Terms and Policies

To assist in understanding this Policy, it is important to consider the following definitions detailed below:

Anonymization – use of reasonable technical means available at the time of processing, whereby data loses the possibility of direct or indirect association with an individual;

Database s – a structured set of personal data, established in one or several places, in electronic or physical support;

Consent – free, informed and unambiguous manifestation by which the holder agrees with the processing of their personal data for a specific purpose;

Cookies – are small files temporarily stored on the computers of visitors to Grupo Master websites used to identify their internet browsing preferences.

Dado Pessoal / Dados Pessoais – information related to an identified or identifiable natural person;

Sensitive Personal Data – personal data on racial or ethnic origin, religious conviction, political opinion, affiliation to a union or organization of a religious, philosophical or political nature, data relating to health or sexual life, genetic or biometric data, when linked to a natural person;

Elimination – deletion of data or set of data stored in a database, regardless of the procedure used;

Purpose – reason for processing the data subjects personal data;

Holder – natural person to whom the personal data that are the object of processing refer;

Data Processing – any operation performed with personal data, such as those relating to the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation or control of information, modification, communication, transfer, broadcast or extraction;

Shared Use of Personal Data – communication, dissemination, international transfer, interconnection of personal data or shared treatment of personal data banks by public bodies and entities in compliance with their legal powers, or between these and private entities, reciprocally, with specific authorization, for one or more treatment modalities allowed by these public entities, or between private entities.

Grupo Master receives, collects and processes Personal Data for the purposes described below, when:

They are provided directly by the Holder: Personal Data are provided to Grupo Master when the Holder fills out forms, physical or digital registrations, provides information on our digital channels and/or applications, proposals, for the operation of financial transactions, interest in our products, among others.

They are provided by third parties: Grupo Master may receive and collect Personal Data through third parties, whether partners or service providers, who have a relationship with the companies that are part of Grupo Master, in accordance with the LGPD, subject to the purposes established in this Policy. The receipt and collection of Personal Data may also occur for the operation of transactions carried out by the Holder or in which he is a beneficiary or representative, or also through public bases, made available by authorities (such as the Federal Revenue, for example), official bodies, or up to Personal Data made public by the Owner on websites or social networks, always respecting their privacy, in accordance with their consent, when necessary, and in accordance with the rules and legislation in force.

The Personal Data collected may vary according to the nature of the service provided, the product provided or the type of relationship that the Holder maintains with Grupo Master. Thus, according to the purpose of the Data Processing, the Personal Data informed below may be collected:

Personal Information – full name, CPF, RG, nationality, place of birth, marital status, spouse or de facto partners, parentage, biometric data, etc.

Contact Information – home address, email address, contact phone number.

Network traffic information – identification numbers, location data, line identifiers, IP address, cookies, device ID, websites visited or language setting.

Financial Information – bank details, banking transactions, biometric aspects, credit score and restrictions.

Sensitive Personal Data – biometric data, including facial and/or digital, or other sensitive personal data, in accordance with applicable law.

The collection and processing of Personal Data of minors under the age of 18 will only occur with the consent of at least one of those responsible for the minor and will only observe the Personal Data necessary for the purpose for which they were collected.

IT IS THE OWNERS DUTY TO PROVIDE INFORMATION, INCLUDING PERSONAL, CORRECT AND UPDATED DATA. GRUPO MASTER IS NOT RESPONSIBLE FOR THE ACCURACY, TRUTH OR LACK OF THE INFORMATION PROVIDED BY THE OWNER, AND MAY, IN ITS SOLE DISCRETION, SUSPEND AND/OR CANCEL YOUR REGISTRATION AT ANY TIME, IF ANY INACCURACY IS DETECTED.

The Personal Data processed by Grupo Master may be collected for different purposes and have the following objectives, among others:

1. Hiring, operation and provision of services and/or products of Grupo Master;
2. Application for professional opportunities of Grupo Master;
3. Carrying out research and development of new products or services, as long as authorized by the Owner and with the guarantee of anonymity of information;
4. Service and provision of support to customers, employees, suppliers and service providers;
5. Granting of benefits;
6. Compliance with legal obligations and/or regulatory bodies;
7. Exercising ample defense and compliance with judicial and/or administrative orders;
8. Management and treatment of potential risks in the offer and contracting of products and/or services, including credit risks;
9. Promotion of services and products offered by Grupo Master;
10. Provide the Holder with a good and easy browsing experience on the websites of the companies that make up Grupo Master;
11. Operate, evaluate and improve Grupo Masters businesses, including the analysis and review of Grupo Masters customer base and services; data analysis and market research; and performing accounting, auditing, and other internal functions;
12. Assessing, maintaining and improving the security of our websites and applications, especially to prevent possible information security threats;
13. Implement and maintain technical and organizational security measures, internal audits and investigations, verification of conflicts of interest;
14. Protect, identify and prevent fraud or other illegal activities;
15. Safeguard the legitimate interest of Grupo Master companies in accordance with the specific need and without prejudice to the Holders rights;
16. Provide information and clarification regarding the products and services offered by Grupo Master, through our service channels;

Grupo Master may share your Personal Data as strictly necessary for the development of its activities and services, or for the purposes established in this Policy, with due regard for the related purpose.

If it is necessary for Grupo Master to share the Owners Personal Data between companies in Grupo Master, or with a supplier, partner and/or service providers, who may be headquartered outside Brazil, Grupo Master will require that all affiliated companies, suppliers, partners or service providers use such Personal Data in accordance with the General Data Protection Law.

The Owners Personal Data will only be accessed by employees, suppliers, partners and service providers who need its access and are legitimated for the effective treatment, observing the principles of purpose, adequacy, necessity, minimum retention and other principles inherent to the treatment of Personal Data, always for the purposes of Grupo Master, in addition to the commitment to confidentiality and preservation of the Holders privacy, under the terms of this Privacy Policy.

The Personal Data processed by Grupo Master will be shared with third parties in the following cases:

To fulfill our contractual obligations

In order to comply with the obligations arising from the legal relationship contracted with the Holder, Personal Data may be disclosed to Master Groups suppliers or service providers, as well as public or governmental authorities.

For our business purposes

Grupo Master may share Personal Data with third parties for its own commercial purposes. Only the Personal Data strictly necessary to enable the provision of services to the Holder will be shared. Grupo Master may also share Personal Data for various internal purposes, such as, but not limited to, ensuring the security of Grupo Masters services, improving the quality of services that Grupo Master provides to the Holder, and analyzing Personal Data that is collected.

To provide services and products

Grupo Master may share Personal Data with suppliers, partners and service providers that help Grupo Master to provide products and services to the Holder. Grupo Master needs to share information with these partners in order to process the orders that the Holder places, fulfill their requests, provide customer support, or provide other services and functions. Grupo Master may also share Personal Data between companies of Grupo Master to better serve the Holder.

For other internal reasons

Grupo Master may share Personal Data with partners and other entities that provide Grupo Master with certain services or assist with internal functions or with compliance with legal/regulatory provisions, such as data analysis, maintenance of the security of internal systems, information security, data analytics, quality assurance assessors, audit firms, law firms.

For legal or regulatory reasons

Grupo Master may share Personal Data with other entities when necessary to comply with legal or regulatory obligations, including compliance with any applicable law or regulation, judicial, arbitration or administrative proceedings. Grupo Master may also share Personal Data to protect and defend the rights of Grupo Master, the Rights of the Owner, or any other person, to protect against fraudulent or malicious activities, to enforce the terms of this Privacy Policy, or to cooperate with law enforcement agencies.

In relation to corporate transactions

In the process of commercial transaction, such as mergers, acquisitions by another company, or sale of all or part of its assets, Grupo Master will share Personal Data for the successor or potential successor company, as well as its employees during the transaction and with companies audit offices and law firms that are assisting in the operation.

When the Holder consents to the disclosure

Grupo Master may share certain information with partners or other entities when the Owner consents to the sharing in a specific consent term, formalized prior to the sharing of Personal Data.

Grupo Master has partners and service providers based abroad, therefore, to operate in accordance with the provision of contracted services and aiming at the best performance of its business, it may carry out international transfer of the Owners Personal Data, if necessary and in accordance with the purposes set out in this Policy and other data processing and security policies and procedures, as well as the best information security practices in the market. In this case, the measures required by law will be taken to ensure the protection of the Owners Personal Data.

In accordance with the LGPD, Grupo Master assures the Holder the following rights:

1. Confirmation of the existence of the Treatment;
2. Access to Personal Data owned by you;
3. Correction of incomplete, inaccurate or outdated Personal Data;
4. The anonymization, blocking or deletion of unnecessary, excessive or treated Personal Data in violation of the LGPD;
5. The portability of Personal Data to another service or product provider, upon express request, in accordance with ANPD regulations;
6. The elimination of Personal Data processed with the consent of the holder, with exceptions provided for in the LGPD;
7. Information on public and private entities with which Grupo Master shared personal data;
8. Information about the possibility of not providing consent and about the consequences of denial;
9. Revocation of consent under the terms of the LGPD;
10. Review of automated decisions.

The Rights of the Holders provided for in the LGPD and in this Policy may be exercised upon express request by the Holder or its legal representative to the Master Group, as the case may be, and may be made through the following communication channel: dpo@bancomaster.com.br

The Master Group will make all reasonable efforts to meet the requests made by the Holder in the shortest possible time and in compliance with legal requirements. However, justifiable factors may delay or prevent its quick service, given that, in case of delay, the appropriate justifications will be presented to the Holder.

The Holders request may be legally rejected, either for formal reasons (such as their inability to prove their identity) or legal (such as the request to delete data whose maintenance is free exercise of rights by the Master Group), it being certain that , in the event of impossibility of meeting these requests, reasonable justifications will be presented to the Holder.

The request to delete Personal Data necessary for the management and provision of services contracted with the Master Group, when possible the elimination, may lead to the termination of the contractual relationship with the cancellation of the provision of services.

If necessary, the Owners consent to carry out the processing of Personal Data, this will be duly requested by the Master Group. In this case, the Holder has the right to revoke his consent at any time, provided that the revocation will not affect the legality of any treatment based on the consent given before its revocation or any other legal basis permitted by law.

The Holder also has the right to refuse the provision of certain types of Personal Data, however, this option may affect the use of part of the services and resources offered by Grupo Master, in addition to hampering our ability to offer you the best experience as a user of our services. Unless otherwise specified, the choice not to provide certain information will not result in any legal consequences for the Holder.

Grupo Master will ensure the Holders the right to review any automated decisions, thus considering systemically parameterized decisions for contracting products and services according to criteria established in its internal policies.

Grupo Master may provide links to other sites considered relevant.

Grupo Master is not responsible for the Privacy Policy practiced by these sites. Third parties have their own policy for the collection, use, sharing and handling of Personal Data. These third parties will be responsible for maintaining any kind of processing of Personal Data related to their services. Grupo Master recommends that the Owner reads the policies of these third parties. Grupo Master is also not responsible for information and links made available on behalf of Grupo Master on third-party websites that are not authorized or and/or confirmed by official sources of Grupo Master.

Personal Data will be stored for the period necessary to fulfill the purpose of the processing for which they were collected. No documents or information containing personal data will be used unless expressly authorized by the LGPD and applicable regulations.

All Personal Data collected from the Owners are considered confidential by Grupo Master, and therefore will be stored on its own servers or by third parties, receiving our commitment to adopt all reasonable market efforts in order to preserve the security of the systems that carry out the storage, observing the practices required by current legislation, including Law No. 12,965/14 (“Internet Civil Framework”). However, considering that no security system is infallible, Grupo Master will not be liable for any damages and/or losses arising from failures, viruses or invasions of our database, except in cases where there is intent or fault.

For purposes of auditing, security, fraud control and preservation of rights, Grupo Master may keep the registration history of the Owners Personal Data for the period established by law or regulatory rule or for the preservation of rights.

Personal Data will be stored for the period necessary to fulfill the purpose of the processing for which they were collected. No documents or information containing personal data will be used unless expressly authorized by the LGPD and applicable regulations.

All Personal Data collected from the Owners are considered confidential by Grupo Master, and therefore will be stored on its own servers or by third parties, receiving our commitment to adopt all reasonable market efforts in order to preserve the security of the systems that carry out the storage, observing the practices required by current legislation, including Law No. 12,965/14 (“Internet Civil Framework”). However, considering that no security system is infallible, Grupo Master will not be liable for any damages and/or losses arising from failures, viruses or invasions of our database, except in cases where there is intent or fault.

For purposes of auditing, security, fraud control and preservation of rights, Grupo Master may keep the registration history of the Owners Personal Data for the period established by law or regulatory rule or for the preservation of rights.

Grupo Master adopts appropriate technical and organizational measures in line with current market standards to protect Personal Data against privacy incidents that are frequently updated to maintain the global level of security.

Under the terms of the General Law on Personal Data Protection and in accordance with its internal rules on personal data protection, Grupo Master will take all available measures to mitigate the consequences of any Privacy Incident that may cause relevant risk or damage, always ensuring due transparency to the holder of personal data.

Grupo Master may change the content of this Policy at any time, as needed, as well as for adequacy and compliance with legal or regulatory provision. Therefore, we recommend that you visit this page periodically to learn about the changes made.

If there is any doubt about the conditions established in this Policy or any document of Grupo Master, please get in touch through Grupo Masters service channels.

If any provision of this Policy is considered illegal or illegitimate by the authority of the place where the Holder resides or of his Internet connection, the other conditions will remain in full force and effect.

The Holder acknowledges that all communication carried out by email (to the addresses provided by him), SMS, instant communication applications or any other digital, virtual and digital form are also valid as documentary evidence, being effective and sufficient for the disclosure of any subject that refers to the activities and services provided by the Master Group, as well as to the conditions of their provision, with the exception of the expressly diverse provisions set forth in this Policy.

If you have any questions or would like to comment on our Policy, please email us. Contact responses will be sent Monday through Friday (excluding holidays) during bank hours. The Data Protection Officer (DPO) of Grupo Master will be available through the following communication channel: dpo@bancomaster.com.br

The Data Protection Officer (DPO) of Grupo Master will be available through the following communication channel: dpo@bancomaster.com.br