I - OWNERSHIP

Pursuant to the provisions of Law 13,709/2018 (“General Data Protection Law”), this Privacy Policy (hereinafter, the “Policy”) regulates access to and use of the personal data held by GLOBAL EXCHANGE DO BRASIL SOCIEDADE CORRETORA DE CAMBIO LTDA. (hereinafter Global Exchange), recorded in the National Register of the Ministry of the Economy (“CNPJ/ME”) under No. 21.040.668/0001-32, under NIRE No. 35.228.436.078, at Avenida Vinte de Janeiro, S/N, Terminal 2, Área de Embarque, porta D, Galeão, postcode 21941-570.

II – CONTACT

II.1 For any queries concerning the way in which Global Exchange processes personal data, please contact us via our contact form or by telephone 0800 745 1505; Global Exchange will endeavour to respond to you as soon as possible.

II.2 The Customer may also request the deletion of his/her data at any time. To do so, simply send your request to Global Exchange, at the email address in the above clause. Global Exchange will endeavour to respond to you as soon as possible.

III – ACCEPTANCE OF THE POLICY

III.1 The Customer’s acceptance of this Policy is essential in order to access and employ the functions of the service provided by Global Exchange. The Customer’s free, express, unequivocal and informed consent, without reservations, is required with regards to the content of this Policy, whether digitally by clicking “I ACCEPT”, at the time of making the reservation on the Global Exchange website, or physically, as applicable, by signing this Policy.

III.2 By accepting this Policy, the Customer hereby declares that he/she is aware that he/she is solely responsible for all information provided to Global Exchange, whether electronically or in person at a physical store, in addition to the images, documents and any other material made available, assuming responsibility, including with third parties, for any damages resulting from the provision of incorrect, incomplete or inaccurate information.

III.3 The Customer hereby recognises that the inclusion of any inaccurate, false or distorted information will result in the enforcement of the applicable sanctions under Brazilian law, including criminal punishments.

IV – GLOBAL EXCHANGE ACTIVITIES

IV.1 The services provided by Global Exchange on its website and its physical points of sale across Brazil, in addition to the way in which they are provided and promoted, comply with the rules of the Central Bank of Brazil, which regulate exchange activities in Brazil, in particular with regards to Resolutions No. 1,770/1990 and 3,568/2008.

IV.2 Finally, Global Exchange is required to comply with anti-money laundering and terrorist financing regulations, as set out in Brazilian and international legislation. Under this policy, certain restrictions on the exercise of your rights may apply.

V – COLLECTION OF PERSONAL DATA

V.1 Global Exchange will collect the following data for each type of service/request:

(a) CURRENCY EXCHANGE AND SERVICES: Data provided for the provision of services by Global Exchange. These services shall be identified this data is collected and registered.

Data collected: First name, last name, identity number, contact address, address, email address, contact telephone number and other data needed in line with the service requested, which will only be necessary for registering for Global Exchange’s services.

Objective: the registration of data subjects for the provision of services and to establish and maintain commercial relations.

Legitimacy: the existing legal or contractual relationship required to provide the service and the legitimate interest to develop commercial relations.

Storage periods: the data shall be stored for the period required in order to process it and, once this period is over, they shall be available to the public authorities and the courts for the legally defined periods in order for any liabilities that may arise as a result of processing to be managed or defended.

(b) SALES CONTACT: in response to contact requests and queries received by any means, Global Exchange services, and the maintenance of commercial relations:

Data collected: Name, telephone number, email address and query.

Objective: Respond to requests for information that the data subject makes using any means concerning Global Exchange’s products and services, and establishing and maintaining commercial relations.

Legitimacy: Based on the provision of your consent, Global Exchange retains the right to process the information of the data subject provided in the contact request, and based on the legitimate interest, to develop and maintain commercial relations.

Storage periods: the data shall be stored until the data subject requests the cancellation or deletion of his/her data and, once deleted, they shall be available to the public authorities and the courts for the legally defined periods in order for any liabilities that may arise as a result of processing to be managed or defended.

(c) CV OR WORK: submission of CVs via the website or by email, post or in person to Global Exchange.

Data collected: professional area, first name, last name, telephone number, email address, CV, cover letter and any other personal data associated with the CV or professional profile.

Objective: manage the candidacy of the data subject for selection processes published or other vacant posts based on his/her professional profile that may arise in the future as part of Global Exchange’s activities.

Storage periods: the data will be stored until the data subject is assigned to a vacancy or until he/she asks us to delete them. Therefore, the data will be stored for as long as necessary to process them and, once complete, they shall be available to the public authorities and the courts for the legally defined periods in order for any liabilities that may arise as a result of processing to be managed or defended.

Legitimacy: provision of consent by the data subject.

Recipients: The data provided and involved in the selection process may be transferred to third parties identified by the data subject to request references that may be needed to select the candidate.

(d) PROMOTIONAL MATERIAL or NEWSLETTERS: sending information, news, notifications, reminders and promotions that may be of interest to the data subject concerning Global Exchange's activities.

Data collected: Email address, first name and last name.

Objective: registration of data subjects to send information, news and promotions and to establish and maintain commercial relations.

Legitimacy: provision of the data subject’s consent to Global Exchange to register promotional services and legitimate interest for the development of commercial relations.

Storage periods: the data shall be stored until the data subject requests the cancellation or deletion of his/her data and, once deleted, they shall be available to the public authorities and the courts for the legally defined periods in order for any liabilities that may arise as a result of processing to be managed or defended.

(e) CUSTOMERS/SUPPLIERS: Professional personal data provided by Customers/Suppliers for the provision of services and management of the contractual or legal relationship.

Data collected: First name, last name, identification number, professional contact address, email address, contact telephone number.

Objective: management of the contractual relationship of the service.

Legitimacy: the legal or contractual relationship needed to provide the service.

Storage periods: the data shall be stored for as long as necessary to process them or delete them, and once complete or deleted, they may be stored for a period of six years, available to the public authorities and the courts for the legally defined periods in order for any liabilities that may arise as a result of processing to be managed or defended.

(f) ACCESS CONTROL AND SECURITY: Data collected by CCTV cameras:

Data collected: Images.

Objective: control access and the management of internal security at Global Exchange facilities.

Legitimacy: the owner’s legitimate interest in guaranteeing the security of the facilities, justifying the fact that the images are captured when accessing these facilities

Storage periods: The data shall be stored for a maximum of one month, unless they must be stored for a longer period, as appropriate in order to clarify any breach or unlawful act detected.

VI – DATA SUPPLIED

VI.1 The data collected by the different means are strictly necessary to respond to the request and are communicated voluntarily by the Customer.

VI.2 Refusing to provide data classed as mandatory shall result in the non-provision or the inability to access the service for which they were requested. Data may also be provided on a voluntary basis to guarantee that the services are provided in the best possible way.

VI.3 Likewise, for cases in which third-party data are provided, the Customer is required to inform these third parties of the content of this Policy.

VI.4 The Customer commits to informing Global Exchange as soon as possible of any change or amendment to his/her personal data, in order for the information contained in the records of Global Exchange’s activities to always be up to date.

VI.5 Based on Global Exchange’s legitimate interest, the Customer's personal data may be used to establish or maintain commercial relations by any means, including electronic means, in relation to information of interest related to Global Exchange’s products and services, and the Customer may, at any time, oppose this processing for commercial purposes by sending a written notice to the correspondence address provided, or by sending a message via our contact form.

VII - PROCESSING OF PERSONAL DATA AND SECURITY MEASURES

VII.1 By means of the sales channels at physical stores or on the website, Global Exchange shall collect and store the information that may be provided by the Customer that are necessary for the service provided.

VII.2 All data collected by Global Exchange is considered confidential. Thus, Global Exchange and its partners hereby commit to making all the reasonable market efforts to preserve the security of the systems used to store this data, including compliance with the guidelines on security standards established under Decree No 8,771/2016.

VII.3 System security is applied physically, electronically and procedurally to collect, store and publish the Customer’s personal information.

VII.4 To ensure the security of personal information, [Secure Sockets Layer (SSL) software] is used when transferring information, which encrypts the information included.

VIII - DATA TRANSFERRING AND PROCESSING

VIII.1 The Customer’s personal data shall not be transferred to any third party unless there is a legitimate legal basis for doing so (i.e. legal relationship, court and/or administrative request, etc.).

VIII.2 The Customer acknowledges that Global Exchange may share the data collected with third parties under the following circumstances:

In case of corporate transactions and changes involving Global Exchange, in which case, the information shall be transferred to continue with the provision of the service; or,

By court order or at the request of the administrative authorities who are legally entitled to make such a request; or

For the provision of services, including processors contracted by Global Exchange to process data, provided that the third parties implement the corresponding technical and organisational measures to guarantee the protection of the data subject’s rights.

VIII.3 The Customer’s personal data may be transferred abroad to service providers, mainly to the providers of cloud storage services (iCloud) (i.e. AWS.) The servers used by these providers shall be located in Brazil.

VIII.4 However, in the event that the servers are located outside Brazil, Global Exchange shall guarantee that personal data is processed with the same level of protection as would be the case if they remained in Brazil.

VIII.5 Data is communicated to third parties for the provision of outsourced services, including processors with whom Global Exchange has entered into data processing contracts and verified that they have sufficient guarantees to implement the corresponding technical and organisational measures, in such a way that the data is processed pursuant to the requirements of Law 13,709/2018, guaranteeing the protection of the data subject’s rights.

IX – EXERCISE OF THE CUSTOMER’S RIGHTS

IX.1 Global Exchange guarantees the Customer, with regards to the processing of his/her data, the following rights:

For any downtime, errors and/or faults that may affect the website or the sales channels at physical stores, including any fraudulent use that the Customer may make when verifying the aforementioned locations, given their fallability or any access difficulty experienced;

a anonimização, bloqueio ou eliminação de dados desnecessários, excessivos ou tratados em desconformidade com a legislação brasileira aplicável, mediante requisição expressa feita pelo Cliente;

que não sejam transferidos a qualquer terceiro, sem embasamento legal ou autorização expressa, os dados pessoais do Cliente, salvo nos casos previstos nesta Política.

X - EXEMPTIONS FROM LIABILITY

X.1 Notwithstanding the other exemptions from liability indicated in this Policy, the Customer hereby declares that he/she is aware that Global Exchange shall not be responsible:

Por quaisquer indisponibilidades, erros e/ou falhas eventualmente apresentados pelo site e nos canais de vendas das lojas físicas, inclusive por qualquer defraudação de utilidade que o Cleinte possa ao verificar nestes locais mencionados, pela sua falibilidade, ou por qualquer dificuldade de acesso enfrentada;

anonymisation, blockage or deletion of unnecessary or excessive data or data not processed in compliance with the applicable Brazilian legislation, when expressly requested by the Customer;

For any errors and/or inconsistencies in the transfer of data, whether related to the quality or availability of the Internet connection that may affect the correct receipt of information by Global Exchange or the Customer;

For outdated, incomplete or inaccurate data that may be submitted by the Customer to Global Exchange and/or any resulting damages;

For any use of the information provided on the website or through sales channels at physical stores that fails to comply with the provisions of this Policy and the applicable legislation in force; and for all damages resulting from an awareness that unauthorised third parties may have access to any data provided, whether via the website or sales channels at physical stores, as a result of a fault exclusively attributable to the Customer or third parties that are beyond the reasonable control of Global Exchange.

XI – GENERAL PROVISIONS

XI.1 Any clause or condition of this Policy that, for any reason, is deemed null and void by any Court shall not affect the validity of the other provisions of this Policy, which shall remain in full effect and binding, having effect to the fullest permitted extent.

XI.2 The failure of Global Exchange to exercise any rights or provisions in this Policy shall not constitute a waiver and this party shall retain the right to exercise its rights within the legal terms.

XI.3 The Customer may access this Policy at any time, on Global Exchange’s website, and acknowledges that the Policy may have been amended at any time, as it is not prohibited from doing so. In such a case Global Exchange shall inform the Customer of any changes on its website.

XI.4 This legal relationship shall be governed solely by Brazilian legislation, including any lawsuits that may be filed as a result of a breach of this Policy and conditions.

XI.5 The Customer’s jurisdiction shall be used to resolve any queries, complaints or lawsuits resulting from this Policy, with the parties hereby expressly waiving any other to which they may be entitled.

Please inform an email related to Serviços de Atendimento ao Cliente (“SAC”) in Brazil.

As per the Decree No. 6,523/2008 that regulates the Consumers Protection Law, fixing general rules regarding the call centers (SAC).

 

Please see comment above related to Serviços de Atendimento ao Cliente – “SAC” in Brazil.