Privacy Policy

Version 1.0 · Effective October 15, 2026

This is a translation. In case of any discrepancy, the Portuguese version prevails.

On this page

To whom this Policy applies
Our role in each situation
Data we process
Why we process your data and on what legal basis
Automated decisions
With whom we share
International transfer
How long we keep it
Your rights
Data subjects outside Brazil
Security
Children and adolescents
Cookies
Data Protection Officer and contact
Changes

RGST TECNOLOGIA LTDA, registered under CNPJ No. 47.993.283/0001-83, which operates the SecurityPag platform ("SecurityPag"), processes personal data in order to process payments securely, comply with the law, and prevent fraud. This Policy explains what data we process, why, with whom we share it, how long we keep it, and how you exercise your rights. Questions: compliance@securitypag.com.

1. To whom this Policy applies

1.1. This Policy applies to: (a) Users who sell through the Platform, including Producers, Co-producers, Affiliates, and their representatives; (b) Buyers who pay through the Checkout or payment links; (c) students and members who access the Members Area; and (d) visitors to the website, the app, and our channels.

1.2. When you buy from a Seller that uses SecurityPag, that Seller also processes your data to deliver the product and provide support, in accordance with its own privacy policy. This Policy covers only the processing carried out by SecurityPag.

1.3. Capitalized terms have the meaning given in the Terms of Use.

2. Our role in each situation

Situation	SecurityPag's role	Seller's role
User registration and account	Controller	—
Payment processing, anti-fraud, AML/CFT, and disputes	Controller	Controller of the sale data for delivery and support
Members Area, sales recovery e-mails, remarketing, and integrations configured by the Seller	Processor, following the Seller's instructions	Controller
Pixels and trackers installed by the Seller on the Checkout	Provides the tool	Controller and responsible for consent
Corporate website, contact form, and SecurityPag marketing	Controller	—

3. Data we process

3.1. Users and their representatives

Category	Examples	Source
Identification and contact	Name, CPF or CNPJ, date of birth, address, e-mail, phone	You
Identity verification	Photo ID, selfie, liveness check, and derived facial biometric data	You and our verification provider
Corporate data	Articles of association, partners, directors, ultimate beneficial owners, status as a politically exposed person	You, Federal Revenue Service, and public databases
Financial data	Bank account, Pix keys, estimated revenue, Transactions, Balance, withdrawals, destination crypto-asset wallets	You and the Platform
Activity data	Products, sales pages, domains, ads, dispute ratios, and complaints	You, the Platform, and public sources
Usage and device data	IP, access date and time, device, browser, approximate geolocation, records of actions on the dashboard	Automatic collection
External lookups	Registration status, restrictions, sanctions lists, public lawsuits, adverse media	Public databases, credit bureaus, and anti-fraud providers
Communications	Customer support messages, recordings, and e-mails	You

3.2. Buyers and members

Category	Examples	Source
Identification and contact	Name, CPF or foreign document, e-mail, phone, delivery and billing address	You, on the Checkout
Payment data	Card (stored only in a PCI DSS-certified environment and converted to a token; the Seller sees only the card network and the last 4 digits), Pix Payer data provided by the Payer's institution	You and the payment institutions
Order data	Products, amounts, currency, installments, coupons, purchase and refund history	Platform
Anti-fraud data	IP, device identification, browsing and typing patterns on the Checkout, 3DS authentication result	Automatic collection and anti-fraud providers
Members Area	Access, course progress, comments, certificates	Platform
Communications	Support, refund, and dispute requests	You

3.3. Visitors and business contacts: name, company or brand, e-mail, WhatsApp, where you sell, revenue range, and message submitted through the form, plus cookies in accordance with the Cookie Policy.

3.4. We do not request data on health, religion, political opinion, or sexual orientation. The sensitive data we process is facial biometrics in identity verification.

4. Why we process your data and on what legal basis

Purpose	Legal basis (LGPD)
Create and maintain the Account, provide the contracted services, and charge fees	Performance of a contract (Art. 7, V)
Verify identity, know the customer and the ultimate beneficial owner	Compliance with a legal and regulatory obligation (Art. 7, II)
Use facial biometrics in verification and authentications	Fraud prevention and security of the data subject (Art. 11, II, "g") and legal obligation (Art. 11, II, "a")
Prevent money laundering and terrorist financing and comply with sanctions, including reports to COAF	Legal obligation (Art. 7, II)
Process payments, Splits, withdrawals, and Crypto Withdrawals	Performance of a contract (Art. 7, V) and regulatory obligation (Art. 7, II)
Analyze fraud risk in each Transaction and on the Account	Legitimate interest (Art. 7, IX), credit protection (Art. 7, X), and fraud prevention (Art. 11, II, "g")
Handle Chargebacks, refunds, MED, and complaints	Regular exercise of rights (Art. 7, VI) and regulatory obligation (Art. 7, II)
Provide information to the Federal Revenue Service, the Central Bank of Brazil, and other authorities	Legal obligation (Art. 7, II)
Respond to and support you	Performance of a contract (Art. 7, V) and legitimate interest (Art. 7, IX)
Send SecurityPag commercial communications to Users and contacts	Legitimate interest (Art. 7, IX), with an opt-out option, or consent when required (Art. 7, I)
Improve the Platform and produce statistics	Legitimate interest (Art. 7, IX), preferably with aggregated or anonymized data
Non-essential cookies and trackers	Consent (Art. 7, I)
Functions we operate for the Seller, such as Members Area and sales recovery	Legal basis defined by the Seller, as controller

4.1. When we rely on legitimate interest, we first assess whether the processing is necessary and whether it respects your expectations and rights. You may request information about this assessment through the Data Protection Officer (DPO) channel.

5. Automated decisions

5.1. We use automated systems to approve or refuse registrations, set limits, and assess the fraud risk of each Transaction. These systems consider, among other factors, device data, purchase history, consistency of information, and behavioral signals.

5.2. You may request a review of a decision made solely on the basis of automated processing and information about the criteria used, pursuant to Article 20 of the LGPD. For security reasons, we do not disclose details that would allow anti-fraud controls to be circumvented.

6. With whom we share

We do not sell personal data. We share only what is necessary for each purpose:

Recipient	Purpose
Partner Institutions, Acquirers, Card Networks, and card issuers	Authorize, settle, and dispute payments
Central Bank of Brazil, including the Pix system and the DICT	Execute Pix, MED, and regulatory obligations
COAF, Federal Revenue Service, Judiciary, Public Prosecutor's Office, police, Secretariat of Prizes and Bets, ANPD, Procons, and Senacon	Comply with law, order, or authority request
Seller of the purchase	Deliver the product and provide support: name, e-mail, phone, document, address, and items purchased. Never the full card number
Affiliates and Co-producers	Only the minimum sale data attributed to them, without payment data
Suppliers that operate on our behalf	Cloud, identity verification, anti-fraud, e-mail and SMS delivery, video hosting, customer support, and usage analytics, under contract and a duty of confidentiality
Credit bureaus, anti-fraud databases, and other financial system institutions	Verify registrations and share fraud indicators, pursuant to Joint Resolution No. 6/2023
International acquirers and virtual asset service providers	Execute international sales and Crypto Withdrawals, including the identification required for virtual asset transfers
Advisors, auditors, and potential acquirers in a corporate transaction	Audits and reorganizations, under confidentiality

7. International transfer

7.1. Some suppliers, such as cloud providers, and some institutions involved in international sales are located outside Brazil. For these transfers we use the mechanisms of Article 33 of the LGPD, such as the standard contractual clauses of CD/ANPD Resolution No. 19/2024 and adequacy decisions.

7.2. Data of data subjects protected by the GDPR transferred to Brazil is covered by the European Commission's standard contractual clauses or by another valid mechanism.

8. How long we keep it

Data	Period	Basis
Registration, identity verification, and Transaction records	At least 10 years after the end of the relationship or of the Transaction	Central Bank of Brazil AML/CFT regulations
Access logs for the website, dashboard, and app	At least 6 months	Article 15 of the Brazilian Internet Civil Framework (Marco Civil da Internet)
Tax documents and information	5 years, or longer while an audit is pending	Tax legislation
Evidence of disputes and complaints	Until the end of the Card Networks' dispute periods and the applicable limitation period	Regular exercise of rights
Customer support recordings and messages	At least 90 days, or longer if related to a dispute	Consumer service rules
Biometric template used in authentications	Until the Account is closed	Necessity; the image of the document and the selfie follow the registration period
Marketing data	Until opt-out or withdrawal of consent	Consent or legitimate interest
Cookies	In accordance with the Cookie Policy	Consent or technical necessity

Once the periods end, we delete or anonymize the data.

9. Your rights

9.1. You may request: confirmation that we process your data; access; correction; anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance; portability; deletion of data processed with consent; information on with whom we share; information on the possibility of not giving consent; withdrawal of consent; objection to unlawful processing; and review of automated decisions (Articles 18 and 20 of the LGPD).

9.2. Submit the request by e-mail at compliance@securitypag.com or through the channels indicated at https://securitypag.com. We may request identity confirmation to protect you. We respond within 15 days.

9.3. Some requests have legal limits. We cannot delete data that the law requires us to keep, such as AML/CFT records, nor state whether a report was made to COAF.

9.4. If the request involves data processed by a Seller, such as its delivery or marketing data, we will forward it to the Seller and notify you.

9.5. You may also petition the National Data Protection Authority (ANPD).

10. Data subjects outside Brazil

10.1. SecurityPag has no establishment or representative in the European Union and does not operate directly outside Brazil: it processes international payments through Acquirers that permit such processing. If you are in the European Union, the European Economic Area, or the United Kingdom and your data is processed in a purchase, you may exercise the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent through the channel in section 9, in addition to lodging a complaint with the data protection authority of your country.

10.2. Data subjects in other countries, such as Argentina, Mexico, Chile, Colombia, the United States, and Canada, may exercise the rights provided by local laws through the same channels in section 9.

11. Security

We protect data with encryption in transit and at rest, card tokenization in a PCI DSS-certified environment, need-based access control, two-factor authentication, and continuous monitoring. No system is entirely immune to incidents. If an incident occurs that may create a relevant risk or harm, we will notify the ANPD and the affected data subjects within the legal deadlines. Details are in the Information Security Policy.

12. Children and adolescents

The Platform is not intended for persons under 18 as Users. Purchases by minors must be made or authorized by their guardians. A Seller whose product is intended for children or adolescents must comply with Article 14 of the LGPD and the legislation on the protection of children and adolescents in digital environments.

13. Cookies

We use cookies and similar technologies in accordance with the Cookie Policy, which explains how to manage your preferences.

14. Data Protection Officer and contact

Data Protection Officer (DPO): SecurityPag Compliance Department, e-mail compliance@securitypag.com, address Av. Paulista, 302, Conj. 10, Bela Vista, São Paulo/SP, CEP 01310-000.

15. Changes

We may update this Policy. Relevant changes are notified by e-mail or on the Platform before they take effect. Previous versions remain available in the Legal Center.