Privacy Policy

1. Introduction

This Privacy Policy describes how Ezcale Technology de Payments Ltda. ("Ezcale", "we") collects, uses, stores and protects the personal information of users of our payment processing platform and related services.

By using our services, you agree to the practices described in this policy. If you do not agree with this policy, please do not use our services.

2. Data We Collect

2.1 Data You Provide Directly

• Registration Data: Name, email, phone, CPF/CNPJ, address
• Banking Data: Bank account information for settlement
• Company Data: Legal name, CNPJ, information about legal representatives
• Authentication Data: Passwords (stored as hashes), API keys

2.2 Data Collected Automatically

• Access Logs: IP, timestamp, user agent, endpoints accessed
• Transaction Data: Values, timestamps, status, metadata
• Usage Data: Features used, frequency of use
• Cookies: Cookies essential for the platform to function

2.3 Data from Third Parties

We may receive data from our partners (payment gateways, credit bureaus) for validation, fraud prevention and transaction processing.

3. How We Use Your Data

We use your personal information to:

• Process payment transactions and split amounts
• Meet contractual and legal obligations
• Prevent fraud and ensure transaction security
• Provide technical support and customer service
• Improve our services and develop new features
• Send essential communications about your account
• Meet regulatory requirements (BACEN, PCI-DSS, etc.)

4. Legal Basis for Processing (LGPD)

We process your data on the basis of:

• Performance of a Contract: Data necessary to provide the services
• Legal Obligation: Compliance with tax, regulatory and judicial obligations
• Legitimate Interest: Fraud prevention, security and service improvement
• Consent: Marketing communications and non-essential data

5. Data Sharing

We share your data only when necessary with:

5.1 Service Providers

• Payment gateways and acquirers
• Cloud infrastructure providers (AWS, Google Cloud)
• Monitoring and analytics tools
• Compliance and fraud prevention service providers

5.2 Legal Obligations

• Tax and regulatory authorities
• Investigative authorities pursuant to a court order
• Compliance with judicial and administrative decisions

6. Data Security

We implement robust security measures:

• AES-256 encryption for data at rest
• TLS 1.3 for data in transit
• Required multi-factor authentication
• 24/7 security monitoring
• Regular audits and penetration tests
• PCI-DSS Level 1 and ISO 27001 certifications
• Strict role-based access controls

7. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this policy or as required by law:

• Transaction Data: 5 years (tax legal requirement)
• Registration Data: During the contractual relationship + 5 years
• Access Logs: 6 months (regulatory requirement)
• Audit Data: 7 years (compliance requirement)

8. Your Rights (LGPD)

You have the right to:

• Access: Confirm and access your personal data
• Correction: Correct incomplete, inaccurate or outdated data
• Anonymization/Blocking/Deletion: Of unnecessary or excessive data
• Portability: Receive your data in a structured format
• Deletion: Request data deletion (when permitted by law)
• Withdrawal of Consent: Withdraw consent when applicable
• Objection: Object to data processing in certain situations

To exercise your rights, contact our DPO: dpo@ezcale.com

9. International Transfers

Your data may be transferred to and processed on servers located outside Brazil, always with appropriate safeguards under the LGPD. We use standard contractual clauses and internationally recognized certifications.

10. Cookies

We use essential cookies for the platform to function (authentication, security). Analytics and marketing cookies are used only with your explicit consent.

11. Minors

Our services are not directed to individuals under 18. We do not knowingly collect data from minors. If we identify such collection, we will delete the data immediately.

12. Changes to This Policy

We may update this policy periodically. Material changes will be communicated by email 30 days in advance. Continued use of the services after changes constitutes acceptance of the new policy.

13. Contact

For questions about privacy or to exercise your rights:

Data Protection Officer (DPO)
Email: dpo@ezcale.com
Address: Av. Faria Lima, 3144 - São Paulo, SP - 01451-000

You may also file complaints with the Brazilian National Data Protection Authority (ANPD).