Privacy Policy of Lokal

1. Introduction

This Privacy Policy of Lokal (“Policy”) governs the processing of Personal Data of Users of the “Lokal” platform, provided by Lokal Tecnologia e Serviços Ltda., in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018 — “LGPD”) and other applicable regulations.

The Lokal Platform aims to facilitate payments through the Brazilian Instant Payment System (PIX), using an international payment method owned by the User (such as a credit or debit card issued outside Brazil). To do so, Lokal acts as a technological facilitator of transactions, receiving the User's payment request, executing the PIX transfer on behalf of the User with its own capital, from the User Account and the Processing Partners. The corresponding charge to the issuer of the Payment Instrument occurs concurrently with the execution of the PIX payment, even if the effective settlement of the funds to Lokal takes place later, according to the applicable timeframes and rules of the payment method used.

The use of the Platform requires the collection and processing of Personal Data essential for the secure execution of Transactions. Thus, by using Lokal, the User gives their free, express, and informed consent to the terms of this Policy. If the User does not agree, they should not use Lokal's services.

2. Definitions

For clarity and to avoid repetition, the following terms, when used with an initial capital letter, have the meanings set out below (in singular or plural form):

1. “ANPD”: refers to the National Data Protection Authority of Brazil.
2. “User Account”: an individual account created by the User on the Platform, by providing personal information and access credentials, which allows them to use Lokal's functionalities and authorize Transactions. The User Account is personal, non-transferable, and linked to the respective Payment Instrument provided, and is governed by these Terms and Conditions and this Privacy Policy.
3. “PIX Account”: an account held by an individual or legal entity at an institution participating in the PIX system.
4. “Payment Instrument”: any international payment method owned by the User (e.g., credit or debit card) issued by an authorized institution in its jurisdiction, used by the User to perform a PIX Transaction. The Payment Instrument is governed by its own terms, conditions, and agreements, which are independent from Lokal and should be known by the User.
5. “LGPD”: the General Data Protection Law of Brazil, Law No. 13,709/2018, which regulates the processing of personal data, including in digital environments, by individuals or legal entities, public or private, to protect fundamental rights of freedom, privacy, and the free development of the natural person's personality.
6. “Lokal”: refers to Lokal Tecnologia e Serviços Ltda. and/or any of its affiliated companies, as applicable.
7. “Processing Partners”: third-party service providers engaged by Lokal to enable the capture, processing, and settlement of payments made with the Payment Instrument, and to execute PIX transfers within a Transaction. These may include acquirers, sub-acquirers, payment processors, PIX infrastructure providers, and payment or financial institutions.
8. “Platform”: the online environment operated by Lokal through which the services described in these Terms and Conditions are provided, including via website, mobile applications, interfaces, or technological integrations.
9. “Policy”: the document governing the processing of the User's personal data, available at: https://www.lokal-app.com/en/tandc.
10. “Transaction”: a PIX payment for the purchase of a product and/or service offered by any third party that holds a PIX Account.
11. “User”: an individual or legal entity that performs Transactions through Lokal using a Payment Instrument and PIX as the local payment method.

3. Collected Data

3.1. Lokal may collect and process the following personal data (“Personal Data”):

1. Registration Data: full name, date of birth, address, email, phone number, identification document information, Payment Instrument details, and any other data provided when registering the User and creating the User Account;
2. Platform Usage Data: IP address, geolocation, browser, operating system, device model, operations performed on the Platform, and interactions with the User Account;
3. Transaction Data: amounts, date, time, merchant, PIX key, comments, and other information related to the transaction; and
4. Automatically Collected Information: via cookies, web beacons, and similar technologies to improve User experience and personalize services and content. This includes, but is not limited to, browser type, pages accessed, session duration, and navigation behavior.

3.2. All Personal Data processed by Lokal are collected based on at least one of the legal grounds provided in Article 7 of the LGPD, including:

1. performance of a contract (item V);
2. compliance with a legal or regulatory obligation (item II);
3. legitimate interest of Lokal or third parties (item IX); and
4. the User's consent, when applicable.

4. Purpose of Processing

4.1. Personal Data will be used for the following purposes:

1. to provide the Platform's services and process authorized Transactions;
2. to comply with legal, contractual, and regulatory obligations related to anti-money laundering, counter-terrorism financing, and the traceability of financial Transactions, in accordance with Law No. 9,613/1998, and the rules of the Central Bank of Brazil, the National Monetary Council, COAF, and other applicable regulations;
3. to prevent fraud and validate identity, including through “KYC” mechanisms, document verification and registration validation, risk and security analysis;
4. to improve the Platform's features and develop new services;
5. to communicate with the User, including regarding security, support, and contractual changes; and
6. to send promotional information and campaigns, based on the User's consent or Lokal's legitimate interest, depending on the channel used and the content sent, in compliance with the LGPD and other applicable ANPD regulations.

5. Data Sharing

5.1. Lokal may share Personal Data with:

1. Processing Partners and financial institutions, solely to enable Transactions and ensure proper execution of the payment flow as authorized by the User;
2. Public authorities, in compliance with legal, judicial, or regulatory obligations;
3. Foreign authorities, when necessary to comply with applicable international laws or valid requests, always observing due process and the mechanisms set forth in the LGPD for international data transfers;
4. Service providers engaged for hosting, processing, security, and support purposes; and
5. Third parties, when authorized by the User or required to perform contracted services, including for fraud prevention or risk analysis purposes.

6. Device Information and Tracking Technologies

6.1. Lokal may automatically collect certain technical and device information through its mobile application, to ensure secure and efficient operation of its services. This includes:

1. device information, such as model, operating system, unique identifiers, language, and time zone settings;
2. usage information, including app interactions, session time, performance data, and diagnostic logs;
3. geolocation data, collected only for purposes of fraud prevention, risk assessment, and transaction security; and
4. analytical and security technologies, such as mobile SDKs or equivalent tools, used to detect fraud, prevent unauthorized access, and improve the stability and reliability of the Platform.

6.2. The collection and processing of geolocation and device data are carried out on the lawful basis of legitimate interest (Article 7, item IX of the LGPD) and compliance with legal and regulatory obligations applicable to financial institutions.

6.3. The User may manage or revoke permissions for location and device data directly through their mobile operating system settings. However, disabling these permissions may limit the ability to perform or authorize certain Transactions for security reasons.

7. Storage and Security of Information

7.1. Personal Data will be stored in a secure environment, using encryption, access control, firewalls, and information security best practices.

7.2. Lokal adopts reasonable measures to protect data but cannot guarantee absolute immunity against attacks or unauthorized access.

7.3. In the event of a significant security incident, Lokal will notify the User and the ANPD, as required by the LGPD. Lokal may also inform Processing Partners and other financial institutions involved in the Transaction, when applicable.

7.4. Data storage may occur in Brazil or abroad, through proprietary or contracted servers, always in compliance with the legal requirements for international data transfer (Articles 33 to 36 of the LGPD). Lokal keeps records of personal data processing activities in accordance with Article 37 of the LGPD, implements a privacy governance program, and maintains an incident response policy aligned with ANPD recommendations.

8. User Rights

8.1. Under the LGPD, the User has the following rights:

1. confirmation of the existence and access to data;
2. correction of incomplete, inaccurate, or outdated data;
3. anonymization, blocking, or deletion of unnecessary or excessive data;
4. data portability;
5. withdrawal of consent, when applicable;
6. information about data sharing with third parties;
7. deletion of Personal Data, except when retention is required by legal or regulatory obligations, including for anti-money laundering, counter-terrorism financing, and Central Bank compliance purposes; and
8. objection to processing based on legitimate interest, pursuant to Article 18, §2 of the LGPD.

8.2. Requests should be sent to Lokal's support channel: contact@lokal-app.com. Responses to such requests will follow the timelines and requirements set forth in the LGPD and may be subject to verification of the requesting User's identity.

9. Data Retention

9.1. Personal Data will be retained for as long as necessary to fulfill the purposes described in this Policy and to comply with applicable legal or regulatory obligations. After this period, data will be deleted or anonymized, except as required by the LGPD and other applicable laws.

9.2. Lokal may retain Transaction records as required by the National Monetary Council, the Central Bank of Brazil, COAF, and other authorities. Retention may extend for longer periods in cases of legal or regulatory obligations, the exercise of rights in judicial, administrative, or arbitral proceedings, or for audit, information security, fraud prevention, and compliance purposes.

10. Processing of Data from Users Located in the European Union

10.1. Although Lokal is a Brazilian company primarily subject to the LGPD, it recognizes that certain Users located in the European Union may use the Platform in Brazil, in which case the General Data Protection Regulation (“GDPR”) may apply to the processing of Personal Data, always to the benefit of the User.

10.2. Whenever there is an international transfer of data outside the EU, Lokal will observe appropriate data protection mechanisms. Users located in the EU may exercise their rights directly with Lokal through the same contact channel indicated above, and their requests will be handled in accordance with European legislation, when applicable.

11. Final Provisions

11.1. This Policy complies with the LGPD, the Brazilian Internet Civil Framework (“Marco Civil da Internet”), and other applicable financial and payments sector regulations, including those of the National Monetary Council, the Central Bank of Brazil, and COAF. This Policy may be amended at any time, and the User will be informed in the event of material changes.

11.2. Lokal's Data Protection Officer (DPO) is responsible for acting as a communication channel with data subjects and the ANPD. Questions, complaints, or requests related to this Policy may be directed to the DPO via email: contact@lokal-app.com.

11.3. This Policy forms part of Lokal's Terms and Conditions and is available at: https://www.lokal-app.com/en/tandc.