PRIVACY Policy.

This Policy applies to two principal categories of data subjects: (A) creditor clients who engage our services, and (B) debtors whose data we process in the course of collection and cadastral activities on behalf of creditor clients. Both categories have distinct rights and the data processing for each has distinct legal bases — described in detail below.

A. Creditor clients (contracting parties):

• Company name or personal name, CNPJ or CPF, address, phone and email of the responsible contact — collected when creditors engage our collection or cadastral services.
• Details of the debt portfolio — debtor identities, debt amounts, due dates and any supporting documents — provided by the creditor to enable collection activity.
• Billing data (CNPJ or CPF) for NFS-e issuance.

B. Debtors subject to collection (as operador for the creditor):

• Identification data: Full name, CPF, date of birth and RG — provided by the creditor or obtained from lawful public or commercial sources for the purpose of debtor identification and contact.
• Contact data: Addresses (current and previous), telephone numbers and email addresses — used to contact the debtor in connection with the collection activity, obtained from the creditor, from the debtor directly or from lawful tracing sources.
• Financial data: Debt amount, maturity date, nature of the original obligation and payment history — provided by the creditor. We do not independently assess creditworthiness; we process the data provided by the creditor for the purpose of recovery.
• Communication records: Records of contacts made with the debtor — dates, channels, debtor responses and payment arrangement terms — maintained to document the collection process and any agreements reached.

C. Cadastral information inquiries (on behalf of creditor clients):

• CPF or CNPJ of the subject of the inquiry — provided by the creditor client for credit background checking, address verification or cadastral validation purposes. Processed under the legal bases described in Section 04.

D. Website visitors: IP address, browser type, pages visited and access times; name and message when submitting enquiries.

• Creditor client (collection deliverables): Recovery results, payment records, communication logs and collection outcomes are reported to the commissioning creditor — this is the purpose of the service.
• Credit protection bureaus (SPC, Serasa, SCPC — where applicable): Where the creditor authorises and the conditions of CDC Art. 43 are met, debtor information may be registered with credit protection bureaus. Debtors are informed before any such registration, as required by law.
• SEFAZ-MT / Receita Federal: Tax data for NFS-e issuance and applicable Mato Grosso fiscal compliance.
• Prefeitura de Cuiabá (ISS): For ISS obligations on collection and cadastral service activities.
• PROCON-MT: When required in a consumer dispute — including disputes initiated by debtors about collection practices.
• Judicial authorities: When required by court order — for example, in judicial recovery proceedings initiated by the creditor.
• Legal authorities: When required by a competent judicial or administrative order.

Our collection activities are based in Cuiabá, MT. All debtor and creditor data is stored in Brazil. Any technology platforms used for communication, portfolio management or case tracking that operate on international servers do so under the guarantees of Art. 33 of the LGPD or recognised adequacy mechanisms. Debtor personal data is never transmitted internationally as part of our collection operations.

• NFS-e and fiscal records: Minimum 5 years under Receita Federal and SEFAZ-MT requirements.
• Collection case records (creditor client and debtor): Duration of the collection engagement plus 5 years for contractual and potential dispute purposes. Where a debt is settled, records are retained for the applicable civil limitation period — typically 5 years under Código Civil Art. 206.
• Cadastral information inquiry records: The record of the inquiry is retained for up to 2 years for audit and dispute purposes. The substantive credit information obtained is not retained beyond what is required to deliver the service.
• Credit bureau registrations (SPC/Serasa): Debtor information registered with credit bureaus is subject to CDC Art. 43 — maximum 5 years from the date of the overdue obligation, regardless of the status of the debt.
• Contact and enquiry data (no service commenced): Up to 1 year from last contact.
• Website analytics: Aggregated and anonymised after 12 months.

• Debtor personal data (CPF, addresses, financial information) stored in access-controlled systems — accessible only to collection case handlers directly responsible for that portfolio;
• Strict separation between different creditor portfolios — no debtor's data accessible to handlers working on a different creditor's portfolio;
• Collection communication records maintained in secure, auditable systems;
• Website and digital communications encrypted in transit (HTTPS/TLS);
• As a Ltda, formal internal data handling protocols maintained;
• Incident response procedures and breach notification per LGPD Art. 48.

For debtors subject to collection: You have the right to verify the existence and origin of the debt before any obligation to pay. The following LGPD rights apply to the personal data we hold about you in connection with collection activity:

• Confirmation and Access (Art. 18, I–II): Confirm whether we hold your data and receive information about it — including which creditor commissioned the collection and the nature of the debt claimed.
• Correction (Art. 18, III): Request correction of inaccurate identification or contact data.
• Information on sharing (Art. 18, VII): Find out whether your data has been shared with credit bureaus or other entities.
• Opposition (Art. 18, §2º): Contest the processing if you believe the legitimate interest basis does not apply — for example, if the debt is disputed, already paid or time-barred.
• Complaint to the ANPD (Art. 18, §1º): Lodge a complaint at www.gov.br/anpd.
• Complaint to PROCON-MT: Complaints about collection practices can also be lodged with PROCON-MT under the CDC.

For creditor clients: All standard LGPD Art. 18 rights apply to your identification and commercial data. We respond within 15 business days.

Our website may use cookies for essential functionality and aggregated performance analysis. We do not use behavioural tracking or advertising cookies. Preferences can be managed through browser settings.

Debt collection activities are directed at adults with legal capacity to contract. We do not pursue collection against individuals under 18 years of age — where a debtor identified in a creditor portfolio is a minor, we suspend collection activity and notify the creditor for appropriate handling. We do not intentionally collect personal data from children under 13 via our website or digital channels.

The processing of debtor personal data for debt collection involves balancing the legitimate interest of the creditor in recovering a lawful debt with the privacy rights and dignity of the debtor. We apply the following principles to all collection activity:

This Policy may be updated to reflect changes in our activities, the LGPD, ANPD guidance, CDC interpretations or applicable Mato Grosso tax legislation. Material changes will be communicated via our website and to active creditor clients by WhatsApp or email.

All privacy requests — from creditor clients and from debtors — should be directed to our Data Protection Officer (Encarregado — LGPD Art. 41). Debtors who wish to dispute a debt, verify the creditor's identity or contest collection practices should also contact us via the channels below: