1. Who we are and what this Policy does
1.1. LEXXEN LTDA, CNPJ 63.987.111/0001-53, with its registered office at Rua 15, nº 721, Quadra H12, Lote 12, Sala 1, Setor Marista, Goiânia/GO, CEP 74.150-020 ("Lexxen"), is the controller of the personal data processed through its platform.
1.2. This Policy explains which data we collect, why, with whom we share it, for how long we retain it and what your rights are.
1.3. It applies to Users, website visitors, representatives of corporate clients, job applicants, partners and suppliers.
1.4. It supplements the Terms of Use (www.lexxen.com/terms) and the Cookie Policy.
2. Data Protection Officer (DPO)
2.1. Data Protection Officer: Siffermann Sociedade Individual de Advocacia, Thiago de Oliveira Rocha Siffermann (OAB/GO 40.724), compliance@lexxen.com.
2.2. The Data Protection Officer is the channel for exercising rights, clarifying questions and receiving communications from the ANPD (Brazil's National Data Protection Authority), pursuant to Article 41 of the LGPD.
3. Roles in the processing
This section defines who is responsible for what. It matters because Lexxen operates by integrating services provided by regulated third parties.
| Agent | Role | What it means |
|---|---|---|
| Lexxen | Controller | Decides the purposes and means of the processing of its Users' data |
| Partners (payment institutions, VASPs (virtual asset service providers), card issuers) | Independent controllers | Process the data to comply with their own regulatory obligations, under their own policies |
| Contracted suppliers (identity verification, cloud, anti-fraud, communications) | Processors | Process the data exclusively under Lexxen's instructions, under contract |
3.1. When data is shared with a Partner, that Partner becomes responsible for the processing it carries out for its own regulatory purposes. The relationship between the User and the Partner is governed by that institution's privacy policy.
3.2. The list of Partners and processors is set out in the Partners Annex, at www.lexxen.com/privacy/partners.
4. Data we process
4.1. Data you provide
| Category | Examples |
|---|---|
| Identification (individuals) | full name, CPF (taxpayer number), RG (identity card) or CNH (driver's license), date and place of birth, nationality, parentage, photo of the identity document |
| Identification (legal entities) | corporate name, CNPJ, articles of association, ownership structure, ultimate beneficial owner, revenue |
| Contact | e-mail, telephone, address |
| Financial | bank details, PIX key, source and destination of funds, income or revenue, declared assets |
| Biometric | facial image for liveness check and matching against the identity document |
| Tax | information required for ancillary tax obligations |
4.2. Data collected automatically
IP address, device identifiers, operating system, browser, approximate geolocation, pages accessed, access times, application logs (Internet Civil Framework, Article 15) and browsing behavior data used for fraud detection.
4.3. Data from third parties
Credit and anti-fraud bureaus, public databases (Brazilian Federal Revenue Service, Commercial Registries, courts), national and international sanctions lists, lists of Politically Exposed Persons (PEP), adverse media and information received from Partners regarding transactions.
4.4. Sensitive data
4.4.1. We process biometric data (facial image), which constitutes sensitive data under Article 5, II, of the LGPD, exclusively for identity verification, liveness check and fraud prevention.
4.4.2. Legal basis: compliance with a legal and regulatory obligation by the controller (Article 11, II, "a") and fraud prevention and the security of the data subject (Article 11, II, "g").
4.4.3. We do not process sensitive data concerning racial origin, religious belief, political opinion, trade union membership, health or sex life.
4.5. Children and adolescents
The platform is intended for persons aged 18 or over. We do not knowingly collect data from minors. If improper processing is identified, the data will be deleted. Communications: compliance@lexxen.com.
5. Why we process data and on what legal basis
The LGPD requires a legal basis for each purpose. Most of what we do does not depend on your consent; it derives from a legal obligation or from the performance of the contract.
| Purpose | Legal basis (LGPD) |
|---|---|
| Creating and maintaining your account; carrying out the contracted transactions | Performance of a contract: Article 7, V |
| Identity verification (KYC/KYB) and onboarding qualification | Legal/regulatory obligation: Article 7, II and Article 11, II, "a" |
| Prevention of money laundering and terrorist financing; reporting to COAF (Brazil's financial intelligence unit) | Legal obligation: Article 7, II |
| Sharing identification and beneficiary data with Partners, including in real time | Legal obligation: Article 7, II (CMN Resolution No. 5.261/2025, BCB Resolution No. 518/2025) |
| Traceability of virtual asset transactions (Travel Rule) | Legal obligation: Article 7, II (Law No. 14.478/2022, the Brazilian Virtual Assets Law) |
| Fraud prevention and detection; platform security | Legitimate interest: Article 7, IX / Article 11, II, "g" |
| Compliance with a court order or an order from a public authority | Legal obligation: Article 7, II |
| Retention of access logs | Legal obligation: Article 7, II (Internet Civil Framework, Article 15) |
| Exercise of rights in legal proceedings | Article 7, VI |
| Support, customer service and service improvement | Performance of a contract: Article 7, V / legitimate interest: Article 7, IX |
| Marketing communications and offers | Consent: Article 7, I (revocable at any time) |
| Non-essential cookies | Consent: Article 7, I |
5.1. Where the legal basis is legitimate interest, we carry out a documented impact assessment and balancing test, which are made available to the ANPD upon request.
5.2. Where the legal basis is consent, you may withdraw it at any time, without prejudice to the processing already carried out and to processing supported by other legal bases.
⚠️ Important: withdrawing marketing consent does not interrupt the processing required by law, such as KYC, AML and traceability, which continues for as long as the relationship lasts and for the statutory retention periods.
6. With whom we share data
6.1. We share personal data only when necessary and with the following categories:
| With whom | For what purpose |
|---|---|
| Partner payment institutions | opening and maintaining an individual account in the User's name; executing payments |
| Partner VASPs | executing and safekeeping virtual asset transactions |
| Card issuers and card networks | issuing, processing and settling transactions |
| Partners abroad | maintaining international accounts in the User's name |
| Identity verification providers | KYC, KYB, liveness check, sanctions lists |
| Anti-fraud and security providers | risk analysis and fraud prevention |
| Infrastructure and cloud providers | hosting and processing |
| Public authorities | COAF, the Central Bank, the Federal Revenue Service, the Judiciary, law enforcement authorities |
| Legal and accounting advisors and auditors | defense of rights and legal obligations |
| Acquirer in a corporate reorganization | continuity of services, subject to notice |
6.2. We do not sell personal data and we do not share it for third-party behavioral advertising.
6.3. The named and up-to-date list of Partners and processors is set out in the Partners Annex, at www.lexxen.com/privacy/partners. New Partners will be added to the list, and material changes will be communicated.
6.4. Pursuant to Joint Resolution No. 6/2023, identification and transaction data may be shared with participating institutions for the processing and exchange of information on indications of fraud.
7. International transfer
7.1. Part of the processing takes place outside Brazil: at cloud providers, at identity verification providers and at Partners responsible for international accounts and virtual assets.
7.2. Transfers comply with Article 33 of the LGPD and rely on: (i) specific or standard contractual clauses for protection; (ii) necessity for the performance of the contract between you and Lexxen; (iii) compliance with a legal obligation; (iv) your specific consent, where applicable.
7.3. We require recipients to provide safeguards compatible with the LGPD.
8. How long we retain data
| Data | Period | Grounds |
|---|---|---|
| Registration and KYC | 5 years after the end of the relationship | Law No. 9.613/1998 (the Brazilian Anti-Money Laundering Law), Article 10, III |
| Transaction records | 5 years after the transaction | Law No. 9.613/1998 / BCB regulations |
| Application access logs | 6 months, at a minimum | Internet Civil Framework, Article 15 |
| Tax and accounting documents | 5 years | tax legislation |
| Contract and billing data | 5 years after termination | Civil Code, Article 206 |
| Data for defense in legal proceedings | until the decision becomes final and unappealable | LGPD, Article 7, VI |
| Marketing data | until withdrawal of consent | LGPD, Article 8, §5 |
8.1. Once the period has elapsed, the data is deleted or anonymized, unless there is a legal obligation to retain it for a longer period.
8.2. Regulatory retention periods prevail over deletion requests; the LGPD provides for this exception in Article 16, I.
9. Your rights
9.1. Pursuant to Article 18 of the LGPD, you may request:
- Confirmation of the existence of processing
- Access to your data
- Correction of incomplete, inaccurate or outdated data
- Anonymization, blocking or deletion of unnecessary or excessive data, or of data processed in non-compliance with the law
- Portability to another provider, subject to ANPD regulations
- Deletion of data processed on the basis of consent
- Information on the entities with which we share your data
- Information on the possibility of not giving consent and the consequences of doing so
- Withdrawal of consent
- Review of automated decisions that affect your interests
- Objection to processing based on legitimate interest
9.2. Requests: compliance@lexxen.com. We will respond within 15 (fifteen) days, pursuant to Article 19, II, of the LGPD. We may request additional information to confirm your identity, a security measure to prevent improper disclosure to third parties.
9.3. Some rights are subject to legal limits. We cannot delete data that we are required to retain by law or regulation, nor interrupt processing required by a legal obligation. In such cases, we will respond by stating the grounds.
9.4. You may lodge a complaint with the National Data Protection Authority (ANPD).
10. Automated decisions
10.1. We use automated systems for: onboarding risk analysis, AML risk profile classification, fraud detection, identity verification and transaction monitoring.
10.2. These analyses may result in refusal of registration, limitation of features, blocking of a transaction or termination of the relationship.
10.3. You may request a review of these decisions through the Data Protection Officer channel, pursuant to Article 20 of the LGPD, and submit additional elements for reassessment.
10.4. The review may be limited where disclosure of the criteria would compromise the effectiveness of anti-fraud and AML controls or reveal trade secrets, in which case we will inform you of the general reasons for the decision.
11. Information security
11.1. We adopt technical and organizational measures compatible with the nature of the data, including: encryption in transit and at rest, least-privilege access control, multi-factor authentication, environment segregation, audit logging, continuous monitoring, vulnerability management and periodic staff training.
11.2. Contractually, we require processors to maintain compatible security standards.
11.3. No system is entirely immune. You contribute to security by keeping your credentials under your exclusive control, keeping MFA enabled and keeping your devices up to date.
11.4. Incidents. In the event of a security incident that may give rise to a relevant risk to data subjects, we will notify the ANPD and the affected data subjects within a reasonable period, in accordance with Article 48 of the LGPD and the Authority's regulations, describing the nature of the incident, the data involved, the measures adopted and the recommendations to the data subject.
12. Cookies
The use of cookies and similar technologies is described in the Cookie Policy, at www.lexxen.com.
13. Changes to this Policy
13.1. This Policy may be updated. Material changes will be communicated with at least 30 (thirty) days' notice through the official channels.
13.2. Previous versions will remain available for consultation.
14. Channels
| Purpose | Channel |
|---|---|
| Data Protection Officer (DPO) | Siffermann Sociedade Individual de Advocacia, Thiago de Oliveira Rocha Siffermann (OAB/GO 40.724), compliance@lexxen.com |
| Support | support@lexxen.com |
| Compliance and whistleblowing | compliance@lexxen.com |
| Partners Annex | www.lexxen.com/privacy/partners |
LEXXEN LTDA, CNPJ 63.987.111/0001-53 Goiânia/GO, August 31, 2026, version 1.0