Privacy Policy
LAST UPDATED: SEPTEMBER 09, 2026 • VERSION 2.4 (CENTRAL BANK & LGPD/GDPR STANDARDS)
Commitment Summary: Dotfy Technology, operated in compliance with partner institutions Sistema Seguro Ltda and Verlic Ltda (Verlic Hub), treats payment data privacy and corporate information security as foundational pillars of its financial infrastructure.
1. Definitions and Scope
This Privacy Policy governs the processing of personal and transactional data collected by Dotfy Technology in providing payment processing services, gateways, automated financial splits, and Banking-as-a-Service (BaaS), in strict accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018 - LGPD), Central Bank of Brazil (BACEN) regulations, and international data protection best practices.
2. Data Collected
We collect exclusively the information strictly required to deliver our financial services and prevent transaction fraud:
- Corporate Registration Data: Legal Corporate Name, Tax ID (CNPJ), ownership structure, executive contact details, and tax regularity certificates.
- Identity and Verification Data (KYC): Official identification documents, facial biometrics (liveness detection), and background checks required for compliance with Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) obligations.
- Transactional Data: Instant payment identifiers (such as Pix End-to-End Id), settlement audit trails, timestamps, monetary amounts, and API originating IP addresses.
- Credit Card Data: Dotfy never stores Primary Account Numbers (PAN) or sensitive CVVs on its central servers. All sensitive cardholder data flows exclusively through isolated, PCI-DSS Level 1 certified tokenization vaults.
3. Purpose of Data Processing
Collected data is processed for the following purposes:
- Processing instant electronic payments via the Instant Payment System (SPI) and card scheme rails;
- Provisioning and maintaining ledger accounts and subaccounts within the BaaS ecosystem;
- Continuous real-time fraud monitoring, anomaly detection, and Central Bank compliance reporting;
- Fulfilling legal mandates, judicial orders, and tax/regulatory documentation requirements.
4. Security and Storage Architecture
All data in transit is protected by high-grade cryptography (TLS 1.3 with asymmetric keys and strict forward secrecy). Data at rest is encrypted using AES-256 and hosted in Tier III datacenters featuring multi-region redundancy, automated failover, and quarterly independent security audits.
5. Data Subject Rights
In accordance with Applicable Data Protection Regulations, data subjects have the right to request confirmation of processing, access, data correction, anonymization or deletion of non-essential data, and revocation of consent, except where data retention is strictly mandated by financial regulatory requirements (e.g., Central Bank anti-money laundering records).
6. Data Protection Officer (DPO) & Inquiries
To exercise your rights or clarify any aspect of this Policy, please contact our Data Protection Officer at: dpo@dotfy.com.br or through our institutional support channels.