The Privacy and Personal Data Protection Policy of Qyon Tecnologia S.A., Qyon Instituição de Pagamento Ltda., Qyon Administradora e Corretora de Seguros Ltda. and other companies in the Qyon Business Group, including direct or indirect parent companies and subsidiaries, affiliates and companies under common control in Brazil (“QYON”), was created to describe and explain personal data collection, use, sharing and storage processes, informing data subjects of their rights and ensuring secure processing subject to a transparent privacy policy.
1. Definitions
The following capitalized terms in QYON's Privacy and Personal Data Protection Policy have the meanings below, in accordance with Brazil's General Personal Data Protection Law, Law No. 13,709/2018:
• Processing agents: the controller and processor.
• Controller: a natural or legal person, governed by public or private law, responsible for decisions regarding personal data processing.
• Personal Data: any information relating to a natural person that allows identification of its subject.
• Sensitive Personal Data: personal data concerning racial or ethnic origin, religious beliefs, political opinions, trade union membership or membership of religious, philosophical or political organizations, health or sex life, or genetic or biometric data linked to a natural person.
• LGPD: Brazil's General Personal Data Protection Law, Law No. 13,709/2018.
• Processor: a natural or legal person, governed by public or private law, that processes personal data on behalf of the controller;
• Policy: QYON's Privacy and Personal Data Protection Policy.
• Data Subject: the natural person to whom the personal data being processed relates.
• Processing: any operation performed on personal data, including collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, assessment or control of information, modification, communication, transfer, dissemination or extraction.
2. Application
This Policy applies to all services and products supplied and offered by QYON. QYON may occasionally develop new products and/or services or offer additional ones. If introducing them materially changes how we collect or process personal data, we will provide additional information, conditions or policies. Unless otherwise stated when introduced, new or additional products and/or services are subject to this Policy.
This Policy applies to natural persons interacting with QYON by providing personal data, whether contacting QYON on their own behalf or as representatives of a legal entity.
This Policy also applies to other forms of personal data collection by QYON that enable delivery or improvement of our services. For example, we may collect information through partners or relating to our technologies. All collection methods and uses of your personal data are described in this Privacy Policy.
The practices described herein apply only to processing your personal data in Brazil and are subject to applicable local laws, especially the LGPD.
3. Data Collection
When accessing QYON's website or requesting, contracting or using its products or services, certain personal data is supplied and collected and may be processed by QYON according to its purpose. In some cases, the Data Subject provides data directly; some Personal Data may also be collected automatically, as specified below.
The Data Subject must provide only true, current and accurate personal data and is solely responsible for false, outdated or inaccurate information supplied to QYON.
Data provided by the Data Subject.
This includes all information voluntarily entered or supplied by the Data Subject on the Platform, including:
(I) USER/Data Subject Personal Data: any data identifying the USER/Data Subject as an individual, including but not limited to name, identification documents, nationality, occupation, address, date of birth, parentage, gender, telephone, email address, banking data and any other information enabling personal identification.
(II) Personal Data that may appear in Electronic Tax Documents: electronic invoices (NFe), electronic service invoices (NFSe), electronic consumer invoices (NFCe), electronic transport documents (CTE) and any other documents issued by the platform and transmitted to Federal Revenue, State Treasury and municipal systems whose recipient is the Contracting Party, automatically downloaded/stored by the Platform for its analysis and access.
(III) Personal Data that may appear in Electronic Financial Documents: bank payment slips and payment receipts issued by the platform and transmitted digitally to systems of banks with which the Contracting Party has a relationship, processed/stored by the ERP Platform for its analysis and access.
(IV) Personal Data of USERS' collaborators, contractors, employees, representatives and salespeople: any data identifying them as individuals, including but not limited to name, identification documents, nationality, occupation, address, date of birth, parentage, gender, telephone, email address, banking data, remuneration, payslips and any other information enabling personal identification.
Data provided by the Data Subject for account opening and QYON Bank platform access
For QYON Bank platform access, QYON requests personal data according to whether the account is for an individual or legal entity.
For creation and access to Individual accounts, collected data includes:
• Full name, CPF registration number and date of birth, gender, marital status, city and state of birth, as needed to verify identity and enable contractual performance;
• Address details, including street, number, additional address information, district, city, state and postal code, email address and landline or mobile number, needed to communicate with the Data Subject and ensure contractual, legal and regulatory compliance;
• Parentage details, with mother's name mandatory and father's name optional, to distinguish people with the same name;
• Identification document details, including document number, issue date, issuing authority and state, to secure identity verification procedures;
• Personal identification document (RG containing CPF or CNH) plus a facial photograph, with camera access to capture the Data Subject's face through a procedure known as Facematch, used to improve platform access security and verify identity.
For creation and access to Legal Entity accounts, collected data includes:
• Corporate name, CNPJ registration number, trading name, incorporation date, company contact telephone and CRC registration number for accounting firms. These are not considered Personal Data under the LGPD and are requested to enable contracting of the payment account;
• Address details, including street, number, additional information, district, city, state and postal code, email address and landline or mobile number, needed to communicate with the legal entity and ensure contractual, legal and regulatory compliance;
• Full name, date of birth and CPF registration number of the legal entity's representative, needed to verify identity and the validity of their representation;
• Parentage details of the representative, with mother's name mandatory and father's name optional, to distinguish people with the same name;
• The representative's address, including street, number, additional information, district, city, state and postal code, email address and landline or mobile number, needed for communication and contractual, legal and regulatory compliance;
• Identification document details, including document number, issue date, issuing authority and state, to secure identity verification procedures;
• The representative's identification document (RG containing CPF or CNH), current incorporation document of the legal entity, and a facial photograph of the representative, with camera access for Facematch, used to improve platform security and verify identity and authority to represent the legal entity.
Browsing and Device Data
This includes the IP address of the mobile device used to access QYON products or services; technical data such as URL, network connection, provider and device information; Cookies (detailed below); device attributes such as ID, operating system, browser and model; and device geolocation if you authorize its collection.
Personal Data Arising from Use of QYON Platforms
This includes:
Personal data that may appear in Electronic Tax Documents: electronic invoices (NFe), electronic service invoices (NFSe), electronic consumer invoices (NFCe), electronic transport documents (CTE) and other documents issued through Federal Revenue, State Treasury and municipal systems whose recipient is the Qyon Platform User, automatically downloaded for USER analysis and access.
Personal data that may appear in emails and attachments saved on the platform as service records, as configured and authorized by the contracting party, and data collected from third-party systems through integrations configured by the contracting party on the QYON Platform.
Public Data
This includes Contracting Party data collected from public databases, including without limitation Federal Revenue, State Treasury and municipal websites and/or systems.
4. Purposes of Personal Data Processing
QYON uses collected personal data to supply high-quality products and services, ensure Platform security and comply with legal and regulatory obligations requiring knowledge and sharing of personal data with competent authorities. The purposes for which we use your personal data are detailed below:
• Comply with regulatory or legal obligations under LGPD Article 7, II;
• Exercise defense rights in judicial, administrative or arbitration proceedings under LGPD Article 7, VI;
• Comply with administrative or judicial authority decisions under LGPD Article 7, II;
• Verify identity, improve browsing security on our channels and adopt fraud prevention procedures to protect the Data Subject or QYON under LGPD Article 7, II and V;
• Perform actions arising from pre-contractual relationships, during a contract or after contracting, under LGPD Article 7, V;
• Handle complaints, questions and requests through Customer Service, support and the Ombudsman, and provide Data Subject support under LGPD Article 7, V;
• Use cookies as described herein under LGPD Article 7, V; and
• Maintain and update registration data under LGPD Article 7, II and V.
Sensitive Personal Data
QYON may collect sensitive data only to comply with a legal or regulatory obligation under LGPD Article 11, II, a).
Children's and Adolescents' Data
QYON does not knowingly collect children's or adolescents' data through its digital platforms. If a parent or guardian becomes aware of improper submission of such information, they may request deletion under this Policy.
5. Data Subject Rights:
QYON undertakes to comply with legal rules governing data processing for anyone in a public or private legal relationship resulting in collection, acting in good faith and guided especially, but not exclusively, by: a) transparency, b) purpose, c) suitability, d) necessity, e) quality, f) accuracy, g) security, h) prevention and i) non-discrimination.
Data Subjects may protect their rights whenever they believe or identify noncompliance by QYON by contacting: lgpd@qyon.com.br or telephone (19) 2660-2579.
QYON guarantees the ability to submit requests based on these rights:
a) confirmation of the existence of processing;
b) access to data;
c) correction of incomplete, inaccurate or outdated data;
d) anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data;
e) portability of data to another provider;
f) deletion of data processed with USER consent, except where legal retention or other statutory exceptions apply;
g) information about public or private entities with which QYON has shared data;
h) information about the possibility of withholding consent and the consequences of refusal;
i) withdrawal of consent;
j) objection to processing based on a consent exemption if it breaches the General Data Protection Law;
k) review of decisions based solely on automated personal data processing that affect Data Subjects' interests, respecting QYON's trade and industrial secrets, including but not limited to fraud prevention criteria or contractual performance. QYON will make every effort to address requests as quickly as possible. Even upon deletion requests, minimum storage periods for internet application USER information under Brazilian law and other applicable legal requirements shall be respected.
6. Personal Data Storage and Deletion
Personal data of Data Subjects interacting with QYON shall be retained no longer than necessary to fulfill the purposes for which it is processed, subject to applicable legal or controller regulatory retention obligations and, where possible, anonymization.
7. Recipients and Transfers of Personal Data
Personal Data collected by QYON may be shared with:
(a) Research Bodies under LGPD Article 5, XVIII;
(b) Direct and indirect public administration bodies and entities at all levels of Brazilian government, as provided by law;
(c) Private legal entities contractually linked to QYON, provided processing conditions remain consistent with purposes disclosed to the Data Subject and the Data Subject is informed of sharing. Personal data may be transferred only to countries, territories or international organizations ensuring adequate protection for data subjects, whether users or participants in educational, academic, research or medical relationships.
Where adequate protection is absent, QYON undertakes to ensure protection under stricter rules through specific contractual clauses for the proposed transfer, standard contractual clauses, global corporate rules or duly issued seals, certificates and codes of conduct, respecting the most appropriate legislation. Otherwise, the transfer shall not occur.
8. Cookies and Similar Technologies
When QYON Platform services are used, QYON may collect personal information about services the Data Subject uses and how they are used. This is necessary for proper service delivery and continuous improvement of application features.
(i) Geolocation Information: location may be collected from data such as IP address or mobile-device GPS to provide an optimized experience. Most mobile devices let you control or disable application location services in device settings.
(ii) Usage Patterns: information may be collected on how you use QYON Platform Services, such as most-used features, changes made and usage time.
(iii) Log Data: logs and device information may be collected automatically when using QYON Platform services, even if the Data Subject is not a customer.
QYON may use technology to store temporary browsing information to improve the product experience. The main tools are “cookies,” alongside similar technologies.
This makes it possible, for example, to identify sites visited by the Data Subject, their IP address and browser version.
The Data Subject can configure their device to manage cookies or alert them when active. Some cookies may be necessary for browsing, and disabling them may impair certain QYON Services features.
9. General Provisions
For more detailed information and any communication about this Privacy Policy, the Data Subject may use QYON's customer communication channels, including the website www.qyon.com.
QYON is legally required to ensure compliance with the law and court decisions and supply Personal Data to respond to authorities, safeguard its rights and prevent fraud risks.
This Privacy Policy was updated on March 25, 2024. The Controller reserves the right to modify the information herein, available at www.qyon.com.
Data Subjects who provided an email address shall be expressly notified of changes to this Privacy Policy.
Rodovia Luiz de Queiroz, SP-304 – Km 127,5
Americana SP – CEP 13466-170
Phone: 0800 591 0486 | www.qyon.com