Privacy Policy

1.1. Welcome to BLOCKBR. Your privacy is essential to us. Whether you are a customer, employee, collaborator, service provider, or visitor to our site (www.blockbr.com.br) and/or mobile app and/or own and third-party APIs (hereinafter referred to as 'Platform'), know that BLOCKBR is attentive to the protection of your personal data.

1.2. If you are interested in one of our products and wish to use the Platform, please read this Privacy and Personal Data Protection Policy. Understand that you can only use our Platform and services if you agree with the respective conditions, so by doing so, you agree with the entire content of these documents. Similarly, if you are our employee, collaborator, service provider, or maintain any other type of relationship with BLOCKBR, know that you can only start this relationship if you agree with this Privacy and Personal Data Protection Policy, so by relating to BLOCKBR, you agree with the entire content of this document.

1.3. Individuals representing legal entities, when not the legal representatives of the relevant legal entities as per their current constitutive acts, may have their authorization to access the Platform conditioned on the provision of authorizations by the legal entities to which they are affiliated.

1.4. BLOCKBR may establish specific rules applicable to a particular product, as the case may be, which will complement and prevail over this Privacy and Personal Data Protection Policy and the Terms of Use. In any case, you must accept the applicable terms and conditions.

1.5. This Policy was constructed in compliance with Law No. 13.709/2018 ('General Data Protection Law') and No. 12.965/2014 ('Internet Civil Framework') to clarify to you (i) what personal data, how and for what they are processed; (ii) what are your rights, under the legislation and norms applicable to the protection of personal data and (iii) what are our obligations, applying to our offline and online interactions and to all activities and services provided. However, it does not cover the practices of other organizations referenced through links on our Platform, for which we ask you to observe the Privacy Policies and Terms of Use of third parties.

2.1. We are BLOCKBR DIGITAL SERVICES LTD., a company registered under CNPJ No. 43.723.993.0001/32, with headquarters at Avenida Presidente Juscelino Kubitschek, 2041, Tower D, São Paulo - SP, 04543-011.

3.1. Personal data refers to all information related to a natural person, identified or identifiable, such as name, identity document, address, contact information, etc.

3.2 Your data can be collected by BLOCKBR when...

3.2. Your data can be collected by BLOCKBR when you:

a) browse our website, register, and carry out transactions on the Platform

b) share essential information for the execution of services and improvement of BLOCKBR's processes

c) contact our customer service channels.

3.3. Other possible ways of obtaining data by BLOCKBR, as applicable, are through external partners and information providers, who help us understand demographic data and socioeconomic profiles, complementing the data collected by us; social networks, as long as you have granted permission to access your data on one or more networks, as well as official public sources, such as public or private databases.

3.4. All sources of data collection ensure the protection and confidentiality of your data in accordance with the practices described here, with legislation, and applicable norms.

3.5. The personal data that will be requested for you to have full access to our services, as applicable, are: in the case of a natural person: CPF (Individual Taxpayer Registry), date of birth, and email. In the case of a legal entity, BLOCKBR will establish the documents that will be requested.

3.7. Without the submission of these documents and information, the use of our channels, services, and functionalities may be restricted and even rendered impossible. BLOCKBR may, as applicable, request other necessary documents from you, with the aim of ensuring full access to the Platform's services, such as income and residence proofs, as necessary. In any case, the necessary documents are informed at https://www.blockbrinvest.blockbr.com.br/register. Consult this link when registering for use of the Platform.

3.8. When you register, browse our Platform, and use BLOCKBR's services, the following data and information may be collected, among others:

a) Contact data: phone numbers, with the aim of providing greater security to the services and fidelity of the information you provide;

b) Credentials: we collect cryptographic hashes of passwords, secure words, security PIN, and security information necessary chosen by you for the process of authentication, access to accounts, and transactions, for adequate control of access to your account;

c) Demographic data: gender, address, education, income;

d) Financial data: we collect data necessary for withdrawals in Reais (R$), such as bank, account number, and agency, as well as data and history of operations carried out on the Platform for your control. We collect API keys for trading and encrypted wallet address;

e) Usage data: in addition to data related to your transactions with Cryptoassets, including your user profile, we store data related to your interaction with our communication channels, such as visit duration, navigation paths on the Platform, pageview behavior, characteristics of the access device, browser, Internet Protocol (IP) address with date and time, IP origin, bandwidth and internet service provider (ISP), operating system, device manufacturer, carrier, model, Wi-Fi networks, phone number, device data, device identifier (IMEI/MEID), mobile carrier, and country of registration and configuration;

f) Customer service data: your interaction in our customer service channels is also recorded, as well as other details of your contact, which may include chat conversation content;

g) Relationship data: only when unequivocal permission is granted, we may capture data on who your network contacts are;

h) Location data: we may collect location data through our Platform, originating from GPS (Global Navigation System), GNSS (Global Navigation Satellite System), mobile communication towers, Wi-Fi access points, or location derived from your IP.

i) Investor Profile data: we may collect data related to the assets in which you normally invest, for what duration, and how you would behave in case of abrupt value losses;

3.9. Contracting services provided by BLOCKBR presupposes the sending of electronic messages (such as, for example, emails, notifications, and SMS) of a security and administrative nature, with this sending being essential for the execution and development of our activity. If you do not agree with this procedure, it is necessary to request the cancellation of your account at BLOCKBR.

4.1. The main purpose for which we collect your personal data is to fulfill a contract with you and provide you with the best experience, in a secure, efficient, and customized manner. We also use the collected data to create, develop, analyze, communicate, operate, deliver, and improve our products, processes, and services, to deliver better and complete personalized experiences. In addition to the provisions of this item, we may use the collected data to:

a) Allow and personalize content, make changes to our products and channels,

b) Improve our products, processes, and services, and allow access to investment products or;

c) Enable internal data analysis for permission and access to types of products suitable for the profile;

d) Provide new functionalities, products, and promotional dynamics such as hiring platform as a service, buying and/or selling digital assets, cryptocurrencies, and/or any financial asset;

e) Offer new products and/or services to you, as well as personalized service and investment portfolio monitoring;

f) Conduct research and campaigns, in order to continually improve the user experience with BLOCKBR.

g) Solve problems and doubts, ensuring the quality of our services and customer support.

h) Establish a relevant and assertive dialogue, respecting your interaction preferences, as well as sending important notices, such as announcements, software changes, functionalities, conditions, and policies, among others;

i) Further sophisticate our security, acting effectively in suspicious activities and violations of terms or policies;

j) Analyze performance, trends, and measure the audience of the Platform, verify your browsing habits on the Platform, the way you arrived at the Platform (for example, through links from other sites, search engines, or directly), evaluate statistics related to the number of accesses and use of the Platform, its features, and functionalities;

k) Evaluate and monitor risks for the security of the Platform, improving and developing our security tools, including in compliance with our guidelines for the Prevention of Money Laundering and Combating the Financing of Terrorism;

l) Compliance with legal and regulatory obligations.

4.2. For the purposes of your qualification, training, and for your safety, BLOCKBR may monitor or record telephone conversations with you or with people acting on your behalf. When communicating with BLOCKBR, you understand, agree, and authorize that communications may be listened to, monitored, and/or recorded without prior notice or notification.

4.3. You agree and authorize BLOCKBR to use, copy, reproduce, make available, transmit, process, share, and translate into other languages all and any testimonials, statements, opinions, impressions, comments, and suggestions that you decide to make public on our Platform, including social networks, whether or not associated with your name and profile picture on these networks, without any remuneration due by BLOCKBR.

4.4. In addition to the above, BLOCKBR, respecting your privacy, sends messages by electronic means such as a notification center on the Platform itself, emails, SMS, and notifications to confirm Platform activities, for advertising purposes and uses technologies such as cookies, pixel tags, local storage, or other identifiers, from mobile devices or not, for account authentication, service improvement, personalization, and for mass interest communications. The frequency of sending may vary according to your interaction with these communications. At any time, you can request the interruption of these emails, SMS, and notifications through our communication channels, which will be attended by BLOCKBR within 10 (ten) days from your request, accessing:

a) Notifications on the Platform and SMS, in the menu 'Settings > Preferences > Notifications'.

b) Promotional emails, through the respective unsubscription link.

4.5. The data will be processed by BLOCKBR for the period necessary or relevant to achieve the purposes set out in the Terms of Use and in this Privacy and Personal Data Protection Policy, except for conservation cases provided for in applicable legislation, especially in the General Data Protection Law, Internet Civil Framework, Consumer Protection Code, and Civil Code.

5.1. BLOCKBR ensures rights that you have in accordance with the General Data Protection Law, the Internet Civil Framework, and other Brazilian sectoral laws related to data protection, namely:

a) Access to personal data: allows you to access your personal data provided in your registration in your own account and to request additional information, if desired;

b) Rectification of your personal data: allows you to request the correction and/or rectification of your personal data, at any time, if you identify that some of them are incomplete, inaccurate, or outdated;

c) Blocking or elimination of unnecessary, excessive personal data or data processed in non-compliance with the General Data Protection Law: allows you to ask to cease the processing of your personal data, with the measure taken being evaluated and attended to according to each case, reserving the duty of custody for the legal period of the Internet Civil Framework, the Consumer Protection Code, and the Civil Code, observing the prescription period of any judicial or administrative claims;

d) Right to data portability: allows you to request that BLOCKBR provide your personal data to you, or to third parties you have chosen, in a structured and interoperable format;

e) Right to deletion of personal data processed with the consent of the data subject: allows you to request the deletion of your personal data when the processing of these data is optional and based on your consent, except for the maintenance of data necessary for (i) compliance with a legal or regulatory obligation; (ii) study by a research body, ensuring, whenever possible, the anonymization of personal data; (iii) by a judicial or administrative decision that requires it; or (iv) due to the duty of custody for the legal period of the Internet Civil Framework, Consumer Protection Code, and Civil Code, observing the prescription period of any judicial or administrative claims.

f) Right to information about the sharing of personal data: allows you to request information about third parties with whom BLOCKBR shares your personal data;

g) Right to revoke consent at any time and the right not to provide it and the consequences of not providing it: allows you to revoke your consent at any time, noting that depending on the nature of the personal data, the revocation may imply the impossibility of using the Platform definitively. The revocation of consent does not have retroactive effects.

5.2. To exercise your rights, you can use the contact channels of our Platform, preferably, except if your contract with BLOCKBR provides otherwise.

5.3. If you are one of our customers, before responding to your request, BLOCKBR will request additional information to confirm your identity, through one of our KYC - Know Your Client tools. In cases where BLOCKBR is not the Controller of the personal data of the requester, BLOCKBR will inform the requester about its position as Operator of personal data and, if possible, will indicate the Controller, responsible for responding to your request.

5.4. In addition to rights, you also have some duties set out in this Policy, some of them governed by the Terms of Use, others in specific contracts with you. If you do not observe them, especially the duties related to the security of your personal data, such as acts of disclosing your access information (login and password) to third parties, using public access computers (e.g., internet cafes) or any other form of internet connection that is not private and secure, or, still, using mobile devices with jailbreak or applications from unofficial stores, BLOCKBR will not be responsible for acts or facts resulting from the breach of these duties and/or in which you act with exclusive or concurrent fault.

5.5. If you need any assistance in exercising your rights, you should contact our Help Center, through the email address suporte@blockbr.com.br

6.1. Cookies, the Data Management Platform ('DMP'), and similar technologies support the customer identification process, communication, and other marketing actions, in addition to enabling the protection of collected data. They store information in web browsers used on computers, phones, and other devices, which provide information about your use of our Platform. They are useful in the processes of authentication, advertising, recommendations, audience measurements, features and functionalities of the channels, security analyses for the improvement and development of anti-fraud tools.

6.2. BLOCKBR uses its own essential cookies for control, monitoring, and tracking of potential vulnerabilities, incident risks, and information security incidents, to act preventively and provide a safe environment for our customers. We also use third-party cookies for statistical analysis of navigation data, in order to evaluate our Platform and constantly improve our services and products, offering a more customized user experience.

6.3. Our own cookies are essential for BLOCKBR to ensure a safe browsing environment and to provide you with adequate services, and cannot be disabled.

6.4. By accessing and connecting to BLOCKBR's channels, you agree to receive a more personalized browsing experience and authorize the storage, treatment, and sharing, under the terms provided here, of the information already mentioned.

7.1. BLOCKBR will store your personal data as long as the contractual relationship with you lasts, except for legal or regulatory provisions to the contrary, and as necessary for the maximum prescription periods provided in the Internet Civil Framework, the Consumer Protection Code, and the Civil Code. In cases where there is no contractual relationship, BLOCKBR will keep the information you agreed to provide us until a subsequent request for disposal of your data and in accordance with applicable legislation.

8.1. BLOCKBR may share your personal data and other data indicated in item 3.8 above with companies belonging to the same economic group as BLOCKBR, including Cripto Pagamentos Ltda. for processing operations of buying and selling Cryptoassets, offering specific functionalities (such as viewing and/or accessing your BLOCKBR account through the Cripto Pagamentos app, if you are a client of Cripto Pagamentos), development, and offering of products, services, and registration in said companies. When sharing personal data with third parties is necessary for the development and offering of products and services that best meet your interests, generation of statistical and aggregated data about the use of the Platform, BLOCKBR will adopt, as far as possible, the anonymization of these data.

8.2. BLOCKBR may also share your personal data in auditing processes for corporate operations or with partners and service providers in cases necessary for the execution of a contract with you.

8.3. BLOCKBR can collect information about you through identity verification entities and data bureaus to detect possible frauds, as well as from credit bureaus, for credit analysis, including, but not limited to, Accuity, PH3A, Serasa Experian, Federal Revenue Service, Advice, UpMiner, and Google.

8.4. BLOCKBR may share your personal data with its partners to provide its services, execute the contract with you, credit analyses, and fraud prevention, as well as to implement its Compliance policies and Know Your Client, Money Laundering Prevention, and Terrorism Financing.

8.5. BLOCKBR may share your personal data with public authorities, in case of investigative processes or administrative or judicial requests in Brazil or abroad (in this case, ensuring to give the personal data the same level of protection offered in Brazil) or by order of a competent authority, such as regulatory agencies, government bodies, in accordance with the legislation and applicable norms.

8.6. BLOCKBR may conduct international transfers of personal data, either by force of contracts with technology service providers located outside the country, or by request of foreign data protection authorities or government entities, all in compliance with the General Data Protection Law.

9.1. BLOCKBR has incorporated all the requirements of the General Data Protection Law and other laws and norms regarding data protection in the processing of your personal data, adopting the following premises:

a) Data minimization. In all personal data processing, whether physical or digital, BLOCKBR ensures to collect and process personal data minimally necessary and compatible with the purposes, described and informed to the data subjects (complying with the principles of purpose, adequacy, and necessity).

b) Transparency. BLOCKBR ensures that all personal data processing, including the different forms of collection, use, and storage, is fully known to the data subjects regarding the type of data, purpose, as well as their preservation and storage period.

c) Confidentiality. BLOCKBR adopts organizational and technical measures aimed at the confidentiality of personal data under its responsibility, managing and controlling access only to authorized personnel, as well as adopting log tracking measures for risk anticipation and mitigation.

d) Prevention and security. BLOCKBR conducts periodic risk assessments and, thereby, updates technical information security measures to ensure adequate protection of personal data. In this sense, it also ensures that, as far as possible, there is anonymization or at least pseudonymization of personal data used for scientific research, statistical analysis, and evaluation of any nature to meet legitimate interests of BLOCKBR, especially those that are shared with third parties.

e) Free access and data quality. BLOCKBR guarantees to the data subjects easy and free access to their personal data, including to ensure that the data are clear, precise, and up-to-date.

f) Non-discrimination. BLOCKBR ensures that all personal data processing is conducted lawfully, without any form of discrimination.

g) Relationship with third parties. In all its relationships with third parties involving the flow of personal data under the responsibility of BLOCKBR, whether with affiliated, partner companies, or service providers, BLOCKBR will ensure that contracts contain clauses transmitting instructions and disciplining the duties and obligations of third parties regarding the protection of personal data of which you are the data subject.

h) Accountability and reporting. BLOCKBR continuously attends to adopt effective measures capable of proving compliance and fulfillment of personal data protection norms.

9.2. All personal data are stored in a secure environment, in cloud ('cloud') and on physical servers of providers chosen with the premise of respecting data protection legislation, and BLOCKBR not only observes all rules for international data transfer but also ensures to transmit to its technological service providers the company's guidelines for data protection, guaranteeing to data subjects the same level of protection required by national legislation.

10.1. BLOCKBR adopts organizational measures, training and empowering its internal staff, as well as technical measures aimed at information security, to protect personal data against unauthorized disclosure, improper access, modification, loss, or data leakage, accidentally or unlawfully. BLOCKBR applies the best security practices in the treatment of personal data, such as encryption, monitoring, and periodic security testing, firewalls, among others. Nevertheless, despite all its efforts towards information security, unauthorized access or use of client restricted areas due to the data subject’s own fault (you), or hardware or software failure, and cyber-attacks can compromise the security of your personal data.

10.2. BLOCKBR adopts access control mechanisms and log tracking, with different levels of access restriction to the collected data, ensuring in its specific contracts - whether with internal personnel, collaborators, or service providers - that non-compliance with this rule implies fines and contract terminations.

10.3. Maintain a safe environment; adopt good practices in creating access passwords, do not share third-party data, such as logins and passwords, use strong passwords, do not use the BLOCKBR password on other sites or services, changing it periodically; enable two-step verification. It is also important to always log out of our Platform at the end of your use, avoiding the use of computers or public access networks and keeping your operating system and antivirus updated.

10.4. BLOCKBR does not send emails or notifications requesting confirmation of personal data, passwords, credit card numbers, encrypted wallet addresses, etc.; this can be phishing, a fraudulent practice aimed at inducing you to share personal information, logins, and passwords with malicious people. We also do not send electronic messages with attachments that can be executed (extensions: .exe, .com, among others) or links for possible downloads. Never respond to these emails and report them in our customer service channels.

10.5. If you become aware that any third party has accessed your login and password, follow the procedure provided in our Terms of Use. In the event of a security incident that results in destruction, loss, alteration, unauthorized access, or data leakage, BLOCKBR will communicate with you in a reasonable time and will adopt the competent measures for accountability of those involved and mitigation of damages, such as communication with investigative authorities, blocking access to the respective account, and all other measures that the specific case recommends.

11.1. This Privacy and Personal Data Protection Policy is governed, interpreted, and regulated by Brazilian law and should be read in conjunction with our Information Security Policy, as well as our Terms of Use and, where applicable, the respective contracts.

11.2. The Court of the District of São Paulo/SP is elected to settle any disputes that arise in relation to this Privacy and Personal Data Protection Policy.

11.3. Integral and inseparable parts of this Privacy and Personal Data Protection Policy, and considered incorporated by reference are:

Rates, Commissions, and Limits;

Terms of Use;

Information Security Policy

12.1. BLOCKBR commits to periodically revisiting this Privacy and Personal Data Protection Policy to ensure its compliance with the law, as well as to adjust to the guidelines of the National Data Protection Authority (ANPD), and may, for these reasons, modify its terms at any time. Whenever there is a significant change, such as a new purpose for the already informed personal data, you will be notified through the contact information provided by you or through a notice on the Platform. In the notification, you will have access to the new text of the Privacy and Personal Data Protection Policy.

13.1. If you have any questions and/or need to address any issue related to this Privacy and Personal Data Protection Policy, please contact us at suporte@blockbr.com.br. If you are one of our clients, always keep your contact channels updated, so we can contact you by email, preferably.