Privacy and Personal Data Protection Policy of QYON SOFTWARE LTD. and other companies that make up the Qyon Business Group

The Privacy and Personal Data Protection Policy of QYON SOFTWARE LTD. and other companies that make up the Qyon Business Group, which includes its controlling and controlled companies, directly or indirectly, as well as its affiliates and companies under common control in Brazil (“QYON”) was created to describe and inform the processes of collection, use, sharing and storing personal data, in order to inform data subjects of their rights and ensure that such data is treated securely and subject to a transparent privacy policy.

Qyon Software Ltd is an agent of Plaid Financial Ltd., an authorised payment institution regulated by the Financial Conduct Authority under the Payment Services Regulations 2017 (Firm Reference Number: 804718). Plaid provides you with regulated account information services through Qyon Software Ltd as its agent.

1. Definitions
The following terms beginning with capital letters contained in the QYON Privacy and Personal Data Protection Policy will have the meanings assigned below, in accordance with the Brazilian General Personal Data Protection Law, Law No. 13,709/2018:

Processing agents: the controller and the operator.
Controller: natural or legal person, governed by public or private law, who is responsible for decisions regarding the processing of personal data.
Personal Data: any and all information related to a natural person that allows the identification of its holder.
Sensitive Personal Data: personal data on racial or ethnic origin, religious conviction, political opinion, membership of a trade union or organization of a religious, philosophical or political nature, data relating to health or sexual life, genetic or biometric data, when linked to a natural person.
LGPD: Brazilian General Personal Data Protection Law, Law No. 13,709/2018.
Operator: natural or legal person, governed by public or private law, who processes personal data on behalf of the controller.
Policy: QYON Privacy and Personal Data Protection Policy.
Holder: natural person to whom the personal data that is subject to processing refers.
Processing: any operation carried out with personal data, such as those relating to collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation or control of information, modification, communication, transfer, diffusion or extraction.

2. Application
The Policy applies to all services and products provided and offered by QYON. From time to time, QYON may develop new products and/or services or offer additional services and/or products. If the introduction of such new or additional services and/or products results in any material change in the way in which we collect or process personal data, we will provide additional information, conditions or policies. Except as otherwise indicated when new or additional products and/or services are introduced, they will be subject to this Policy.

This Policy applies to natural persons who have a relationship with QYON, through the provision of personal data (whether in the case of providing personal data to contact QYON in their own name or as representatives of a legal entity).

This Policy is also applicable to other forms of personal data collection by QYON, which allow the provision or improvement of our services. For example, we may collect information through partners or relating to our technologies. All forms of collection and use of your personal data are described in this Privacy Policy.

The practices described in this Policy only apply to the processing of your personal data in Brazil and are subject to applicable local laws, with emphasis on the LGPD.

2.1 EU/UK Representative and Data Protection Officer

For individuals located in the European Union or the United Kingdom, QYON has appointed a local representative for data protection matters:

EU/UK Representative: QYON Software Ltd – UK Office, 2 Lakeside Drive, 6th Floor, Office 6062, London, England – NW10 7FQ. Email: eu-uk-representative@qyon.com. Phone: +44 20 4538 2020

QYON has also appointed a Data Protection Officer (DPO), who can be contacted for any questions regarding the processing of your personal data: Data Protection Officer: QYON DPO Office. Email: dpo@qyon.com. Phone: +44 20 4538 2020

3. Data Collection
When accessing QYON’s virtual page, requesting, hiring or using QYON’s products or services, some personal data is provided and collected, which may be processed by QYON, according to its purpose. In some cases, the data is provided directly by the Holder, but it is also possible that some Personal Data is collected automatically, as specified below.

The Holder must only provide true, current and accurate personal data, being solely responsible for false, outdated or inaccurate information provided to QYON.

Data provided by the Holder includes all information voluntarily entered or provided on the Platform, such as: personal data of the user/holder (name, identification documents, nationality, profession, address, date of birth, gender, contact details, bank details); personal data appearing in electronic tax documents (invoices, service invoices, waybills, etc.); personal data in financial documents (invoices, receipts transmitted to banks); and data of users’ employees, contractors, representatives or vendors.

Browsing and device data include IP address, URL, network connection, device attributes, cookies, operating system, browser, and geolocation data if authorized.

Personal data may also arise from the use of QYON platforms (emails, attachments, documents from third-party integrations). Public data may be collected from government and official sources.

4. Purposes of Processing Personal Data
QYON uses personal data collected to provide products and services, ensure security of its platforms, and comply with legal and regulatory obligations. The purposes include: complying with regulatory obligations, exercising the right of defense, complying with judicial or administrative decisions, verifying identity and preventing fraud, performing contractual obligations, handling complaints and support, using cookies, and maintaining updated records.

Sensitive data will only be collected in cases of legal or regulatory obligation.

QYON does not knowingly collect data from children and adolescents. If such data is identified, parents or guardians may request deletion.

4.1 Automated Decision-Making and Profiling

QYON may use automated decision-making systems, including profiling, for purposes such as fraud prevention, credit risk assessment, and service personalization. These processes involve algorithms analyzing personal data, which may affect outcomes such as the approval of financial transactions or access to certain services.

Whenever automated decision-making is applied, you have the right to obtain human intervention in the decision-making process, express your point of view, contest the decision, and request further explanation regarding the applied logic and potential consequences. To exercise these rights, contact privacy@qyon.com.

5. Data Subject Rights
QYON undertakes to comply with legal standards applicable to the processing of data, based on principles of transparency, purpose, adequacy, necessity, accuracy, safety, prevention and non-discrimination.

The holder may exercise rights by contacting QYON through lgpd@qyon.com.br or +55 (19) 2660-2579. Rights include: confirmation of processing; access; correction; anonymization, blocking or deletion of unnecessary or excessive data; data portability; deletion of data processed with consent (except legal obligations); obtaining information about data sharing; information about consequences of not providing consent; revocation of consent; objection to processing in certain cases; and review of decisions based solely on automated processing.

In addition, data subjects have the right to object to the processing of their personal data when such processing is based on legitimate interests, the right to object to the processing of their data for direct marketing purposes at any time, and the right to file a complaint with the local supervisory authority. In the United Kingdom, complaints can be submitted to the Information Commissioner’s Office (ICO) at www.ico.org.uk. In the European Union, complaints can be submitted to the Data Protection Authority in the individual’s country of residence.

6. Storage and Deletion of Personal Data
The personal data of holders will be kept for no longer than necessary to fulfill the purposes for which they are processed, observing applicable legal or regulatory deadlines. Whenever possible, data will be anonymized.

7. Recipients and Transfer of Personal Data
Personal data may be shared with research bodies, government authorities, and private entities with contractual relationships with QYON, provided the purposes are maintained. Data may be transferred internationally only to countries or organizations ensuring adequate protection. If not, QYON will apply strict contractual clauses or corporate standards to safeguard data.

8. Cookies and Similar Technologies
QYON may collect information about services used and how they are used to improve functionalities. This includes geolocation data, usage information, and log data. Technologies such as cookies are used to store navigation data. Users can manage or disable cookies in device settings, though some may be necessary for proper functionality.

9. General Provisions
For further information or communication regarding this Privacy Policy, holders may contact QYON through customer channels or www.qyon.com.

QYON must ensure compliance with laws and court decisions and provide personal data to authorities when required.

This Privacy Policy was updated on January 12, 2021. QYON reserves the right to change this Policy, available at www.qyon.com. Holders who have provided an email address will be notified in case of changes.