Privacy Policy

This Privacy and Personal Data Protection Policy (“Policy”) sets out the corporate guidelines for data governance, privacy, and information security adopted by KINEL FOREIGN EXCHANGE CORRETORA DE CAMBIO LTDA (“Brokerage”), a member of Brazil’s National Financial System (“SFN”). Our institutional commitment is grounded in full respect for the fundamental rights to freedom, privacy, and the free development of the personality of every individual with whom we interact.

This Policy has been developed in strict accordance with Brazil’s General Data Protection Law (Law No. 13,709/2018 — “LGPD”) and regulations issued by the Central Bank of Brazil (“BACEN”), particularly National Monetary Council (CMN) Resolution No. 4,945/2021 (Social, Environmental and Climate Responsibility Policy), CMN Resolution No. 4,893/2021 (Cybersecurity), and guidelines governing Foreign Exchange and International Capital. It also follows legislation on the Prevention of Money Laundering, Terrorist Financing, and the Financing of the Proliferation of Weapons of Mass Destruction (“PLD/FTP” — Law No. 9,613/1998 and BACEN Circular No. 3,978/2020), as well as guidelines issued by Brazil’s Council for Financial Activities Control (“COAF”).

This Policy aims to:

• Maintain Regulatory Compliance: Ensure that the Brokerage’s foreign exchange transactions and corporate activities remain aligned with the LGPD and the rules issued by BACEN, COAF, the Brazilian Federal Revenue Service (“RFB”), and other regulatory authorities;
• Uphold Data Subject Rights: Provide clear, accessible, and transparent procedures that enable individuals to fully exercise their personal data rights;
• Ensure Operational Transparency: Explain how personal data is collected, processed, shared, stored, and protected throughout its lifecycle;
• Reduce Risk: Establish strict information security guidelines to prevent data security incidents and financial fraud;
• Build a Culture of Privacy: Provide ongoing guidance and training to employees, directors, partners, and foreign exchange agents on responsible data processing practices.

This Policy applies to all personal data processing activities carried out by the Brokerage, in both physical and digital environments, and covers:

1. External Individuals: Individual clients; legal representatives, authorized representatives, directors, and shareholders of corporate clients; beneficiaries of international transfers; senders; and visitors to our digital platforms and physical premises;
2. Employees and Third Parties: Employees, including apprentices; job applicants; directors; service providers; suppliers; and Foreign Exchange Agents acting on behalf of the Brokerage. These agents are individuals or legal entities authorized to represent a financial institution in foreign exchange transactions, including the purchase and sale of foreign currencies, the sending and receiving of international remittances, and related services;
3. The Data Lifecycle: Collection, receipt, classification, use, processing, access, distribution, transmission, storage, archiving, deletion, anonymization, and international transfer.

All data processing activities carried out by the Brokerage strictly follow the legal principles established in Article 6 of the LGPD:

• Purpose and Compatibility: Data is processed for legitimate, specific, explicit purposes disclosed to the Data Subject and consistent with the institution’s foreign exchange and operational activities.
• Necessity (Data Minimization): Data collection is limited to what is strictly necessary to deliver the contracted services and meet legal and/or regulatory requirements.
• Access and Transparency: Individuals are provided with easy, free access to clear and accurate information about how their data is processed and for how long.
• Data Quality: Data is kept accurate, clear, and up to date as necessary to fulfill its intended purposes and meet regulatory obligations.
• Security and Prevention: Technical and administrative measures are used to protect data against unauthorized access, accidental harm, and unlawful activity.
• Non-Discrimination: Data must not be processed for unlawful, abusive, or discriminatory purposes.
• Responsibility and Accountability: The Brokerage demonstrates the effectiveness of the measures it adopts to ensure and substantiate compliance with data protection requirements.

The Brokerage collects personal data provided directly by clients, collected automatically through digital channels, or received from third parties and public databases. The scope of the data collected depends strictly on the nature of the relationship:

• Client Identification Data: Full name, Brazilian identity card number (RG), Brazilian taxpayer identification number (CPF/ME), marital status, gender, nationality, place and date of birth, parents’ names, occupation, and job title.
• Contact Details: Residential and business addresses, postal code, landline number, mobile/WhatsApp number, and email address.
• Financial and Asset Information: Monthly income, net worth, financial statements, income tax returns, proof of source of funds, Brazilian bank account and branch details, and PIX key.
• Foreign Exchange and International Transfer Details: Transaction type, economic purpose, transaction amount, currencies involved, supporting documents such as bills, invoices, and service agreements, and the overseas beneficiary’s or sender’s banking details, including SWIFT/BIC code, IBAN, account number, and the corresponding financial institution’s address.
• Biometric and Security Data: Facial biometrics, selfies for liveness verification, recordings of telephone calls and customer service interactions, and CCTV footage captured at our physical premises.
• Compliance, Know Your Customer (KYC), and PLD/FTP Data: Results of searches in public and private databases, screening against sanctions lists (OFAC, UN, and European Union), Politically Exposed Person (PEP) status, tax residency status, and tax information (FATCA/CRS).
• Automatically Collected Browsing Data: IP address, access timestamps, mobile device identifiers, browser type, geolocation data, and preferences collected through cookies on our online platforms.

The Brokerage processes personal data on the legal bases established in Articles 7 and 11 of the LGPD, for legitimate purposes and to meet foreign exchange market regulatory requirements:

8.1 Sensitive Personal Data

The Brokerage’s processing of sensitive data is strictly limited to facial biometrics for client identity verification, liveness checks, and fraud prevention on digital channels (Article 11, II, “g” of the LGPD). We do not collect information about health, religious beliefs, political opinions, or trade union membership, except where strictly required to administer employee benefits or comply with legal obligations under eSocial, Brazil’s employment and social security reporting system.

8.2 Personal Data of Minors

Children’s and adolescents’ data is processed only in exceptional circumstances, such as foreign exchange transactions for a minor’s education or travel abroad, or the registration of employees’ dependents. In these cases, processing will be carried out exclusively in the minor’s best interests and with specific, clearly highlighted consent from at least one parent or legal guardian (Article 14 of the LGPD), except where collection is necessary to contact the responsible adults or fulfill a legal obligation without ongoing storage.

The Brokerage shares personal data in a limited, secure, and transparent manner, only as necessary to carry out foreign exchange transactions, meet legal requirements, or support legitimate operational needs:

• Financial Institutions and Overseas Correspondent Banks: To settle international transfers through SWIFT and execute payment instructions, which require the beneficiary’s and sender’s details to be included in the financial settlement message;
• Public Authorities and Regulators: To provide information, routinely or upon request, to BACEN, COAF, RFB, the courts, or the Public Prosecutor’s Office;
• Foreign Exchange Agents and Business Partners: To share data with the accredited network that sources and facilitates foreign exchange transactions on behalf of the Brokerage, subject to the same contractual privacy obligations;
• Service Providers and Technology Providers: Cloud hosting providers, biometric verification tools, credit bureaus, and fraud screening systems;
• Corporate Transactions: In the event of a restructuring, merger, absorption into another company, or acquisition of the Brokerage, subject to confidentiality obligations.

The Brokerage will not sell its clients’ Personal Data or share it with third parties for direct marketing purposes unless the Data Subject has expressly authorized it.

Individuals may opt out of direct marketing at any time. Upon receiving a request, the Brokerage will add the individual to its direct marketing suppression list and ensure that no further direct marketing communications are sent to them. The Brokerage works with online advertisers and social media networks (“marketing partners”). These partners use cookies and similar technologies for marketing purposes and may display targeted advertisements about the Brokerage on third-party websites, but only with the website visitor’s consent. Visitors can reject the third-party cookies used for this type of marketing at any time through our cookie preference center.

By their nature, foreign exchange transactions and international remittances require data to be sent to institutions and systems outside Brazil. The Brokerage ensures that international data transfers fully comply with Articles 33 to 36 of the LGPD by applying the following safeguards:

1. Transactions Requested by the Data Subject: Transfers necessary to perform a contract or take steps before entering into a contract at the Data Subject’s request (Article 33, IX of the LGPD);
2. Countries with an Adequate Level of Protection: Transfers to jurisdictions recognized by the ANPD as providing compatible and adequate data protection legislation;
3. Standard Clauses and Contractual Safeguards: Use of specific contractual clauses or binding corporate rules with overseas partners and correspondent banks;
4. Compliance with Legal and Regulatory Obligations: Compliance with international cooperation agreements and global rules to combat financial crime.

The Brokerage enables all Data Subjects to fully and easily exercise the rights established in Article 18 of the LGPD. Requests will be addressed within a reasonable timeframe, subject to the LGPD and applicable regulations:

• Confirmation and Access: Confirm whether your personal data is being processed and access the personal data held by the Brokerage;
• Correction: Request the correction of incomplete, inaccurate, or outdated data;
• Anonymization, Restriction, or Deletion: Request the removal of data that is unnecessary, excessive, or processed in breach of the LGPD;
• Portability: Make an express request to transfer your data to another service provider, subject to the protection of trade and industrial secrets;
• Deletion of Data Processed on the Basis of Consent: Request the deletion of data processed solely on the basis of your prior consent;
• Information About Data Sharing: Obtain details of the public and private entities with which the Brokerage has shared your data;
• Withdrawal of Consent: Withdraw your consent to processing at any time, without affecting the lawfulness of processing carried out before withdrawal.

The Brokerage retains the personal data it collects for as long as necessary to fulfill the purposes described in this Policy and for the periods required by applicable rules:

The Brokerage applies strict technical, organizational, and administrative security measures to protect personal data against unauthorized access, data leaks, unauthorized changes, loss, or destruction. The controls implemented, aligned with CMN Resolution No. 4,893/2021, include:

• Strong Encryption: Encryption in transit using TLS 1.2/1.3 and at rest using AES-256 for databases containing sensitive information;
• Access Control and Multi-Factor Authentication (MFA): Access management based on the principle of least privilege, with multi-factor authentication required for critical systems;
• Monitoring and Logging: Auditable records of all access to and operations performed on databases containing personal information;
• Vulnerability Management: Annual penetration testing and regular security scans;
• Backups and Business Continuity: Automated backups, regular restoration testing, and a business continuity plan.

The Brokerage maintains a Security Incident Response Plan coordinated by the Data Protection Officer (DPO) and the Technology and Compliance Directorate. If a security incident occurs that could cause significant risk or harm to Data Subjects:

1. Notification to the ANPD: Brazil’s National Data Protection Authority will be formally notified within the applicable legal timeframe, as established by ANPD regulations;
2. Notification to Affected Individuals: Affected Data Subjects will receive a notification describing the nature of the data involved, the consequences of the incident, the technical corrective measures taken, and contact details for further information;
3. Documentation and Audit: All incidents, investigations, and remediation plans will be properly documented and retained for at least 5 years.

The following Data Protection Officer has been appointed to serve as the point of contact between the Brokerage, Data Subjects, and Brazil’s National Data Protection Authority (ANPD):

Any employee, director, service provider, or foreign exchange agent who violates this Policy will be subject to internal disciplinary measures, including a warning, suspension, dismissal for cause, or termination of their contract. These measures do not exclude any obligation to pay compensation or any applicable civil, administrative, or criminal liability.

This Policy takes effect upon its publication and approval by the Compliance Committee. It must be reviewed at least every 12 months and may be reviewed sooner whenever significant legislative or regulatory changes occur.