Privacy Policy

Introduction

UTUA’s goal is to share information and commercial offers of interest to its Users, informing them about products and services best suited to their circumstances, according to their needs and preferences.

UTUA follows national and international standards and rules for the security, storage, protection, privacy, and transmission of data.

By using UTUA’s services, the user confirms that they have read, understood, and accepted the Terms and Policies applicable to the service provided by UTUA, including this Privacy Policy, and agrees to be bound by them, acknowledging that the controller of their personal data — that is, the company responsible for making decisions about the processing of their personal data — is NEXUS INTERNATIONAL VENTURES BRASIL LTDA, a private legal entity, enrolled with the Brazilian Corporate Taxpayer Registry (CNPJ) under No. 65.836.872/0001-30, headquartered at Av. Afonso Pena, No. 3351, Room 1101NIV, Bairro Serra, Belo Horizonte/MG, CEP 30.130-008.

After reading this Privacy Policy, if you have questions or complaints, want to exercise your rights regarding your personal data, or wish to contact UTUA about this subject, you can reach us through our service channels or contact our Data Protection Officer (DPO), Gabriel Machado Delgado, at compliance@nexusiv.org

1. Scope

This Privacy Policy applies to all UTUA users and anyone who, in any way, makes use of the services provided by this tool. We collect your personal data whenever you:

• Fill out the registration form available on the company’s website;
• Take part in surveys or promotions offered by UTUA;
• Report an issue to UTUA, requesting that the company provide a solution;
• Browse UTUA’s website – https://utua.com.br/
• Contact us through our service channels;
• Sign up for “Clube Utua” to take part in specific sweepstakes and promotions, as described in that program’s specific Privacy Policy.

This Privacy Policy also applies to other forms of personal data collection by UTUA that enable the provision or improvement of our services. For example, we may collect information through partners or related to our technologies, or for participation in duly regulated sweepstakes, as is the case with Clube Utua.

The practices described in this Privacy Policy are subject to applicable local laws, notably Law No. 13,709/2018 (the Brazilian General Data Protection Law, or “LGPD”).

2. What personal data UTUA collects

By using UTUA’s services, you provide us with, and we collect, certain personal data related to you. From the moment you interact with UTUA, we collect your personal data. In some cases, you provide your personal data directly to UTUA, but we may also collect your data automatically when you browse UTUA’s website.

In addition, we also receive certain personal data sent by partners we hire for specific purposes, so that we can comply with legal obligations or applicable regulations, among other purposes detailed further below.

By accepting the terms of this Privacy Policy, you expressly agree to provide only true, current, and accurate personal data, and not to alter your identity or personal data in any way when accessing and using our products or services. You will be solely responsible for any false, outdated, or inaccurate information you provide directly to UTUA.

Below are the categories of your personal data processed by UTUA:

Personal data that may be requested from and provided by the data subject:

• (i) Registration data: full name, phone number, e-mail, CPF (Brazilian taxpayer ID), date of birth, address, gender, RG (ID number and issuing authority), full name of father and mother;
• (ii) Data regarding the intended transaction: information related to the financial product or type of credit you wish to obtain;
• (iii) Data regarding employment status and banking information: information related to the user’s current or previous occupation, as well as any movements or balances in accounts linked to the FGTS (Brazilian severance indemnity fund) and bank details provided to receive funds;
• (iv) Social security benefit data: profile (retiree, pensioner, public servant, member of the armed forces, etc.); type of benefit received (retirement, pension, etc.); benefit amount; enrollment number; state, bank, account, and branch of receipt;
• (v) Data regarding possible loan collateral: whether you own a vehicle or property; value and address of the property to be used as collateral; and default status, if applicable;
• (vi) Data from information systems: SCR (Central Bank Credit Information System), Cadastro Positivo (positive credit registry), and Open Finance data, in accordance with applicable legal and regulatory limits.

Personal data we collect from third parties:

• Registration data, such as: name, date of birth, CPF, phone number, and address;
• Data on financial restrictions, such as: default records, amounts owed, and due dates;
• Credit history information;
• Score generated by credit bureaus;
• Information on debts due or overdue, co-obligations, and collateral;

Browsing and device data:

• IP address of the mobile device used to access UTUA’s services or products;
• Interactions performed and usage profile on UTUA’s website;
• Technical data, such as URL information, network connection, provider, and device information;
• Cookies;
• Device attributes, such as ID, operating system, browser, and model;
• Device geolocation data, if you authorize collection from your device;
• application access logs;
• date and time of application use;
• browsing data, reflecting the areas visited;

Personal data arising from the use of our services:

• Data related to hiring our services;
• Data related to entering into credit transactions with partners, such as personal loans, negotiation of amounts owed, and debt installment plans;
• Credit history;
• Customer service history;

“UTUA does not collect or process sensitive data, such as racial or ethnic origin, religious or political belief, union membership, or genetic or biometric data, except where strictly necessary and with a valid legal basis.”

3. How UTUA uses your personal data

UTUA uses your personal data in order to offer you the best products and, in the case of Clube Utua, to allow you to participate in sweepstakes promoted under the terms of their respective Rules.

UTUA is committed to continuously implementing physical, technical, and administrative information security measures when processing your personal data, in line with industry best practices. This is intended to protect your data against unauthorized access and against accidental or unlawful destruction, loss, alteration, disclosure, or any other form of inappropriate or unlawful processing.

Below we detail the purposes for which we use your personal data:

Personal data provided by the data subject

Purposes:

• Correct and accurate identification of the user, thereby ensuring greater security and protection for users themselves;
• Access to the services and products offered by UTUA;
• Analysis of users’ profiles in order to recommend the best products and information according to their actual needs and circumstances;
• Identification, authentication, and verification of requirements for using UTUA’s services;
• Sending articles and texts related to partners’ products, which, in the case of Clube Utua, enable the accumulation of points for the User’s participation in sweepstakes regularly promoted by UTUA;
• Responding to requests and questions;
• Contact by phone, e-mail, SMS, WhatsApp, or other means of communication, including sending notifications or push messages regarding the use of UTUA’s services;
• Improvement of the services provided by UTUA, including cross-referencing information about contracted products in order to offer new products and services;
• Marketing, prospecting, market and opinion research, and promotion of our partners’ products and services, including enabling offers and sending information about products, services, news, features, content, and other events relevant to maintaining our relationship with you;
• Credit protection, including credit granting and limit increases;
• Prevention and resolution of technical or security issues;
• Investigations and measures to prevent and combat illegal acts, fraud, and financial crimes, and to ensure the security of UTUA’s customers and of the financial system;
• Cooperation with or compliance with court orders, competent authorities, or regulatory bodies;
• Compliance with legal or regulatory obligations;
• Resolving questions based on the information collected, in order to clarify doubts, fix problems, and improve the system, enhancing the UTUA User’s experience.

Personal data we collect from third parties

Purposes:

• Improvement of our products and services;
• Marketing, prospecting, and market and opinion research;
• Credit protection, including credit granting and limit increases;
• Prevention and resolution of technical or security issues;
• Investigations and measures to prevent and combat illegal acts, fraud, and financial crimes, and to ensure the security of UTUA’s customers and of the financial system;
• Compliance with legal or regulatory obligations, keeping your registration up to date, or fulfilling legal and/or regulatory obligations imposed on UTUA.

Browsing and device data

Purposes:

• Provision of services, offering of contracted products, and improvement of the use of and experience with UTUA’s website;
• Operationalization of new products and services;
• Recommendation of new services, products, or features, including services from other partners that may be of interest to you;
• Display of advertising, whether on our website, social media, or third-party websites;
• Generation of statistics, studies, research, and surveys related to activities and behavior in the use of products or services;
• Credit protection, including credit granting and limit increases;
• Prevention and resolution of technical or security issues;
• Investigations and measures to prevent and combat illegal acts, fraud, and financial crimes, and to ensure the security of UTUA’s customers and of the financial system;
• Compliance with court orders, competent authorities, or regulatory bodies;
• Compliance with legal or regulatory obligations;

Personal data arising from the use of our partners’ products and services

Purposes:

• Provision of services and offering of contracted products;
• Improvement of the services provided by UTUA, including cross-referencing information about contracted products in order to offer new products and services;
• Development of new products and services to be offered by UTUA’s partner companies, and generation of knowledge for innovation or development of new products;
• Testing to improve UTUA’s models, services, and products;
• Marketing, prospecting, market and opinion research, and promotion of our partners’ products and services, including enabling offers and sending information about products, services, news, features, content, and other events relevant to maintaining our relationship with you;
• Credit protection, including credit granting and limit increases;
• Prevention and resolution of technical or security issues, and monitoring of the use and performance of UTUA’s services and products;
• Investigations and measures to prevent and combat illegal acts, fraud, and financial crimes, and to ensure the security of UTUA’s customers and of the financial system;
• Cooperation with or compliance with court orders, competent authorities, or regulatory bodies;
• Compliance with legal or regulatory obligations.

Public data

Purposes:

• Promotion of the products and services provided by UTUA on social media, websites, apps, or institutional and advertising materials;
• Credit protection, including credit granting and limit increases;
• Investigations and measures to prevent and combat illegal acts, fraud, and financial crimes, and to ensure the security of UTUA’s customers and of the financial system;
• Regular exercise of UTUA’s rights;
• Compliance with legal and/or regulatory obligations imposed on UTUA.

4. Sharing of personal data

UTUA may share your data in certain circumstances. Your data may be shared with companies within UTUA’s economic group, service providers, and with authorities and regulatory bodies for different purposes, when necessary. Whenever it occurs, data sharing will be carried out within the limits and purposes of our business and in accordance with applicable law.

Additionally, personal data may be shared with Assertiva Tecnologia da Informação LTDA, always in compliance with the applicable legal basis, the principles of the LGPD, and the legitimate chain of data processing, with the appropriate commitment to confidentiality, security, and compliance. At any time, the User will have free access to their personal data, either through NEXUS’s service channel or that of Assertiva Tecnologia da Informação LTDA, and may exercise all rights provided for in this Policy and in applicable law, particularly the Brazilian General Data Protection Law (LGPD).

Below is a summary, organized by category, of the types of providers with whom we share your personal data:

Business partners, service providers, and other third parties

Purposes of sharing:

• Improvement of our services and website, as well as operationalization of new products or services;
• Contact by phone, e-mail, SMS, WhatsApp, push notification, or other means of communication;
• Assistance in developing and offering our services and the sweepstakes promoted by Clube Utua;
• Marketing, prospecting, market and opinion research, and promotion of our products and services;
• Credit protection, including credit granting and limit increases;
• Prevention and resolution of technical or security issues;
• Investigations and measures to prevent and combat illegal acts, fraud, and financial crimes, and to ensure the security of UTUA’s customers and of the financial system;
• Regular exercise of UTUA’s rights;
• Compliance with court orders, competent authorities, or regulatory bodies;
• Compliance with legal or regulatory obligations;
• Verification and improvement of the UTUA customer’s credit line, by cross-referencing information and analyses with data obtained from partners and credit bureaus;

Authorities and regulatory bodies

Purposes of sharing:

• Investigations and measures to prevent and combat illegal acts, fraud, and financial crimes, and to ensure the security of UTUA’s customers and of the financial system;
• Regular exercise of UTUA’s rights, including submitting documents in judicial and administrative proceedings, if necessary;
• Compliance with court orders, and responding to requests from competent authorities or regulatory bodies;
• Compliance with legal or regulatory obligations.

In addition, while browsing our website, you may be redirected to third-party websites or apps. Once you are redirected to a third-party website or app, privacy practices will be governed by that third party’s privacy policy and terms of use. We cannot control, and are not responsible for, third parties’ privacy practices and content. Please read the applicable privacy policies carefully to understand how they collect and process your data.

All third parties with whom UTUA shares personal data must sign agreements containing data protection clauses consistent with the LGPD.”

5. Retention and deletion of your personal data

For as long as you are a Customer or Prospect of UTUA, during your use of our services, and throughout the period in which UTUA stores your personal data, it will be kept in a secure and controlled environment.

Where applicable, even after you stop using UTUA’s services or those of its partners, we may retain your personal data for an additional period for audit purposes, compliance with legal or regulatory obligations, the regular exercise of UTUA’s rights, or for the period required under the legal basis that justifies the retention of the data. Where there is no legal basis justifying retention, the data will be deleted from UTUA’s database after 5 (five) years from the end of your relationship with UTUA.

6. Your rights as a data subject

Since the LGPD came into force, you, as the data subject, may exercise your rights with respect to the controllers of your personal data, such as UTUA.

We provide the mechanisms detailed below so that you clearly and transparently understand how to exercise your rights, and our team is ready to respond to any requests.

Confirmation of the existence of personal data processing

The fact that you are a user of UTUA’s services already means that we process your personal data, even if that processing consists, among other things, of storing personal data in a secure and controlled environment. Accordingly, you may ask UTUA to confirm whether it processes your personal data.

Access to personal data

You may request that UTUA disclose and provide the personal data it holds about you.

Correction of incomplete, inaccurate, or outdated personal data

If you find that your personal data is incomplete, inaccurate, or outdated, you may ask UTUA to correct or complete it. To do so, you will need to submit a document proving the correct, current information.

Anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in violation of the LGPD

If any personal data is being processed unnecessarily, in excess of the purpose for which it is intended, or in violation of the LGPD, you may request that UTUA anonymize, block, or delete such data, provided the excess, lack of necessity, or non-compliance with the law is actually established.

Deletion of personal data processed with consent

If you have given consent for the processing of your personal data for specific purposes, you may, at any time, request the deletion of that personal data.

Information on the companies with which UTUA has shared, or from which it has received, your personal data

You may request that UTUA disclose which third parties it has shared your personal data with, or from which it has received your personal data.

Information about the option of not giving consent and the consequences of refusal

If your consent is required to access or use a particular product or service, you may ask UTUA to clarify whether that product or service can be provided without your consent to the processing of your personal data, or what the consequences of not giving consent would be in that case.

Withdrawal of consent

If you have given your consent for the processing of your personal data, you may request the withdrawal of that authorization. Withdrawing consent may result in the inability to use some of the features offered by UTUA, or even in the termination of the services provided, but it does not prevent the use of (i) anonymized data; and (ii) data whose processing is based on another legal basis provided for in the LGPD.

Automated decisions

You may request a review of decisions made solely on the basis of automated processing of personal data that affect your interests, and the criteria used for those decisions. For reasons of trade secrecy, protection of confidential information, and preservation of competition, UTUA does not disclose how these automated systems work.

7. Activity logs / Data collected

We may record the activities you carry out when using our website, creating, where possible and applicable, logs (records of activities carried out on the sites, apps, and services) that will contain: the IP address, access and actions you have taken on the service provided, the date and time of each action taken, and information about the device used, such as operating system version, browser, and geolocation.

We may also use certain technologies, our own or third-party, to monitor the activities carried out while you access our website, such as:

Cookies: internet files that temporarily store what you are viewing online. UTUA uses cookies on its website and also receives information from partners regarding cookies placed on their respective websites. Cookies may be used for various purposes, including remembering you and your preferences, retaining information related to your activities on the website you visited, or collecting information that can be used to offer personalized content.

The user may, at any time, change whether or not to accept cookies in their browser settings, noting that disabling browsing cookies may impair some of UTUA’s features.

We have third-party cookies enabled on our website. Privacy practices will be governed by such third parties’ privacy policies and terms of use, meaning we cannot control, and are not responsible for, third parties’ privacy practices and content. We therefore note that you may, at any time, block the use of cookies by enabling a setting in your internet browser, and your ability to limit cookies will be subject to your browser’s settings and limitations. You may also delete existing cookies through those same browser settings. If you choose to disable cookies, you may continue browsing the sites, but some features may stop working.

Web beacon: a web beacon is a technique that makes it possible to map who is visiting a given web page, identifying their behavior across different websites or web servers.

Google AdSense DART cookie: UTUA displays advertisements served by the GOOGLE ADSENSE network. Google uses cookies to display ads on websites that publish its ads. The DART cookie enables ads to be displayed based on the user’s preferences and browsing habits. Users can choose to disable the DART cookie on the page containing Google’s advertising and content network privacy policy. If a user does not agree with Google’s cookies and wants to disable them, they can simply visit Google’s official page to control how Google uses cookies collected on its ad network: http://www.google.com/ads/preferences/

Analytics tools: these tools may collect information such as how you visit a website, including which pages and when you visit them, as well as other websites visited previously, among other data.

All technologies we use will always comply with the terms of this Privacy Policy.

Activity logs will be stored for at least 6 months, in accordance with Article 15 of the Brazilian Internet Civil Framework Law (Marco Civil da Internet), and may be kept for a longer period for audit or security purposes.

8. International transfer of personal data

Some or all of your personal data may be transferred abroad, for example when it is stored by UTUA, NEXUS, and Assertiva Tecnologia da Informação LTDA on cloud computing servers located outside Brazil. To that end, both comply with all requirements established by applicable law and adopt security and privacy best practices to ensure the integrity and confidentiality of your personal data.

9. Security measures

UTUA uses various types of security measures to ensure the integrity of your personal data, in line with industry information security standards when collecting and storing personal data.

We handle the security of your personal data with the utmost care, using market-adopted standards and best practices. We have a highly qualified team responsible for ensuring that UTUA adopts security best practices, including:

• Multi-factor authentication for access to information;
• Security as code, to enable automation and fast, efficient responses to security events in the technological environment;
• Encryption of data at rest, in transit, and in use, to ensure the integrity of information;
• Continuous monitoring of the environment;
• Ongoing information security analyses and testing of our systems, carried out by internal and external teams;
• Periodic audits.

“In addition to internal reviews, UTUA may hire specialized external audits to verify the effectiveness of its security controls.”

10. Consent

Throughout this Privacy Policy, we note that certain personal data will only be collected by UTUA with your consent. Likewise, such personal data may only be processed with authorization and for the purposes described.

By reading this Privacy Policy and clicking, at the end, “I have read and I am aware of the conditions for processing my personal data, and I give my consent as described in this Privacy Policy,” you consent to the processing of personal data in the manner indicated herein.

Please note that the processing of your personal data is a necessary condition for us to be able to provide our services to you. If you have any questions about any of the terms explained here, we are available through our service channels to help you.

11. Additional relevant information

UTUA does not send e-mails to its Users requesting payments or confirmation of personal data. Therefore, if you receive an e-mail of this nature, we recommend that you disregard it immediately and report it as spam.

UTUA may share your personal data with partner companies in order to recommend products and services best suited to your needs, or to provide products and/or services requested by the user.

Articles on UTUA’s website may include content embedded from other sites, such as videos, images, articles, etc. Content embedded from other sites behaves exactly as if the visitor had visited the other site directly. These sites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including your interaction with the embedded content if you have an account and are logged in to that site.

12. Changes to this Privacy Policy

UTUA may amend this Privacy Policy at any time. Whenever a material condition of this Privacy Policy is changed, such changes will be valid, effective, and binding once the new version is published on our website or sent to you by e-mail.

We are always committed to transparency: whenever a material change is made, we will highlight this information on our main page, https://utua.com.br/. By continuing to use our products and services after a change to the Privacy Policy, you agree to the new terms, although you may always express your disagreement through our service channels, if applicable.

13. Contacting the DPO

Under Law No. 13,709/2018, UTUA is considered the “Controller” of your personal data. If, after reading this Privacy Policy, you still have any questions, or if for any reason you need to contact us regarding matters involving your personal data, you can reach our Data Protection Officer:

• Data Protection Officer (DPO): Gabriel Machado Delgado
• E-mail: compliance@nexusiv.org
• Address: Av. Afonso Pena, No. 3351, Room 1101NIV, Bairro Serra, Belo Horizonte/MG, CEP 30.130-008.
• Duties: Article 41, Paragraph 2, of the LGPD

I – to receive complaints and communications from data subjects, provide clarifications, and take appropriate action;

II – to receive communications from the national data protection authority and take appropriate action;

III – to guide the entity’s employees and contractors on the practices to be adopted regarding personal data protection; and

IV – to carry out any other duties determined by the controller or established in supplementary regulations.

14. What rights do data subjects have?

The Brazilian General Data Protection Law – LGPD guarantees data subjects certain rights regarding their data, which may be exercised at any time upon an express request made by the data subject via e-mail at compliance@nexusiv.org

You may exercise your rights as defined by the LGPD, namely:

• Right of confirmation and access (Art. 18, I and II): You may request, at any time, confirmation of whether your data is being processed in our environments. If so, you may request access to it, as well as request a full electronic copy of that information, or a copy in a format that allows you to use it.
• Right of rectification (Art. 18, III): You may also request the correction of your personal data that is incomplete, inaccurate, or outdated.
• Anonymization, blocking, or deletion of your personal data (Art. 18, IV): In addition to the rights listed above, you also have the right to ask UTUA to anonymize, block, or delete your personal data, if you believe it is being processed excessively in relation to its purpose or without complying with the Brazilian General Data Protection Law – LGPD.
• Right to object (Art. 18, Paragraph 2): Users have the right to object to the processing of their data at any time, for reasons related to their particular situation, provided this is based on one of the grounds that dispense with consent or in the event of non-compliance with the General Data Protection Law.
• Right to withdraw consent (Art. 18, IX): You may, at any time, withdraw any consent you have given to UTUA. Please note that withdrawal of consent may not always be possible, since data processing and storage may, in most cases, be based on requirements set out in law.
• Right not to be subject to automated decisions (Art. 20, LGPD): Data subjects have the right to request a review of decisions made solely on the basis of automated processing of personal data that affect their interests, including decisions intended to define their personal, professional, consumer, or credit profile, or aspects of their personality.

15. FINAL PROVISIONS

If you have any questions regarding the provisions of this Privacy Policy, you may contact us through UTUA’s service channels or through our Data Protection Officer, whose details are provided above.

If third parties process any data collected by UTUA, they must comply with the conditions set out herein and with the Platform’s information security standards.

If any provision of this Privacy Policy is deemed illegal or unlawful by a local authority, the remaining provisions will remain in full force and effect.

The User acknowledges that any communication made by e-mail (to the addresses provided at registration), SMS, instant messaging apps, or any other electronic means, such as digital platforms or instant messaging apps, is also valid, effective, and sufficient for disclosing any matter related to the services provided by the Platform, as well as the conditions of their provision or any other matter addressed therein, except where this Privacy Policy expressly provides otherwise.