for customers

This Privacy Policy (“Policy”) states how your personal data is processed as a result of your use of the Services relating to the payment processing of purchases made by you on our clients’ websites. This document is an integral part of the EBANX Terms and Conditions, which contain an overview of the Services. By using our Services, you agree to our Policy and authorize us to process your personal data as described herein to provide our Services properly.

We share this policy by answering the following questions:

Who is EBANX?
What kind of personal data does EBANX collect?
How does EBANX collect personal data?
Why does EBANX collect personal data?
With whom can EBANX share personal data?
Can EBANX transfer personal data internationally?
For how long will personal data be stored?
What are the security standards adopted by EBANX regarding personal data?
What are your rights as a data subject?
What about cookies?
How to talk to EBANX about Privacy?
What happens if this Policy is changed? 

Who is EBANX?

EBANX is a payment processing company that provides local payment methods on international websites (“Merchants”).

For purchases made by you from Merchants that process payments with EBANX, we act as the processor of your personal data: we are responsible for processing the payment of purchases of services or products made by you from websites that offer you our payment methods.

In order to provide our Services, we process your personal data in accordance with the legitimate instructions of the website in which you purchased services or products using EBANX payment methods, in accordance with this Policy or in accordance with the applicable data protection legislation.

This Policy refers only to Services provided by EBANX. Products and services that you purchase from our Merchants are subject to their own terms of use and privacy policies, as determined by them. In addition, the payment methods you use may also be subject to the terms of use and privacy policies set by financial institutions and card issuers.

What kind of personal data does EBANX collect?

Some data that we use to be able to provide our Services to you may be considered personal data – meaning information related to you that, individually or in combination, may identify you. We may use the personal data stated herein for you to use and improve our Services:

Identity Data: includes information about your identity, such as your full name, identity number, date of birth, address, email, mother’s name, and phone number.

Financial Data: includes information about payment details, bank information, and information about the payment methods you use to purchase from our Merchants.

Technical Data: includes information about your IP address, access time and date, geolocation, data about your access device and cookies.

Usage Data: includes information about how you use our Service, such as profile and purchase behavior and transaction volume.

Biometric Data: includes information such as photos of your documents and personal photos.

We may also collect Aggregate Data, such as statistical or demographic data. They may be derived from your personal data, but they are not legally considered personal data since this data does not reveal your identity directly or indirectly.

Biometric Data is the only sensitive data from you that we may intend to process solely for the purpose of providing security to you and our Services. Don’t worry, you will be notified whenever we need this kind of data.

How Does EBANX collect personal data?

You may provide us Identity Data and Financial Data by using our payment processing Services. We may also collect personal data about you by contacting us through our communication and customer services channels. We may request Biometric Data for the sole purpose of fraud prevention and security threats and to confirm your identity.

When interacting with our Services, we may automatically collect data, such as Technical Data and Usage Data, through cookies, records in services, applications, software and similar technologies.

We may also receive your personal data through Merchants from which you purchase products or services through EBANX Payment Processing Services.

In addition, for your safety and to improve our Services, we may receive personal data about you from third parties and public sources, such as companies that introduce you to us, state agencies and service providers, including fraud prevention agencies.

Why does EBANX collect personal data?

Your personal data is used in accordance with the purposes presented below, with their respective legal bases, which authorize your processing:

We generally do not rely on consent as a legal basis for the processing of your personal data, except for sending direct marketing communications to you via email or text message. In such an event, you have the right to revoke your consent on your own communications received or by contacting us.

In other cases, if you refuse to provide personal data that we need by law or regulation, or because we have a contract with you, we may not be able to provide the Services properly.

We will only use your personal data for the purposes that we collect it, unless we consider that we need to use it for another reason and that reason is compatible with its original purpose. In addition, if we need to process your personal data for a new purpose not originally related, we will notify you by providing explanations about it.

We may process your personal data without human intervention to analyze transactions and consumption profiles, for behavioral analysis purposes and to prevent fraud and security threats. We can also do this to decide which marketing communications are adequate for you, analyze statistics, and assess risk. All of this is based on our legitimate interests: to protect our business and develop and improve our Services.

With whom can EBANX share personal data?

Because we offer a Service that involves payment transactions and financial transactions, we may work with other companies to provide them properly, which may involve sharing your personal data. They can be shared with companies such as: companies of the same economic group; payment processors; fraud prevention agents; tax identification number agencies; bulk sender mail platform; suppliers of card payment arrangements. We only share your data with companies that guarantee us compliance with industry security standards.

Your personal data may be shared with state agencies and regulatory agencies to comply with legal and regulatory obligations to which we must comply in all territories where we provide our Services.

In addition, we may share your personal data in order to protect our rights, clients’ rights or third parties’ rights, to protect their legitimate interests or of others, to enforce our terms of use or other agreements, and to pursue or exercise defense in legal claims.

We do not license, sell or transfer your personal data to anyone under any circumstances for the purpose of making a profit or contrary to this Policy.

Can EBANX transfer personal data internationally?

EBANX is headquartered in Brazil and your personal data is collected in accordance with Brazilian law. However, we may transfer your personal data internationally to provide our Services. Your personal data may be transferred to the United States if the company responsible for hosting information is located there.

Before transferring your personal data internationally, we will ensure that such transfer will occur in accordance with the high degree of protection required in this Policy. For this purpose, your personal data will only be transferred to parties located in countries or international organizations that legally have an adequate accordance with data protection or that comply with standard contractual clauses required by us.

By using the Services or providing personal data to EBANX you consent to the processing and transfer of such data to Brazil, United States of America, United Kingdom, Ireland, Netherlands, Denmark, Finland, Belgium, Germany, Japan, Canada, France, China and Singapore, if applicable, subject to the above conditions.

For how long will personal data be stored?

We keep your personal data only for the necessary period to fulfill the purposes for which we collect it, including for the purposes of complying with any legal, contractual, accountability or law enforcement obligations, subject to a minimum period of 5 (five) years starting from the date of the data collection, in compliance with the provisions of Article 11, of Circular No. 3,461, of July 24, 2009, as well as Article 195, caput and sole paragraph of the Brazilian National Tax Code.

To determine the appropriate retention period for personal data, we consider the quantity, nature and sensibility of the personal data, the potential risk of damage arising from unauthorized use or disclosure of your personal data, the purpose of processing your personal data and if we can achieve such purposes through other means. If certain data is no longer necessary for the purpose, it will be deleted or subject to anonymization.

If you request the exclusion of your personal data, we will delete it as soon as the above-mentioned legal maintenance period has elapsed, unless your maintenance is determined based on legal obligations or at the request of a competent authority.

What are the security standards adopted by EBANX about personal data?

We have established appropriate administrative and technical security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized manner, altered or disclosed. Furthermore, we authorize access to your personal data to employees, agents, contractors and other third parties within the limits necessary to perform their activities. They will process your personal data according to our instructions and will be subject to a duty of confidentiality.

We have established procedures to deal with any suspicious personal data breach and we will notify you and any applicable regulator of any breach, in the case that we are required to do so.

We are PCI-DSS certified, which means that our Services adhere to high standard security rules, utilizing encryption, access control, advanced monitoring, security updates, violation tests, and other procedures required by both regulation and our security payment processing partners.

Although we adopt strict safety standards, the transmission of information on the internet is not completely secure, and even though we do our best to protect your personal data, we cannot guarantee the security of your data transmitted online.

What are your rights as a data subject?

We summarize all your rights as a data subject that may be exercised by contacting us:

Right of access. You may request and receive a copy of your personal data that we hold. Also, you may request clarifications about how we obtain your personal data, what criteria we use, what are our processing purposes and with whom we share your personal data.

Right of rectification. You may request the rectification of personal data that is incomplete, inaccurate or outdated, through a validity check of the data you provide to us.

Right to anonymize, block or eliminate. You may request anonymization, block or deletion of personal data that you believe is being processed contrarily to this Policy or in violation of the applicable personal data protection legislation.

Right of opposition. You may oppose the processing of your personal data that is not executed based on your consent, if you understand that such processing is violating your rights. In such cases, we can demonstrate that we have legitimate reasons to process your personal data according to this Policy and to provide our Services properly.

Right of exclusion. You may request the deletion of your personal data stored by EBANX, processed with your consent, which is no longer necessary or relevant to the provision of the Services, as long as we have no any other reason to maintain it, such as to comply with a legal or regulatory data retention obligation or to safeguard EBANX rights.

Right not to provide consent. You may refuse personal data processing  based on your consent at any time. However, if you withdraw your consent, we may not be able to provide our Services properly, whose consequences we will explain to you.

Right of review. You may request the review of the decisions made solely based on automated processing if you believe they are affecting your interests.

Right of portability. You may request the portability of your personal data in a structured and interoperable format.

To submit your manifestations, you must provide an express request, on your behalf or through your legal representative, to the EBANX contact addresses described in the topic below. This requirement will not have any cost to you. However, we may charge you a fee if your request is clearly repetitive or excessive, or we may refuse to answer your request under these circumstances.

In order to exercise these rights, we may have to check your identity and the validity of your personal data. This is a security measure to ensure that personal data will not be disclosed to anyone who is not entitled to receive it. EBANX may also contact you for more information regarding your request.

Confirmation of data processing and access to your data will be provided immediately, in simplified form, or, through a detailed statement within 15 days. For further answers to your requests, EBANX will attempt to reply to you within 30 days. Occasionally, we may take longer if your request is particularly complex or if you have made multiple requests. In this case EBANX will notify you and keep you updated on the progress of your request.

What about cookies?

Cookies are small pieces of data that can temporarily store information about your browsing preferences. Cookies can be used for a variety of purposes such as storing information about your browsing preferences, collecting information to offer you personalized content, or even to redirect your browser to another part of our website when necessary.

The cookies that EBANX has set are called primary cookies. But there are also third-party cookies, which are those that are set by other partners and allow third-party features or functionalities to appear on our website (such as advertising, interactive content, and analytics). Those who set these third party cookies may recognize your computer both when you visit our website and when you visit their website.

We use several categories of cookies, each one with specific purposes. These are:

Required: Essential and necessary cookies for EBANX website to perform basic actions and to provide services on our website to you, such as registration page and mobile applications, and also for you to be able to use some features, such as accessing security areas within the website.

Analytics and Performance: Used to increase and improve the functionality of our website, registration services and mobile applications. Without these cookies some functionalities may be impaired.

Advertising Cookies: These cookies are used to make advertising messages more interesting to you. They prevent ads you have already seen from appearing again, ensure that ads are placed in locations that do not disturb your reading, and in some cases serve ads based directly on your interests.

Social Media Cookies: These cookies are used to allow you to share pages and content that you are interested in on our site on your social media. These cookies may also be used for advertising purposes.

You have the right to accept or decline cookies. You can set your browser to accept or decline cookies. If you choose to decline cookies, you can still access our site, but some functionalities and areas of our site may be restricted or limited. Because the ways to restrict cookies may vary according to the browser you are using, you should visit your browser's "help" page for more information.

For more information on cookie settings: http://www.aboutcookies.org/

Google Analytics Cookies

Internet Explorer™;

Safari™;

Chrome™;

Firefox™;

Opera™.

We have a technology called "clear gifs" (known as web beacons or web bugs), which helps us manage our site by identifying which content is effective. "Clear Gifs'' are small graphics with a unique identifier, similar to those found in cookies, that are used to track users' movements around the Internet. Unlike cookies, which are stored on the hard drive of users' computers, clear gifs are invisibly embedded in Web pages or in e-mail, and are as small as the period at the end of this sentence.

We use clear gifs or pixels so that we know which users have actually opened emails that we send to their inboxes. This helps us to be sure of the effectiveness of our communications and marketing actions. In doing so, we combine the information generated by clear gifs with the personal information of our customers.

How to talk to EBANX about privacy?

If you wish to exercise any of the rights under this Policy or the applicable law, or if you have questions, comments, or suggestions regarding this Policy, you may contact us at the following contact addresses:

Email: encarregadodedados@ebanx.com

Site: https://www.ebanx.com/br/ajuda

What happens if this policy is changed?

Any changes we made in this Policy will be posted on EBANX page and, when appropriate, you will be notified by email. Please check often to see any updates or changes.

EBANX | CNPJ: 13.236.697/0001-46

Rua Marechal Deodoro, 630 - Centro - CEP 80010-010 - Curitiba/PRWW