, we follow defined storage and disclosure procedures, which means we will require proof of your identity before disclosing such information. You may exercise this right at any time by contacting us using the details provided in this policy.
b. Right to Rectification: You have the right to correct any inaccurate personal information about you and complete any incomplete personal information. You can also request that we restrict the processing of such information.
c. Right to Erasure: You generally have the right to request the erasure of your personal information in the following circumstances:
The personal information is no longer necessary for the purpose for which it was collected;
You withdraw your consent to processing based on consent, and there is no other applicable legal justification for the processing;
You object to the processing for direct marketing purposes;
We have processed your personal information unlawfully; and
Erasure is necessary to comply with a legal obligation that applies to us. We will comply with an erasure request without delay and to the extent possible, unless continued retention is necessary for:
Exercising the right to freedom of expression and information;
Complying with a legal obligation in accordance with the General Data Protection Law or other applicable law;
Performing a task carried out in the public interest;
Archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, in certain circumstances; and/or
Establishment, exercise, or defense of legal claims.
d. Right to Restrict Processing and Right to Object to Processing: You have the right to restrict the processing of your personal information, for example, when:
You contest the accuracy of the personal information;
When the processing is unlawful, you can request the restriction of the use of unlawfully processed personal information instead of requesting erasure;
When we no longer need to process your personal information, but we need to retain your information for the establishment, exercise, or defense of legal claims. You also have the right to object to the processing of your personal information in certain circumstances, such as when the processing is based on your consent and you withdraw that consent. This may affect the services we can provide, and we will explain this to you if you choose to exercise this right.
e. Right to Data Portability: When the legal basis for our processing is your consent or the processing is necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or request us to transmit it to another person.
f. Right to Automated Decision-Making: We do not use automated decision-making, but where any automated decision-making occurs, you have the right, in that case, to express your point of view and contest the decision, as well as request that decisions based on automated processing concerning you or significantly affecting you and based on your Personal Data be made by natural persons, not just computers.
g. Right to Object to Direct Marketing ('Opt-out'): You can choose whether or not to receive information from us.
h. Right to Withdraw Consent: When the legal basis for processing your personal information is your consent, you have the right to withdraw that consent at any time by contacting us using the details found in this policy.
i. Right to Lodge a Complaint About How We Handle Your Personal Data: If you wish to make a complaint about how we handle your Personal Data, please contact us using the details found in this policy.
9. Changes to the Policy
Arq Brasil may amend the provisions of this Policy at its discretion and at any time. Whenever the Policy is amended, in the manner provided by the LGPD (art. 8, §6), these changes will be valid, effective, and binding after: (1) being published on the Application; and (2) being sent to you by email; and/or (3) being communicated to you by any other means.
Whenever the Policy is changed, these changes will be disclosed on the Platform and may be sent to you by email. You should check the updated version of this Policy every time you visit the Application.
10. Contact Us
Under Law No. 13.709/2018, Arq Brasil is considered the “Controller” of your Personal Data. We are committed to complying with personal data laws and regulations and helping our users have full visibility and control over their personal data. Therefore, if you wish to obtain a copy of your Personal Data processed under this Policy; or if you wish to exercise any of your rights as a data subject as set out in this Policy; or if you have questions related to this Policy, please make your request through the following email: help.br@arqfinance.com.
Effective Date: February 09, 2026
