Privacy Policy

Information Classification:

Public
Internal
Restricted
☐Confidential

1. OBJECTIVE

This policy aims to present, in a clear and accessible way, how Dock Ltd., its subsidiaries, affiliates and associated companies process personal data, including access, storage, sharing, processing, use and deletion, ensuring full compliance with applicable legislation, in particular the General Personal Data Protection Law (LGPD), and alignment with international information security and privacy standards.

Our commitment is supported by the Information Security and Privacy Management System (SGSIP), implemented in accordance with ABNT NBR ISO/IEC 27001 and ABNT NBR ISO/IEC 27701 standards, ensuring the protection of your personal data, the preservation of your privacy and the safe continuity of the services provided.

2. SCOPE

This policy applies to the processing of personal data carried out by Dock. and its subsidiaries, affiliates and associated companies, hereinafter referred to only as “Dock”. This policy is applicable and must be complied with, mandatorily, by all employees of Dock, as well as third parties and related service providers.

3. STANDARDS AND CERTIFICATIONS

☒ BACEN
☐ PCI
☐ SOX
☒ ISO 27.001
☒ ISO 27.701
☐ ISAE 3402
☐ NONE OF THE RULES

4. REFERENCE DOCUMENT

Federal Law No. 12.965 of April 23, 2014 (Civil Rights Framework for the Internet);
Federal Law No. 13.709 of August 14, 2018 (General Personal Data Protection Law)

5. GENERAL PROVISIONS

Employees involved in this process are aware that the guidelines defined in this document may be audited. Therefore, it is recommended not to save copies of these regulations to the desktop/network folders or print them. Employees should always access the Confluence tool.

6. GUIDELINES

The policy applies to the relationship that You, (data subject – natural person to whom the personal data that are the object or may be the object of processing refer) maintains with the  Dock.

Please read this document carefully to understand the guidelines and practices regarding personal data and how the processing is carried out by Dock.

This policy includes our online and offline data collection and processing activities, covering personal data that Dock collection through various channels, including – but not limited to:

• websites;
• aplicativos
• third party social networks;
• customer service;
• points of sale;
• research; and
• event-based apps

A Dock may aggregate personal data combined from different sources (e.g. our website and offline events) or from our partners and customers.

In some specific cases, if You decide not to provide such information indicated as necessary (the Dock will indicate when this is the case, for example by explicitly placing this information on our registration forms), we may not be able to provide the products/services in full.

Main definitions: To make things easier, we've put together a summary of some terms you might find here:

• Personal Information: Information that allows you to be identified in some way: name, date of birth, document numbers, etc., in this document we refer to them as data.
• Sensitive Personal Data: those relating to racial or ethnic origin, religious belief, political opinion, membership of a trade union or organization of a religious, philosophical or political nature, data relating to health or sexual life, genetic or biometric data, when linked to an individual.
• Biometric Data (Biometrics):  Technology that enables statistical analysis of each person's physical and behavioral characteristics. Biometric data is unique to each individual and, therefore, provides greater assertiveness and security for identity validation and authentication.
• General Personal Data Protection Law (LGPD) – Federal Law No. 13.709/2018: Brazilian legislation that establishes rules on the collection, storage, processing and sharing of personal data, guaranteeing rights to data subjects and duties to data processing agents.
• Ley Federal de Protección de Datos Personales en Posesión de los Particulares
  (LFPDPPP) de México:Es una ley mexicana que regula la protección de los datos personales en
  posesión de particulares. Su objetivo principal es garantizar que los datos personales sean tratados de forma
  legítima, controlada e informada, protegiendo la privacidad y el derecho a la autodeterminación informativa de
  las personas.
• Marcas de aceptación:Visa o Mastercard, indistintamente, así como sus filiales y subsidiarias. Estas marcas actúan como socios (partners) de Dock como Emisor de Tarjetas, habilitando la aceptación y procesamiento de transacciones en los establecimientos afiliados a sus respectivas redes a nivel nacional e internacional.
• Partner(s):entidad que actúa como socio estratégico de Dock para brindar ciertos productos o servicios bajo su marca, estándares y reglas. En este sentido, el Partner habilita y faculta a Dock para el uso, comercialización y adaptación de sus productos y servicios para brindar niveles de servicio de Dock a sus Clientes, Usuarios y Tarjetahabientes, y Dock deberá garantizar el cumplimiento de las políticas y requisitos establecidos por estos.
• Treatment: Any operation/action performed with personal data, such as collection, use, storage, sharing and deletion.
• Legal representative: An individual or legal entity authorized to act on behalf of another, whether to make strategic decisions or represent an individual before regulatory bodies.

Table of Contents

• What data is collected?
• For what purpose is the data used?
• How do we record your activities?
• Sharing and disclosure of Data?
• Treatment Agents
• Data Storage, Retention and Deletion
• Your rights, choices and controls
• international transfer
• Internet security
• 10. Changes to this policy
• Contact us

 

1. What data is collected?

During the interaction with the Dock, as Data Controller, under the terms presented in this policy, using one of the collection sources previously described, various types of personal data may be collected, as explainedpostthe following.

 

1.1 Identification Data: 

Any type of information that may facilitate our contact with you You, including:

• Full name;
• CPF/RNE/Passport;
• Date of birth;
• Age or age range;
• Nationality;
• Marital status;
• Gender;
• Telephone contact;
• Physical address for correspondence and e-mail;
• Mother's name; and
• Websites and social media profiles.

1.2 Login Data:

Information to identify and authenticate yourself in services provided by Dock, including:

• Registration name (login);
• Password in unrecoverable (encrypted) format; and
• Security questions;

1.3 Demographic and financial data

Any information that may describe your demographic, financial, habits or behavioral characteristics, including:

• Geographic location;
• Banking information (Bank, Branch, Current account, Savings account),
• Credit card details (number, expiration date, security code),
• Transaction history, income, credit history.

1.4 Interest and behavioral data 

• Favorite products;
• Interactions with Applications and platforms;
• Other interests and information about your family or lifestyle.
• Hobbies and pastimes;

1.5 Navigation/location data:

Details about your computer or other portable device that was used to access one of our websites, services or applications, including:

• Record of the IP address used to connect your computer or device to the internet;
• Geographical location; and
• Operating system and browser type and version website.
• Call logs and names of users' contacts on your phone;
• Sending and receiving text messages

Se You access a website or application Dock using a mobile device such as a smartphone or tablet, the information collected will also include, where necessary:

• Your phone's unique device ID; and
• The geographic location and other similar data from the mobile device.

1.6 Data about the use of our websites and services: 

During interaction with our websites and services, Dock will use automatic data collection technologies to capture information about your actions. This may include:

• Details such as which links were accessed;
• Which pages or content You views and for how long; and
• Other similar information and statistics about your interactions, such as response timespostaa content, download errors and duration of visits to certain pages.

This information is captured through automated technologies such as Cookies (Cookies of browser, Flash cookies and similar) and web beacons, and via third-party tracking.

1.7 Market research and consumer feedback:

This is information that “You" voluntarily shares about your experience using products and services from Dock. This information is used to improve our products and services.

1.8 Content generated by personal data holders:

Content that You creates and shares with the Dock on third party social networks or by uploading to one of our websites, applications and other online and offline services, including the use of third party social networking applications such as Facebook, Instagram, LinkedIn and similar. This data includes:

• Texts;
• Comments;
• Articles;
• Photos;
• Videos; and
• Personal stories or other similar content and media.

Whenever permitted by law and your rights are protected, Dock collects and publishes content generated by holders in connection with a variety of activities, including promotion of products and services of Dock, contests, giveaways and other promotions, website community features, owner engagement and third party social networks.

1.9 Contacting our Customer Service:

Your interactions with our Customer Service may be recorded, in accordance with applicable laws, for legal requirements and to meet the operational needs of the Dock, both as Operator and Controller. Financial and payment details are not recorded. When required by law, You You will be informed about such recording at the beginning of your call.

1.10 Biometric Data:

Biometric data is information that refers to the unique physical, physiological or behavioral characteristics of an individual and, in the context of its relationship with the Dock, are collected to carry out identity validation and proof of life, as part of the account opening process and transaction security.

1.11 Personal data of children and adolescents:

A Dock will collect and process personal data of minors exclusively for the execution of its services, in compliance with legal provisions, and, with the explicit consent of their parents or legal guardian, ensuring that this processing is done in a safe and transparent manner, in accordance with the requirements of the General Personal Data Protection Law (LGPD)

If we discover any unintentional processing of this type of personal data, we will immediately remove the personal data of that child or adolescent from our records after officially becoming aware of the fact.

For all purposes, according to the Statute of Children and Adolescents, children are considered to be persons up to 12 years of age, and adolescents are those between twelve and eighteen years of age.

1.11.1 Consent of Legal Guardians

Data from minors will only be collected with the express consent of their legal guardian. This consent will be obtained using methods capable of verifying the legal guardian's identity.

The legal guardian's consent is required for the processing of a minor's data. This consent may be revoked at any time, and revocation may impact the continuity of the service.

1.11.2 Types of Data Collected

The collection of data from minors will be limited to the minimum necessary for the provision of our services and may include identification documents containing: name, date of birth, CPF, and, to the extent permitted by law, other data necessary for the adequate provision of our services.

1.11.3 Use and Purpose of Data

The data of children and adolescents collected will be used exclusively for the purposes informed at the time of collection or as authorized by legal guardians. We do not share this data with third parties not authorized by Dock, except when required by law or with the explicit consent of legal guardians.

1.11.4 Data Security

A DOCK adopts specific and explicit measures in this policy that guarantee the protection of children and adolescents' personal data against unauthorized access, misuse, disclosure and/or alteration.

 1.11.5 Rights of Legal Guardians

Parents or legal guardians will have access to detailed information about data processing and may exercise their rights to access, rectify, delete and/or revoke consent to the child and adolescent's personal data.

 

2. For what purpose is the data used?

Now that you understand what data we collect, let's explain how we use each piece of data:

Note: We may analyze the aforementioned data to ensure the security of operations and the suitability of the services offered, including verifying data necessary for strategic decision-making and granting benefits. These activities may involve legitimate external sources and follow legal regulatory standards, always respecting the rights of data subjects and the principles of transparency and data minimization.

 

3. How do we record your activities?

To collect browsing data, we rely on the help of some monitoring technologies. Among them:

3.1 Ccookies, log files (logs) and similar:

Or what are Cookies? These are small text files that can be placed on your computer or portable device by websites or services on the Web that You uses. They are used to ensure the proper functioning of websites and other online services, as well as to provide information to the owners of the website or online service.

Os Cookies facilitate the process of adapting websites Dock to your personal needs, assisting, whenever possible, its use and receiving feedback on visitor satisfaction.

A Dock you can use the following types of Cookies on its compatible websites and services:

1. Cookies session: They are Cookies for temporary use, which are deleted when You” closes your browser. When You restart your browser and return to the site you used the cookie, this site deals with You as a new visitor.
2. Cookies persistent: They are those Cookies that remain in your browser until You delete them manually or until your browser deletes them according to the duration period established by cookie. Those Cookies will recognize your return as a visitor to a website or service of Dock.
3. Cookies needed: They are Cookies strictly necessary for the operation of a compatible website or service of Dock. They allow You browse the site and use our resources.
4. Cookies who send us information about you: A Dock inserts this type of Cookies on a compatible website or service of Dock and this kind of Cookie can only be read by our compatible websites and services.
5. Cookies in advertisements for Dock: We put Cookies in advertisements and ads that appear on compatible third-party websites and services. We obtain information through these Cookies when You clicks or interacts with the advertisement or announcement. We may use this data obtained by Cookies from third parties to send you other advertisements thatcreditwe may be relevant or of interest to you based on your past behavior.
6. Cookies who share your information with third parties: They are Cookies placed on a website Dock by our partner companies, such as online advertising services. They may use the data collected by these Cookies to anonymously send you targeted advertisements on other websites based on your visit to compatible websites or services of Dock. Compatible websites and services of Dock may also use other tracking technologies similar to Cookies, which are capable of collecting information such as IP addresses, log files, and web beacons. website, among others. This data is also used to help us adapt the websites and other compatible services of Dock to your personal needs.

Most browsers allow “You” set rules to warn them before accepting Cookies or simply refuse them.”You" no need to have Cookies enabled to use or browse most of the websites and online services of Dock, however, in this case we cannot guarantee that “You" will be able to access all available resources. We recommend that “You" See the “help” button on your browser to learn how to perform this type of configuration.

Remember that if “You" using different browsers, or even different computers and/or portable devices in different locations,You" you will need to ensure that each device and browser is adjusted to your personal preferences. Cookies.

We understand that “You" You can change your mind at any time. Therefore, you have the right to change your decision regarding accepting cookies at any time. If, for any reason, you decide to change your cookie settings, we will provide you with clear and accessible options so that you can “You" do this.

As our flags of the web (web beacons) can be part of a page of website, it is not possible to delete this type of resource, but You can make it completely non-functional by enabling the feature “opt-out” for Cookies placed by this flag.

3.2 IP addresses

An IP address is a number used on the internet or a network to identify your computer. Every time You When you connect to the internet, your computer receives an IP address assigned by your internet service provider. We may log IP addresses for the following purposes:

1. Handling technical problems;
2. Maintaining the protection and security of our websites and other online services;
3. Gain a better understanding of how our websites and other online services are used; or
4. Adapt our content to your needs, depending on your geographic location.

3.4 Log Files

A Dock or a third party working on our behalf may collect information in the form of log files that detail website activity and gather statistics about users' browsing habits. These logs are typically generated anonymously and help us understand details such as:

1. The type of browser and operating system used by users of our websites or online services;
2. Details about your user session, including the referring URL, date, time and which pages you visited on our websites and supported services and how long you spent on them; and
3. Other navigational or click count details, including site traffic reports, unique visitor counts, and similar data.

3.5 Flags of the web (web beacons)

A Dock you can use the flags of website ( GIFs transparent) on the websites or electronic communications of Dock. The flags of the website (also known as webbugs ou website beacons) are small sequences of code that allow the delivery of a graphic image on a web page. website with the aim of transferring data back to the Dock.

We use the information from the flags of the website for a wide variety of purposes, including:

1. Understand how a user responds to email campaigns;
2. Traffic reports for our websites and compatible services; and
3. Perform unique visitor counting, advertising and email auditing and reporting, and personalization on our websites and other compatible services.

 

4. Sharing and Disclosure of Data

In addition to the entities that are part of the Dock, we may share your personal data with the following types of third party organizations:

• a) Service providers: Include external companies that are used by Dock to assist or facilitate the operation of our business. Service providers and their selected employees are only authorized to access your personal data on behalf of Dock and third parties for specific tasks that are requested of them based on our direct instructions. Our service providers are contractually obliged to keep your personal data confidential and secure and, in cases of breach, are liable in accordance with applicable law.
• b) Credit analysis, debt collection and financial services agencies: A Dock may, in accordance with the requirements of applicable laws and regulations, use credit analysis and/or debt collection agencies to facilitate its operation by carrying out analyses of your personal profile to provide greater security to operations and avoid possible fraudeg.
• c) Third-party companies that use personal data for their own marketing purposes: Except in situations where You gave their specific consent, to Dock does not license or sell your personal data to third parties for their own marketing purposes. In such cases, the identity of these third parties will be disclosed before obtaining your consent to share the data.
• d) Third parties who use your personal data for legal reasons or sharing with companies in the same economic group due to merger/acquisition: We may share your personal data with companies that become part of the same economic group as Dock. In addition, we may also, if we have legal or regulatory obligations, share your personal data with third parties or regulators, to the extent required in accordance with applicable regulations. In such cases, we will take reasonable care to ensure that the organization to which we transfer your data uses it in a manner that is consistent with this Privacy Policy and in compliance with applicable data protection legislation.
• e) Companies in the same economic group, partners and suppliers: Eventually, your data may be shared with partners, suppliers, and companies in the same economic sector to offer products and/or services that best meet your interests.
• f) Flags and issuers: We will share your data with companies that process card transactions in order to guarantee the provision of Services when necessary.
• g) Data interoperability will be ensured through the establishment of security standards and protocols for sharing information between systems and devices, where the parties involved in sharing personal data are aware of the security and privacy implications involved.
• h) Authorities, regulatory bodies, or government entities: We will share your personal data when necessary to comply with a legal or regulatory obligation, an order from a competent authority, or when necessary to protect your rights, our rights or the rights of third parties.
• i) Consent: By using our products and services, you may consent to the sharing of your personal data, aiming for a better user experience. Likewise, it is important to emphasize that consent is mandatory due to regulatory requirements. If you choose not to provide consent for data processing, you have the right to refuse. However, it is important to be aware that this refusal may result in the inability to access certain services, as data processing is essential for the provision of some of these services.
• j) Automated decision: To ensure the correct handling of personal and sensitive personal data, as well as for legal and regulatory compliance purposes, there are automated data processing procedures that inhibit misuse and fraudof your data, and also allow the best experience in using our products and services. When "You" If you do not agree with any of these decisions, you can contact us through the DPO box and the Privacy Portal.
• k) Digital Wallet: As a product and service, the digital wallet may contain personal information to provide a personalized and efficient experience, allowing the data subject to securely store information. We use your transaction information to process payments, transfers, and other operations related to your digital wallet. We analyze aggregated data to improve functionality and security.

We do not share your digital wallet information with third parties except in the following cases: with your consent and/or legal requirements.

1. l) Open Finance

A Dock is committed to offering its users the ability to connect their accounts with other legitimate financial institutions through Open Finance. This functionality allows you to have a more complete view of your finances in one place, in addition to enabling you to carry out various financial transactions more conveniently and securely.

Consent

By authorizing the connection of your accounts through Open Finance, you grant your express, free, informed and unequivocal consent for the Dock access, store, and use the financial information linked to these accounts, respecting the principles of the General Data Protection Law (LGPD – Law No. 13.709/2018) and the regulations of the Central Bank of Brazil. This consent is essential for the provision of Open Finance services and may be revoked at any time.

Revocation of Consent

You have the right to revoke the consent granted at any time. To do so, simply access your account on Dock and follow the steps indicated to unlink the connected accounts. Upon revoking your consent, access to your financial information will be immediately terminated, and we will no longer perform any transactions on your behalf.

Processing of Personal Data

The information collected at Open Finance will be used exclusively for:

1. Aggregation of financial data, allowing a consolidated view of your accounts and transactions;
2. Making payments and transfers, always upon prior request;
3. Credit analysis and offering of customized financial products, within regulatory limits;
4. Improving the services provided and developing new financial solutions.

A Dock We will not use your data specifically for any of the purposes listed here without obtaining a new subscription.

Data Sharing in Open Finance

The data accessed through Open Finance may be shared exclusively with:

1. Institutions participating in Open Finance authorized by the Central Bank of Brazil;
2. Strategic partners and discussed contracted services to enable the Open Finance experience, always under contractual security and privacy obligations;
3. Regulatory authorities and oversight bodies , when required by law.

Dock does not sell or share your financial data with third parties for advertising purposes .

• m) Credit Score

A Dock, in its quest to offer increasingly personalized and efficient financial services, may use information related to your credit score. A credit score reflects your financial history and is used by financial institutions to assess your likelihood of meeting your financial commitments.

How we use credit scores:

Offer personalizationBy knowing your credit score, we can offer financial products and services that are better suited to your profile, such as personalized credit limits and competitive interest rates.

Risk analysis: The credit score helps us assess risks, allowing us to make safer and more transparent decisions regarding credit granting.

Credit score data source:

The data used to calculate your credit score is obtained from authorized credit bureaus. This information includes your payment history, inquiries about your CPF (Brazilian taxpayer ID), outstanding debts, and other relevant information.

Data processing:

Your credit score data is treated with the same confidentiality and security as other personal data. We use advanced security measures to protect this information from unauthorized access.

Please note that all third parties with whom we interact undergo a detailed assessment, in accordance with the applicable policies and procedures of Dock, with the aim of ensuring adequate protection of any personal data that may be shared.

 

• n) Credit Bureaus

A Dock, committed to providing safer financial services tailored to the needs of its customers, may use information from authorized credit bureaus. These bureaus collect and analyze financial data to assist institutions in assessing individuals' creditworthiness.

How we use credit bureau data:

1. Credit analysis and granting: The information obtained allows us to assess risks and make more assertive decisions when granting credit.
2. Service customization: Based on this data, we can offer financial conditions that best suit your profile, including personalized limits and competitive rates.
3. Risk management: The analysis of this data contributes to the mitigation of fraudand protection against default, ensuring greater security for everyone involved.

Origin and processing of data:

The data used is obtained exclusively from duly authorized credit bureaus and may include payment history, inquiries made, active debts and other information relevant to credit analysis.

A Dock adopts strict security controls to guarantee the confidentiality and integrity of this information, ensuring that the data is treated in accordance with current legislation and privacy protection principles.

All third parties with whom we interact undergo a thorough evaluation, following internal policies and procedures, in order to ensure adequate protection of any personal data that may be shared.

 

5. Treatment Agents

Data processing agents are the Controller, Singular Controller and the Operator Data, which process your personal data, and are responsible for such processing to the supervisory authorities.

Na Dock, as a processing agent we act in two ways:

1. Single Controller  – Makes decisions regarding data processing and defines the purpose of the processing. Furthermore, it has specific obligations, such as preparing a personal data protection impact report, proving consent was obtained in compliance with all legal requirements, reporting privacy incidents to the ANPD, and repairing damages resulting from unlawful acts.
2. Operator – You may only process data in accordance with the instructions of the Controller, respecting the purpose previously established contractually. The operator's obligations are basically: follow the instructions of the Controller; according to the contract signed with the Controlledr delimiting the regime of activities and responsibilities; provide notice in the case of hiring Sub-operators (companies/suppliers that will assist the operator in the processing of personal data, following its guidelines, and responding jointly to the Operator, as the case may be). The Operator is also jointly liable, as the case may be and in accordance with existing regulations, for regulatory inspections or damages caused by non-compliance with legal obligations or instructions from the controller.

In turn, the Dock, in relation to You, can act as Operator or how Controller, in the form of Single Controller (in which two or more processing agents make decisions about the processing, acting as Controllers, independently).

5.1 Dock as Operator: 

A Dock offers services that may involve the processing of personal data on behalf of third-party contractors. In such cases, the third-party contractors are considered Controladores, Ea Dock, Operator. The Controladores determine why and how personal data is processed. Therefore, this information will be described in the specific policies of those companies and “You" You should access them and, if you have any questions about the processing of your personal data, you should contact them directly. Controladores responsible.

A Dockas the Operator, will respect the current Data Protection legislation and the rules presented contractually by Controller. If Dock receive any request from a data subject relating to situations in which it processes personal data such as Operator, you should direct the request to Controller responsible or guide the data subject himself about who is the ControllerException: Performance of Dock as Singular Controller

Exceptionally, in cases of compliance with new mandates or regulatory requirements from regulatory bodies, the Dock It may act as a sole Controller to comply with such requirements. In these circumstances, the Dock will take all necessary measures to ensure that data processing is limited to what is strictly necessary to comply with regulatory requirements, and that data will be processed based on legal or regulatory obligation and will respect the guidelines established by law.

5.2 Dock as Singular Controller: 

These are examples of purposes for which the Dock acts as Single Controller:

1. Provision of services to the holder;
2. Carrying out contests, promotions and other marketing actions;
3. Access through social networks and third-party websites;
4. Personalization (offline and online);
5. Attendance;
6. Legal reasons or merger/acquisition; and
7. Recruitment and selection.

 

• 6. Storage, Retention, Deletion and Anonymization of Data

According to current legislation, the Dock will use your personal data for as long as necessary to achieve the purposes for which your personal data was collected, to comply with applicable legal requirements or the Controller's determinations, for cases in which the Dock act as a Data Operator.

Personal Data used to provide a personalized experience to “You"They will be kept exclusively for the time permitted, in accordance with current legislation."

You can obtain further details about the retention of your personal data through the communication channels detailed in item 11 of this policy.

When the processing of your personal data is completed, it will be eliminated within the scope and technical limits of the activities, with conservation authorized in the situations provided for in current legislation, including, but not limited to, the LGPD.

Through the anonymization process, we remove or alter personal data in such a way as to make it irreversibly anonymous, so that it is no longer possible to identify or associate this data with "You", even with the combination of other available information.

Our data anonymization practices include cryptographic techniques, data substitution, aggregation, and generalization. We have implemented appropriate technical and organizational controls to ensure the effectiveness of these processes and to prevent any attempts to re-identify the data.

 6.1 – Temporary files
The organization adopts a 100% cloud-based environment, with centralized storage on a corporate online drive. To ensure information security and resource optimization, all temporary files deleted on devices will be automatically and irreversibly deleted after 30 (thirty) days.

7. Your rights, choices and controls

Do you know your rights and guarantees regarding your data? To ensure transparency in our relationship, we've detailed each of your rights below.

Oh, it's important to mention: the way your rights are met varies depending on your position. Operator or Controller of Dock. 

7.1 Service Dock as Data Operator:

In cases where the Dock process your personal data on behalf of third parties, acting as Operator, requests made by you as Data Subject will be forwarded to the Responsible controllers, which determine the purposes and means of processing personal data.

Therefore, we recommend that you address your requests directly to the Data Controller. However, if you submit a request to us to exercise your rights in a situation where the Dock be Operator, whenever possible:

1. We will forward your request to the responsible Controller or
2. We advise you to contact him directly so that you can fully exercise your rights.

7.2 Service Dock as Data Controller:

When the Dock act as Data Controller of your personal data, we will respond promptly to your requests, respecting the terms of the law. "You"You, as the Data Subject, have the following rights regarding your personal data, under the terms of the LPDP (Portuguese Data Protection Law):

1. Obtain confirmation that we process your Personal Data;
2. Access your Personal Data that is processed by us;
3. Request the correction of Personal Data that is incomplete, inaccurate or outdated;
4. Request the anonymization, blocking or deletion of unnecessary, excessive Personal Data or data processed in non-compliance with the provisions of thispostor in the LGPD;
5. Request the portability of your Personal Data to another service or product provider, observing our commercial and industrial secrets;
6. Request the deletion of Personal Data processed based on your consent, except in the cases of conservation of Personal Data provided for in the LGPD;
7. Request information about the sharing of your Personal Data;
8. Request information about the possibility of not providing your consent for data processing and the consequences of this;
9. Revoke your consent for the Processing of your Personal Data, in the event that there is Processing carried out based on your consent;
10. Express opposition to Treatment that violates the dispostor in the LGPD.

Before we respond to any request based on the above rights, we need you to understand that Dock will need, to service the dispostor in the LGPD, request information that confirms your identity.

It is important to remember that these rights are not absolute and may not apply in some circumstances. In certain cases, we may continue to process and retain data regardless of your request for deletion, objection, blocking, or anonymization, in order to comply with legal, contractual, and regulatory obligations, safeguard and exercise rights, including in judicial, administrative, and arbitration proceedings, and in other cases provided for by law.

These rights may be exercised through the communication channels provided for in item 11 of this policy.

 

8. International transfer 

A Dock may transfer your personal data to other countries in the course of providing our services. These transfers may occur to:

1. International partners and service providers, including payment processors, technology companies and approved cloud service providers, essential for the execution and improvement of the services offered.
2. Regulatory bodies and competent authorities in other jurisdictions, as required by applicable laws and regulations.
3. Storage Contingency and Replication from our operations to the US since our environment is cloud-based.

For all international transfers, we adopt strict measures to ensure data protection and privacy, in compliance with the General Personal Data Protection Law (LGPD).

 

9. Internet security

Reinforcing that your privacy is very important to us, A Dock takes all necessary precautions to protect your personal data, but it is worth remembering that data transmission over the internet is not totalmente secure due to several factors, such as network, operation, unauthorized access or use, hardware failure, among others.

We cannot guarantee the security of the network you use to access our platform. Therefore, by agreeing to this policy, you assume responsibility for the transmission of your data and undertake to use only reliable connections to log in to Dock.

Once the data reaches us, we are committed to the security of your information. We have implemented physical, electronic and administrative procedures to prevent unauthorized access or disclosure of your Data, maintaining its security.

9.1 Controlled and Conscious Use of Artificial Intelligence
A Dock is committed to using Artificial Intelligence (AI) technologies in a controlled and conscious manner, aiming to protect privacy and personal data. We guarantee that only the strictly necessary data will be processed, always with transparency and in compliance with current legislation. Security measures are adopted to prevent incidents and minimize risks, ensuring that the use of AI is carried out in an ethical and responsible manner, without compromising the integrity of personal data.

 

10. Changes to this policy

Whenever the Dock If you decide to change the way we treat your personal data, this Policy will be updated. We reserve the right to make changes to our practices and this Policy at any time, as long as we maintain compliance with current legislation.

We recommend that you access it frequently, or whenever you have questions, to learn about any updates or changes made to our Privacy Policy, and that you only continue to use our products and services if you continue to agree with the content of this Policy.

 

11. Data Manager and customer service channel

To contact us, please visit Privacy Portal and use the channel Contact Dock: https://privacidade.dock.tech/.

In the absence of the appointed Data Controller, Thiago Cunha, his replacement Marcelo Lima, duly appointed, will assume his responsibilities.

A Dock will analyze and respond to all requests and complaints related to the processing of personal data, always in accordance with the requirements and deadlines established by current legislation.

 

12. REVISION CONTROL

Revision No.	Review Description	Reviewer	Managing director
1	Creation	Marcelo Lima	-
2	Update – Consolidation of External Privacy and Data Protection Policies, considering Conductor, Dock and BPP	Marcelo Lima	-
3	Inclusion of the topics foreseen in ISO 27701 and updates regarding Data Processing Agents, according to the updated Guidance Guide for Data Processing Agents from the ANPD (Brazilian National Data Protection Authority).	Marina Araujo	-
4	Inclusion of personal data of children and adolescents. Biometric data for onboarding processes, credit bureau checks, sharing with partners and suppliers for the provision of offers, products and/or services, updating the DPO's email address, data anonymization, change of mind regarding cookie acceptance, interoperability.	Taigor Vicari	-
5	Digital Wallet Inclusion	Taigor Vicari	-
6	Inclusion on Credit Score, Open Finance, detailing of personal data (PII) and use of AI in Dock	Taigor Vicari Jessica Albuquerque	Marcelo Lima
7	Review and adaptation regarding) I) Information regarding personal data of children and adolescents, II) credit score and credit bureau, III) Exception: Performance of Dock as a Single Controller, IV) international transfer and V) conscious use of AI	Taigor Vicari Jessica Albuquerque	Marcelo Lima
8	Entering information for the substitute Data Controller	Taigor Vicari Jessica Albuquerque	Marcelo Lima
9	Update on contingency and storage replication in item 8; Update to the Objective containing information about SGSIP and general revision of this document. Inclusion of item 6.1 temporary files	Taigor Vicari Jessica Albuquerque	Marcelo Lima