Brazil Privacy Notice (LGPD)

This regional annex describes how Tanqory Inc. ("Tanqory", "we", "us") processes personal data within the territorial scope of Brazil's Lei Geral de Proteção de Dados Pessoais (Federal Law No. 13.709/2018, "LGPD") and the regulations and technical guidance published by the Autoridade Nacional de Proteção de Dados ("ANPD"). It supplements and must be read together with the Tanqory Privacy Policy, the Data Processing Addendum (DPA-master), the Cookie Policy, and the applicable service terms. Where this annex is stricter than another Tanqory document with respect to LGPD-regulated processing, this annex prevails for that processing.

Authoritative sources referenced throughout this annex:

• LGPD consolidated text: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm
• ANPD official portal: https://www.gov.br/anpd/pt-br
• ANPD breach notification guidance and forms: https://www.gov.br/anpd/pt-br/canais_atendimento/agente-de-tratamento

1) Scope and territorial application (LGPD Article 3)

This annex applies where any of the following triggers LGPD jurisdiction under Article 3 of the law:

• (a) personal data are processed in the national territory of Brazil;
• (b) the processing activity is intended to offer or supply goods or services to, or to process data of, individuals located in the national territory of Brazil; or
• (c) the personal data being processed were collected in the national territory of Brazil (meaning the data subject was located in Brazil at the time of collection).

This annex covers data subjects located in Brazil regardless of nationality or residence, and applies to processing carried out by Tanqory and by sub-operators acting on Tanqory's documented instructions in connection with the services. Processing performed solely for journalistic, artistic, academic, public security, national defence, state security, or criminal investigation purposes, or processing of data originating from outside Brazil and not communicated within Brazil, is governed by the carve-outs in Article 4 of the LGPD and is outside the scope of this annex.

2) Roles of the parties — controller, operator, DPO (Articles 5, 37, 41)

Under Article 5 of the LGPD, the parties are classified as follows in relation to the services:

• Controller (controlador): the natural or legal person to whom decisions about the processing of personal data are attributed. For data processed on behalf of merchants, developers, and other Tanqory customers ("Customer Personal Data"), the customer is the controller. For data processed by Tanqory for its own purposes (account administration, billing, security, fraud prevention, service improvement, compliance with legal obligations), Tanqory is the controller.
• Operator (operador): the natural or legal person that processes personal data on behalf of the controller. Tanqory acts as operator with respect to Customer Personal Data and processes such data only on the documented instructions of the controller, as set out in the DPA-master.
• Sub-operators: the subprocessors listed at the subprocessors page, contractually bound by Article 39 / DPA obligations and flow-down requirements.
• Data Protection Officer (Encarregado), Article 41: In accordance with Article 41 of the LGPD, the Encarregado (data protection officer) function is performed by the senior officer designated by the Company for that role, reachable at privacy@tanqory.com. Public contact channel: privacy@tanqory.com with the subject line "LGPD — Encarregado". The Encarregado's responsibilities include accepting complaints and communications from data subjects, receiving communications from the ANPD, orienting employees and contractors on data protection, and performing other duties assigned by the controller or by regulation.

3) Categories of personal data processed and sources

Tanqory processes only personal data that is necessary, adequate, and relevant to the identified purposes (Article 6, II — adequacy; III — necessity):

• account and contact data (full name, e-mail, telephone, business address, role, CPF only where strictly necessary for tax/billing or anti-fraud);
• transaction and billing data (orders, invoices, refunds, dispute records, payment tokens supplied by the payment provider);
• technical and security data (IP address, device fingerprint, browser/OS, time-zone, application logs, cookie identifiers, session identifiers);
• merchant customer data processed on the controller's instructions (orders, fulfilment data, communications);
• sensitive personal data (Article 11) only where strictly necessary, with a specific legal basis as described in section 5; and
• data from publicly accessible sources or sanctions/PEP lists for legal compliance purposes (Article 7, IV; Article 11, II (a)).

Sources include: direct collection from the data subject, collection from the controller (where Tanqory acts as operator), automated collection by Tanqory systems (telemetry and logs), and lawful third-party sources (payment networks, fraud signals, compliance databases).

4) Purposes of processing (Articles 6 and 7)

Personal data are processed for the following specific, explicit, and informed purposes (Article 6, I — purpose):

• providing, operating, and maintaining the services and the merchant account;
• onboarding, identity verification, KYC/AML and sanctions screening where required;
• processing transactions, invoices, refunds, and chargebacks;
• preventing fraud, abuse, and unauthorised access; investigating security incidents;
• communicating service notices and responding to support requests;
• producing aggregated and anonymised analytics to improve the services;
• complying with legal, regulatory, accounting, and tax obligations applicable to Tanqory; and
• exercising rights in judicial, administrative, or arbitral proceedings (Article 7, VI).

Purposes are documented in the Records of Processing Activities (Article 37) and reviewed before any material change. Where processing for a new purpose is not compatible with the original purpose, Tanqory will refresh the legal basis and, where required, obtain renewed consent.

5) Legal bases for processing (Articles 7 and 11)

For non-sensitive personal data, Tanqory relies on one or more of the legal hypotheses set out in Article 7 of the LGPD:

• Consent (Article 7, I): for optional marketing communications, non-essential cookies, and other processing where no other hypothesis is appropriate. Consent is free, informed, unequivocal, and obtained for specific purposes; generic authorisations are not relied upon (Article 8 §4).
• Compliance with a legal or regulatory obligation by the controller (Article 7, II): for tax, accounting, AML/CFT, and consumer-law obligations.
• Performance of a contract or preliminary procedures related to a contract to which the data subject is a party (Article 7, V): for account creation, service delivery, billing, and support.
• Regular exercise of rights in judicial, administrative, or arbitral proceedings (Article 7, VI).
• Protection of life or physical safety of the data subject or a third party (Article 7, VII).
• Legitimate interests of the controller or third party (Article 7, IX): for security, fraud prevention, network and information security, and service reliability, subject to the balancing test in Article 10 and the data subject's reasonable expectations. A legitimate interest assessment is recorded for each such processing activity.
• Credit protection (Article 7, X): only where directly applicable.

For sensitive personal data within the meaning of Article 5, II (racial or ethnic origin, religious conviction, political opinion, trade-union or religious/philosophical/political organisation membership, data referring to health or sex life, genetic or biometric data when linked to a natural person), Tanqory relies on the hypotheses in Article 11, principally:

• specific and highlighted consent of the data subject, for specific purposes (Article 11, I); or, when consent is not applicable,
• compliance with a legal or regulatory obligation by the controller (Article 11, II (a));
• regular exercise of rights, including in contract and in judicial, administrative, or arbitral proceedings (Article 11, II (d));
• protection of life or physical safety (Article 11, II (e)); or
• fraud prevention and security of the data subject in identification and authentication processes (Article 11, II (g)).

Sensitive data are subject to additional access restrictions, encryption, logging, and minimisation.

6) Children and adolescents (Article 14)

Processing of personal data of children (under 12) is carried out in their best interest and requires specific and highlighted consent given by at least one of the parents or by the legal guardian (Article 14 §1). Tanqory does not condition the participation of children in games, internet applications, or other activities on the provision of personal data beyond what is strictly necessary to the activity (Article 14 §3). For adolescents (12 to 17), processing is carried out with their consent and, where applicable, parental support, and is calibrated to their level of development. Tanqory does not engage in behavioural advertising directed to identified minors and applies privacy-by-default settings for accounts identified as belonging to minors. Reasonable efforts are made, taking available technology into account, to verify that consent was given by the responsible adult (Article 14 §5).

7) Data subject rights (Article 18)

Subject to the conditions and exceptions of the LGPD, data subjects in Brazil may, at any time and by means of an express request, exercise the following rights free of charge against the controller (Article 18):

• (I) confirmation of the existence of processing;
• (II) access to the data;
• (III) correction of incomplete, inaccurate, or outdated data;
• (IV) anonymisation, blocking, or deletion of unnecessary or excessive data or data processed in non-compliance with the LGPD;
• (V) portability of the data to another service or product provider, by means of an express request, observing commercial and industrial secrets and ANPD regulation;
• (VI) deletion of personal data processed with the consent of the data subject, except in the hypotheses provided for in Article 16 (legal/regulatory retention, study by research bodies, transfer to third parties subject to LGPD, exclusive use of the controller with anonymisation);
• (VII) information about public and private entities with which the controller has shared data;
• (VIII) information about the possibility of not providing consent and the consequences of refusal;
• (IX) revocation of consent, under the terms of Article 8 §5; and
• the right to petition the ANPD and consumer protection bodies, and the right to oppose processing carried out on the basis of one of the hypotheses of waiver of consent, in case of non-compliance with the LGPD (Article 18 §2).

Requests are submitted to privacy@tanqory.com with the subject line "LGPD — Article 18 request". Tanqory responds in a simplified, immediate format or, in a complete declarative format, within 15 days from the date of the request (Article 19 §1, II), subject to identity verification. Where a request cannot be granted, Tanqory provides a reasoned reply identifying the factual or legal grounds and, if Tanqory is acting as operator only, forwards the request to the controller.

8) International transfers of personal data (Articles 33–36)

Tanqory operates as Tanqory Inc. (Delaware, USA — global operations), with Tanqory OÜ (Estonia) as EU representative, and engages subprocessors located in additional jurisdictions. International transfers of personal data subject to the LGPD are carried out only where one of the hypotheses of Article 33 applies, namely:

• (I) transfer to countries that provide a level of personal data protection adequate to the LGPD, as recognised by the ANPD;
• (II) where the controller offers and demonstrates guarantees of compliance with the principles, data subject rights, and data protection regime of the LGPD through specific contractual clauses, standard contractual clauses, global corporate norms, or stamps, certificates, and codes of conduct regularly issued;
• (III) when the transfer is necessary for international legal cooperation between public intelligence, investigation, and prosecution bodies, in accordance with the instruments of international law;
• (IV) when the transfer is necessary to protect the life or physical safety of the data subject or third party;
• (V) when the ANPD authorises the transfer;
• (VI) when the transfer results in a commitment assumed under an international cooperation agreement;
• (VII) when the transfer is necessary for the execution of a public policy or legal attribution of a public service;
• (VIII) when the data subject has provided specific and highlighted consent for the transfer, with prior information on the international nature of the operation, clearly distinguishing it from other purposes; or
• (IX) when necessary to comply with a legal or regulatory obligation, to perform a contract or preliminary procedures, or for the regular exercise of rights.

Tanqory relies principally on hypotheses (II) (standard contractual clauses and supplementary measures), (IX) (contract performance), and, where applicable, (VIII) (specific consent). Sub-operators are bound by the DPA-master, including obligations on confidentiality, security, breach notification, and onward transfer limitations. Transfer impact assessments are recorded for transfers to jurisdictions where local law may materially affect the protection of personal data.

9) Security, technical and administrative measures (Articles 46–49)

Tanqory adopts security, technical, and administrative measures capable of protecting personal data from unauthorised access and from accidental or unlawful situations of destruction, loss, alteration, communication, or any form of inadequate or unlawful processing (Article 46). Measures include, without limitation:

• encryption in transit (TLS 1.3 or higher) and at rest (AES-256 or equivalent);
• role-based access controls, least-privilege, multi-factor authentication for administrative access, and periodic access reviews;
• network segmentation, intrusion detection, web application firewalls, vulnerability management, and dependency scanning;
• secure software development lifecycle, code review, and pre-release security testing;
• logging, monitoring, and a 24x7 security operations capability;
• business continuity and disaster recovery plans tested on a documented cadence; and
• vendor due diligence and contractual security obligations.

Measures are calibrated to the nature of the information processed, the specific characteristics of the processing, and the state of the art (Article 46 §1) and are reviewed periodically and after material incidents.

10) Data breach notification (Article 48)

Tanqory communicates to the ANPD and to the data subject the occurrence of a security incident that may create a relevant risk or damage to data subjects (Article 48). The communication is made in a reasonable time, as defined by the ANPD, and includes at minimum (Article 48 §1):

• (I) the description of the nature of the affected personal data;
• (II) information on the data subjects involved;
• (III) the technical and security measures used for the protection of the data, observing commercial and industrial secrets;
• (IV) the risks related to the incident;
• (V) the reasons for delay, where the communication was not immediate; and
• (VI) the measures that have been or will be adopted to revert or mitigate the effects of the damage.

Where Tanqory acts as operator, Tanqory notifies the controller without undue delay after becoming aware of the incident and supports the controller in fulfilling the controller's Article 48 obligations. Internal triage and notification procedures follow the operational timelines set out in the DPA-master and the Tanqory incident response runbook.

11) Records of processing activities (Article 37)

Tanqory and its operators maintain records of the processing of personal data carried out, especially when based on legitimate interest, in accordance with Article 37 of the LGPD. The records include, at minimum, the categories of data, purposes, legal basis, data subjects, recipients, transfers, retention periods, and a general description of security measures. Records are available to the ANPD upon legitimate request (Article 37, together with Article 50 §2, I (d)).

12) Automated decisions and profiling (Article 20)

Data subjects have the right to request the review of decisions taken solely on the basis of automated processing of personal data affecting their interests, including decisions intended to define their personal, professional, consumer, or credit profile, or aspects of their personality (Article 20). On request, Tanqory provides clear and adequate information regarding the criteria and procedures used for the automated decision, observing commercial and industrial secrets (Article 20 §1). Human review channels are available through privacy@tanqory.com.

13) Anonymisation, pseudonymisation, and shared databases

Anonymised data are not considered personal data for the purposes of the LGPD, except when the anonymisation process can be reversed using only the controller's own efforts or, with reasonable effort, by third parties (Article 12). Tanqory applies anonymisation and pseudonymisation to analytics and product-development datasets where feasible, prohibits re-identification attempts, and treats pseudonymous data as personal data subject to this annex.

14) Retention and deletion

Personal data are retained only for the period necessary to fulfil the purposes for which they were collected or to comply with a legal or regulatory obligation (Article 15 and Article 16). At the end of the retention period, personal data are deleted or anonymised, except for the cases provided for in Article 16. Backup deletion follows the rolling cycles described in the Tanqory retention schedule. The retention schedule is available at https://legal.tanqory.com/legal/data-protection/data-retention-policy.

15) Subprocessors and onward processing

Tanqory engages sub-operators (subprocessors) under written agreements that impose obligations equivalent to those applicable to Tanqory under the DPA-master, including security, confidentiality, breach notification, audit, and onward transfer obligations. The current list of subprocessors is published at https://legal.tanqory.com/legal/data-protection/subprocessor-list. Material changes are notified through the customer channel agreed in the DPA-master so that customer-controllers may exercise their objection rights.

16) Sanctions and ANPD enforcement (Article 52)

Tanqory acknowledges that the ANPD may apply the administrative sanctions provided for in Article 52 of the LGPD, including warning, simple or daily fine of up to 2% of the turnover of the legal entity, group, or conglomerate in Brazil in its last fiscal year, excluding taxes, limited to BRL 50,000,000 per infraction, publication of the infraction, blocking, deletion, partial suspension of the database, suspension of the processing activity, or partial or total prohibition of the exercise of activities related to data processing.

17) How to file a complaint

• Internal channel: privacy@tanqory.com (subject line "LGPD complaint"). Complaints are routed to the Encarregado.
• ANPD: https://www.gov.br/anpd/pt-br — petitions may be filed against the controller for the rights and remedies described in the LGPD.
• Consumer protection bodies: PROCON or the relevant Sistema Nacional de Defesa do Consumidor agency.
• Public Prosecutor's Office (Ministério Público) and the courts of Brazil.

18) Relationship with other Tanqory documents

This annex supplements the Tanqory Privacy Policy, the DPA-master, the Cookie Policy, and the applicable service terms. In case of conflict between this annex and another Tanqory document with respect to LGPD-regulated processing, this annex prevails. References to "data controller" in other Tanqory documents are read as "controlador", "data processor" as "operador", and "data protection officer" as "Encarregado", where the context concerns LGPD-regulated processing.

19) Contact

• Privacy and rights requests (LGPD Article 18): privacy@tanqory.com
• Encarregado (Article 41): privacy@tanqory.com (subject line "LGPD — Encarregado")
• Registered agent (controller): Tanqory Inc., c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA

20) Change history