Privacy Policy

HawkPay LTDA, registered under CNPJ 59.052.328/0001-02, headquartered at Rua Pedro da Costa Correia, 570, Várzea Alegre, Ribeirão das Neves – MG, ZIP 33805-570, Brazil, is a multi-vertical financial and digital services company operating across a broad range of regulated activities.

Our registered CNAEs reflect the full scope of our activities:

This Privacy Policy describes how we collect, use, store and protect the personal data of our clients, partners, users and visitors, in full compliance with the Brazilian General Data Protection Law (LGPD – Law No. 13,709/2018).

Given the breadth of our activities, we may collect different categories of personal data depending on the service or interaction:

• Identification data: full name, CPF/CNPJ, date of birth, ID document numbers.
• Contact data: email address, phone number, physical and billing address.
• Financial data: bank account details, payment history, credit information, debt records — collected strictly for financial auxiliary, collection and intermediation services.
• Commercial data: purchase history, product preferences and retail transaction records for e-commerce and apparel retail operations.
• Marketing data: campaign interaction history, click data, lead source and promotional engagement records for direct marketing activities.
• Digital data: browsing behavior on our portals, content consumption patterns and internet session data.
• Corporate data: company information, shareholder data and governance documents for holding and intermediation services.
• Browsing data: IP address, browser type, device identifiers, pages visited and session duration.
• Communication data: messages sent via contact form, email, phone and other channels.

We use personal data collected across our service lines for the following purposes:

• Delivering contracted financial auxiliary, intermediation and collection services;
• Processing retail purchases, payments and order fulfillment (apparel and accessories);
• Operating internet portals and delivering digital content to registered users;
• Managing corporate participations and holding-level governance;
• Executing sales promotion campaigns and direct marketing programs on behalf of clients;
• Providing business agenciamento and intermediation between parties;
• Conducting credit information and accounts receivable management activities;
• Issuing invoices, notas fiscais and fulfilling fiscal and tax obligations;
• Communicating with clients, partners and users about services and updates;
• Improving our platforms, services and internal processes;
• Protecting the legitimate interests and legal rights of HawkPay LTDA.

Due to our multi-sector operations, we may share data with different categories of recipients depending on the service:

• Financial institutions and payment processors: for payment facilitation, credit analysis and financial transaction processing;
• Credit bureaus and information registries: for credit information services and collection activities, as legally permitted under applicable regulation;
• Retail logistics and fulfillment partners: for apparel product delivery and reverse logistics;
• Marketing and advertising platforms: for campaign execution and audience targeting on behalf of clients, under data processing agreements;
• Group companies and portfolio entities: for holding governance, financial coordination and group-level reporting;
• Business counterparts: for intermediation and agenciamento services, with explicit consent where required;
• Service providers: CRM, ERP, hosting, analytics and IT providers under strict confidentiality and data processing obligations;
• Regulatory and public authorities: Banco Central do Brasil, Receita Federal, PROCON, ANS and others when required by law, regulatory obligation or court order.

All sharing is based on legal grounds established by the LGPD (contract performance, legal obligation, legitimate interest or explicit consent).

Our websites, portals and digital platforms may use cookies and similar tracking technologies, including:

• Essential cookies: required for basic platform functionality and security;
• Analytics cookies: to understand user behavior and improve our digital services (e.g. Google Analytics);
• Marketing cookies: for campaign tracking, retargeting and conversion attribution across our promotional services;
• Session cookies: for maintaining authenticated user sessions on portal and e-commerce platforms.

You may configure your browser to refuse cookies or delete existing ones. This may affect the functionality of some platform features. Where required by law, we request your consent before setting non-essential cookies.

Retention periods vary by data category and applicable legal requirements:

• Financial and credit data: retained for the period required by BACEN, Receita Federal and applicable financial regulation (generally 5–10 years);
• Commercial and retail records: minimum 5 years for fiscal and consumer protection compliance;
• Marketing campaign data: retained for the duration of the campaign plus 2 years for performance reporting;
• Collection and credit information: as required by the applicable regulation and agreements with credit bureaus;
• General contact and communication data: for the duration of the relationship plus applicable statute of limitations;
• Digital and portal session data: as required for platform operation and regulatory compliance.

After applicable retention periods expire, data is securely deleted or irreversibly anonymized in accordance with LGPD requirements.

Under the Brazilian General Data Protection Law (Law No. 13,709/2018), you hold the following rights regarding your personal data processed by HawkPay LTDA:

• Confirmation and access: to confirm whether we process your data and obtain a copy;
• Correction: to request update of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion: of unnecessary, excessive or unlawfully processed data;
• Portability: to receive your data in a structured, interoperable format;
• Deletion of consent-based data: withdrawal of consent with consequent deletion where applicable;
• Objection: to processing carried out on the basis of legitimate interest where your rights outweigh our interests;
• Information about sharing: to know with which entities we share your data;
• Review of automated decisions: to request human review of decisions made solely through automated processing.

We implement a comprehensive set of technical and organizational security measures, including:

• Encrypted connections (HTTPS/TLS) across all digital platforms and communications;
• Role-based access controls limiting data access to authorized personnel only;
• Multi-factor authentication on internal systems handling personal and financial data;
• Encrypted storage for sensitive financial and credit information;
• Regular security assessments, penetration testing and vulnerability management;
• Staff training on data protection and security best practices;
• Incident response procedures aligned with LGPD notification requirements.

In case of a security incident that may represent relevant risk or damage to data subjects, we will notify the Brazilian National Data Protection Authority (ANPD) and affected individuals within the legally established timeframes.

Our websites, portals and digital platforms may contain links to third-party sites, partner platforms or affiliated services. This Privacy Policy applies exclusively to HawkPay LTDA's own digital environments. We recommend reviewing the privacy policy of any third-party site you visit through our platforms.

Given the dynamic nature of our multi-sector operations and the evolving regulatory landscape, this Privacy Policy may be updated periodically. The date of the most recent update is always indicated at the top of this document. For material changes, we will communicate proactively with affected users and clients where required by law. Continued use of our services after the publication of changes constitutes acceptance of the revised version.

For any questions, requests or complaints regarding this Privacy Policy or your personal data, please contact us:

• Company: HawkPay LTDA
• CNPJ: 59.052.328/0001-02
• Address: Rua Pedro da Costa Correia, 570, Várzea Alegre, Ribeirão das Neves – MG, ZIP 33805-570, Brazil