Privacy Policy

This document was written in a simple and accessible manner, with several examples of Personal Data collection and use, precisely so that You can read and understand how we use your Personal Data to offer you a safe and comfortable experience while using the Services.

With this in mind, we systematized the definition of some key terms used in this Policy. In this sense, the words below, when used in singular or plural, will have the following meanings, without prejudice to other definitions attributed in this Policy and in the Terms of Use.

As it is a Service that involves payment operations, Impact and the Partner may act together with other companies to perform various activities, including for the evaluation of your financial capacity, such as through credit score verification and monitoring of your CPF registration status.

Therefore, Impact and the Partner reserve the right to share your Personal Data with third parties, in order to receive, analyze and make decisions about requests related to the Services. Such sharing with third parties may include Personal Data related to your financial situation and, whenever possible, sharing will be done in a pseudonymized manner, aiming to preserve your privacy to the maximum extent.

Impact and the Partner do not license or transfer your Personal Data, except to the categories of companies listed below:

Impact and the Partner declare to You that your Personal Data will be shared between them, and must be maintained, for the purpose of complying with user identification rules and money laundering prevention, under the terms of current regulations.

TO SAFEGUARD AND PROTECT THE RIGHTS OF IMPACT AND THE PARTNER: WITHOUT PREJUDICE TO THE PROVISIONS OF APPLICABLE BRAZILIAN LEGISLATION, IMPACT AND THE PARTNER RESERVE THE RIGHT TO ACCESS, READ, PRESERVE AND DISCLOSE ANY PERSONAL DATA NECESSARY TO COMPLY WITH A LEGAL OBLIGATION OR A COURT ORDER ISSUED BY COMPETENT AUTHORITIES; ENFORCE OR APPLY THE TERMS OF USE AND OTHER AGREEMENTS SIGNED WITH YOU; OR PROTECT THE RIGHTS, PROPERTY OR SECURITY OF IMPACT AND THE PARTNER, AND THEIR RESPECTIVE REPRESENTATIVES, SERVICE PROVIDERS, EMPLOYEES OR USERS.

Impact and the Partner may transfer Personal Data collected in Brazil to the USA. This transfer will occur when the company responsible for hosting Personal Data, which may be contracted by Impact and/or the Partner, is located in American territory. However, before transferring your Personal Data to another country, it will be ensured that the country provides the degree of Personal Data protection required in this Privacy Policy, or that Impact and the Partner will guarantee compliance, regardless of foreign legislation, with the principles, subject rights and Personal Data protection set forth in this Privacy Policy, in accordance with applicable standards.

Impact and the Partner are headquartered in Brazil and the Personal Data we collect is governed by Brazilian law. By accessing or using the Services or providing Personal Data to Impact and the Partner, You agree to the processing and transfer of such Personal Data to Brazil and to the USA, if applicable, subject to the conditions set forth above.

You may always choose not to disclose your Personal Data to Impact and the Partner, but keep in mind that some of this Personal Data may be essential to allow your registration, access and use of the Services or some of the features and products offered to You in connection with this Privacy Policy.

Regardless, You will always have rights related to privacy and protection of your Personal Data. In addition to Impact and the Partner being concerned with the security of your Personal Data, they are also concerned that You have access to and knowledge of all your rights related to them.

Therefore, below are summarized all the rights You have under Brazilian laws related to data protection, which are:

• Right to confirm the existence of processing activity;
• Right of access;
• Right of rectification;
• Right of deletion or cancellation;
• Right of objection or opposition to processing;
• Right to restrict processing;
• Right to review automated decisions made based on your data;
• Right to data portability;
• Right to withdraw your consent;
• Right to anonymization or blocking of your data;
• Right not to provide consent and to be informed about related consequences;
• Right to Petition before Public Authorities and exercise your Rights and Interests in Court

In this regard, below is a brief explanation and examples of some of these rights:

To present your manifestations, requests and objections related to this Privacy Policy, You must present an express request, in your name or through your legally constituted representative. This request will have no cost and may be sent to Impact to the email indicated in clause 8 below. Information and Personal Data that You request may be provided via email or in printed form, at your discretion.

It may be necessary to request specific documents and/or information from you to help Impact and the Partner confirm your identity and guarantee your right to access your Personal Data (or to exercise your other rights). This is a security measure to ensure that Personal Data is not disclosed to anyone who does not have the right to receive it.

Impact may also contact you to obtain more information regarding your request, in order to speed up the response. Confirmations of the existence of Personal Data Processing and immediate access to them will be provided, in simplified format or through detailed statement, within 15 days. For other communications and responses to your requests, such as portability of your Personal Data, Impact will try to respond to all legitimate requests within a maximum of 30 days. However, handling requests of this nature may take more than 30 days if your request is particularly complex or if You have made several requests. In this case, Impact will notify you and keep you updated on the progress of your request.

If You have any questions about these issues and about how You can exercise the rights provided for in this Privacy Policy, feel free to contact Impact through the Communication Channels.

Impact and the Partner maintain your Personal Data only for the time necessary to achieve the purposes for which we collect them, including for the purpose of complying with any legal, contractual, accountability obligations or requests from competent authorities, observing a minimum period of 5 (five) years from the date of Personal Data collection, in compliance with the provisions of Resolution nº 85 of the Central Bank of Brazil.

To determine the appropriate retention period for Personal Data storage, we consider their quantity, nature and sensitivity, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purpose of Processing and whether we can achieve such purposes through other means, observing applicable legal requirements.

And if You registered an Account in the Services, your Account information will be maintained while You keep that Account active, observing the legal period mentioned above, or until the purpose for which Personal Data was requested is achieved. If certain Personal Data is no longer necessary to achieve a certain purpose, it will be deleted or subject to anonymization. Personal Data will also be deleted in the event that Public Authorities determine the termination of Processing.

If You request the deletion of your Personal Data and/or your Account, Impact and the Partner will delete them or subject them to anonymization, as soon as the legal period of 5 (five) years mentioned above elapses, unless their maintenance is determined based on legal obligations, or request from competent authorities.

In our products and services we apply strict technological and procedural controls to guarantee the security and protection of all Personal Data collected and stored in our environment.

In order to guarantee the protection of your Personal Data and provide a secure environment, we adopt practices related to information security, such as user authentication, strict access control, encryption of Personal Data and transaction content, prevention and detection of intrusion and unauthorized access, prevention of information leakage, periodic performance of tests and scans to detect vulnerabilities, protection against malicious software, traceability mechanisms, access and computer network segmentation controls, maintenance of backup copies of Personal Data and information, among others.

However, in addition to the protections that Impact applies, it is also important that You have secure behavior, identifying and avoiding situations that may threaten the security of your Personal Data and our products and services. If You identify or become aware of something that compromises the security of your Personal Data, it is essential that you contact Impact.

In situations where You use your Personal Data and Card data for registration or transactions on third-party websites or services, the responsibility for protecting and storing Personal Data in these locations belongs to the providers of such services and You must pay attention to the content of privacy policies applicable to the use of such third-party websites or services.

If You believe that your personal information has been used in a manner incompatible with this Policy or with your choices as Data Subject, or if You have other questions, comments, suggestions or requests related to this Policy, You can contact us at the following contact addresses:

As we are always seeking to improve the Services, this Policy may undergo updates. Therefore, we recommend visiting this page periodically so that You are aware of modifications. If relevant changes are made that require new consent from you, we will publish this update and request new consent from You.

In compliance with pertinent legal obligations, contact with Data Protection Officers may be made through the emails documentos@impact.com.br and dpo@dock.tech.