Privacy Policy — Payzoi

Last updated: January 2025

This Policy explains how Payzoi (PAYZOI PAGAMENTOS LTDA, enrolled with the CNPJ under No. 34.652.051/0001-10, headquartered at Av. das Américas, 1452, Rio de Janeiro/RJ, Brazil) collects, uses, shares and protects personal data, in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018 – LGPD).

1. Who we are and how Payzoi works

1.1. Payzoi is a payment platform that allows merchants to receive payments from their customers by credit card and Pix on a secure checkout, track sales in a dashboard and withdraw the amounts received.

1.2. This Policy uses three terms:

• Merchant: the individual or legal entity that creates an account on Payzoi to receive payments.
• Buyer: the person who pays a Merchant through the Payzoi checkout.
• Visitor: anyone who accesses our websites, documentation or support channels.

1.3. Roles under the LGPD:

• For the Merchant's registration, account and operational data, Payzoi is the Controller.
• For Buyer data used to process the payment of an order, Payzoi generally acts as Processor, following the instructions of the Merchant, who is the Controller of the purchase relationship.
• Payzoi is the Controller when it processes Buyer data for its own purposes, such as fraud prevention, platform security and compliance with legal and regulatory obligations.

1.4. If your request concerns processing under the Merchant's responsibility, we will direct you to the Merchant and provide the necessary support.

2. Who this Policy applies to

2.1. It applies to Merchants, Buyers and Visitors in their interactions with Payzoi.

2.2. It does not apply to the processing each Merchant carries out on its own websites, stores and systems. That processing is governed by the Merchant's own privacy policy.

3. Summary

• What data: registration and contact data, the Merchant's company and banking data, identity verification documents and selfie, transaction data, payment data (card protected by tokenization), withdrawal data and browsing data.
• What for: processing payments, preventing fraud, maintaining the Merchant's account, making withdrawals, complying with the law and improving the service.
• Legal bases: contract performance, legal or regulatory obligation, legitimate interest, fraud prevention in identification processes, regular exercise of rights and, where required, consent.
• Shared with: the Merchant, payment and financial institutions, card networks, credit bureaus, technology providers and authorities, always to the extent necessary.
• Your rights: access, correction, deletion, portability, information and objection, through the channel in section 13.

4. Personal data we process

4.1. Merchants

• Identification and contact: name, CPF or CNPJ, corporate name, partners and representatives, address, email and phone number (including WhatsApp).
• Identity verification: copies of identity documents and, when requested, a selfie holding the document. The selfie may involve biometric data, which is sensitive personal data under the LGPD.
• Credit and background checks: information obtained from credit bureaus and public databases to confirm registration data.
• Financial data: Pix key for withdrawals, wallet address for USDT withdrawals (when used), balances, statements and withdrawal history.
• Access data: login, dashboard usage logs, API keys and webhook settings.

4.2. Buyers

• Identification and contact: name, email and CPF or CNPJ (required for Pix payments).
• Transaction data: amount, order description, the Merchant's order identifier, date, payment method and status.
• Card payment data: the full card number and security code are transmitted in encrypted form to the processor and are not stored by Payzoi. We keep only limited data, such as the card brand, the last four digits and a token.
• Technical data: IP address, device, browser and country, used for security and fraud prevention.

4.3. Visitors: cookies, identifiers, IP address, device and access logs for our websites.

4.4. Children and adolescents: our services are not intended for persons under 18. If we identify improper processing, we will take steps to stop it.

5. Why we use data and on what legal basis

5.1. We process personal data for the following purposes:

• Process payments and provide the contracted service. Legal basis: contract performance (art. 7, V).
• Create and maintain the Merchant's account and make withdrawals. Legal basis: contract performance (art. 7, V).
• Verify identity and prevent money laundering and terrorist financing. Legal basis: legal or regulatory obligation (art. 7, II).
• Verify identity by selfie (biometric data). Legal basis: fraud prevention and security of the data subject in identification processes (art. 11, II, "g").
• Consult credit bureaus and public databases during registration. Legal basis: credit protection (art. 7, X) and legitimate interest (art. 7, IX).
• Prevent fraud and protect the platform. Legal basis: legitimate interest (art. 7, IX) and credit protection (art. 7, X).
• Send receipts and payment notices. Legal basis: contract performance (art. 7, V).
• Notify the Merchant of charge status (webhooks). Legal basis: contract performance (art. 7, V).
• Keep records required by law. Legal basis: legal obligation (art. 7, II).
• Produce statistics and improve the product. Legal basis: legitimate interest (art. 7, IX), using aggregated or anonymized data whenever possible.
• Defend rights in judicial, administrative or arbitration proceedings. Legal basis: regular exercise of rights (art. 7, VI).
• Send Payzoi marketing communications. Legal basis: consent (art. 7, I), which may be withdrawn at any time.

5.2. When we rely on legitimate interest, we first assess the impact on the data subject's rights and adopt safeguards. You may request information about this assessment through the channel in section 13.

6. Automated decisions

6.1. Our anti-fraud system automatically analyzes transactions to approve or decline payments based on risk signals.

6.2. Under article 20 of the LGPD, you may request information about the criteria used and a review of a decision made solely by automated means, subject to commercial and industrial secrets.

7. Data sharing

7.1. We share data only as necessary for the purposes of this Policy, with:

• The Merchant: data about the payment made to them, such as the Buyer's name and email, amount, payment method and status.
• Payment institutions, acquirers, issuers and card networks: to authorize, process and settle card transactions.
• Financial institutions and Pix participants, including our settlement partner Banco Genial: to generate Pix charges and make withdrawals.
• Credit bureaus and public database providers: to verify registration data of Merchants.
• Service providers for USDT withdrawals: when the Merchant chooses this option.
• Technology providers: hosting, email delivery, anti-fraud, identity verification and support, under contract and following our instructions.
• Authorities and regulators: when there is a legal obligation or an order from a competent authority, including the Central Bank of Brazil and COAF (the Brazilian Financial Intelligence Unit).

7.2. We do not sell personal data.

8. International transfers

8.1. Some providers may store or process data outside Brazil, and payments with foreign cards involve institutions in other countries.

8.2. In these cases, we use the mechanisms provided for in the LGPD and in ANPD regulations, such as standard contractual clauses, and transfer only the necessary data.

9. Cookies

9.1. We use cookies for:

• Operation and security (strictly necessary): cannot be disabled.
• Preferences (functional): can be disabled.
• Usage measurement (analytics): can be disabled.

9.2. You can manage cookies in your browser. Disabling some cookies may affect website features.

10. How long we keep data

10.1. Retention periods:

• Application access logs: at least 6 months (art. 15 of the Brazilian Internet Civil Framework).
• Transaction and withdrawal data: as required by applicable regulations and limitation periods, generally up to 5 years after the transaction, or longer where the law requires.
• Merchant registration and documents: during the relationship and, afterwards, for the legal and regulatory periods.
• Marketing consent: until withdrawn.

10.2. Once these periods end, data is deleted or anonymized, unless the law requires it to be kept.

11. Security

11.1. We adopt technical and administrative measures to protect data, such as encryption in transit, card tokenization, least-privilege access control, monitoring and card industry security standards (PCI-DSS).

11.2. The Merchant is responsible for protecting its own API keys, credentials and systems.

11.3. In the event of a security incident that may cause relevant risk or harm, we will notify the ANPD and the affected data subjects, as required by the LGPD and ANPD regulations.

12. Your rights

12.1. Under article 18 of the LGPD, you may request:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
• portability, subject to commercial and industrial secrets;
• deletion of data processed based on consent, unless the law requires it to be kept;
• information about who we share your data with;
• information about the possibility of not giving consent and its consequences;
• withdrawal of consent;
• objection to processing based on legitimate interest, where applicable.

12.2. How to exercise your rights:

• Merchants: much of the data can be viewed and updated directly in the account dashboard.
• Buyers: for requests about a purchase, we recommend contacting the Merchant first. Payzoi will provide the necessary support.
• Any data subject: may contact our Data Protection Officer directly through the channel in section 13.

12.3. We may request additional information only to confirm your identity. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).