--- title: "Privacy Policy and Terms of Use" description: "This document explains how Cumbuca Instituição de Pagamento LTDA. collects, processes, stores and protects user data. It applies to all Cumbuca services and governs the rights and duties of users and of the institution, in accordance with Brazilian Law No. 13,709/2018 (LGPD)." url: "https://www.cumbuca.com/en/privacy" lang: "en" --- # Privacy Policy and Terms of Use Regulatory · LGPD. This document explains how Cumbuca Instituição de Pagamento LTDA. collects, processes, stores and protects user data. It applies to all Cumbuca services and governs the rights and duties of users and of the institution, in accordance with Brazilian Law No. 13,709/2018 (LGPD). - **Version:** 1.0 - **Last updated:** August 2025 - **Published:** 21 Apr 2026 > Courtesy translation. The Portuguese version is the legally binding document. ## About Cumbuca Cumbuca is a payment institution regulated by the Central Bank of Brazil, acting as a payment initiator in the Open Finance ecosystem. For the purposes of this policy, the controller's contact and registration details are: - **Legal name:** CUMBUCA INSTITUIÇÃO DE PAGAMENTO LTDA. - **CNPJ (tax ID):** 44.353.942/0001-29 - **Privacy:** privacidade@cumbuca.com - **Support:** suporte@cumbuca.com - **Ombudsman:** ouvidoria@cumbuca.com · 0800 715 8075 ## Data collected Cumbuca collects the following categories of data, always tied to a specific purpose described in the next section: ### Personal data (individuals) Full name, CPF, ID document, date of birth, address, email, phone, professional data, nationality and parental data. ### Business data (legal entities) Legal name, CNPJ, NIRE, incorporation date, legal representatives' data, revenue and asset information. ### Financial data Bank balances, transaction history, credit card data, investment records, credit operations and foreign exchange operations, always under specific consent. ### Technical data IP address, device characteristics, cookies, geolocation, browser information, FIDO2 signatures and device identifiers. ### Behavioral data Transaction patterns, usage logs, authentication attempts and risk signals used for fraud prevention and account protection. ## Purposes of processing Data is processed exclusively for the following purposes: - User identification and authentication - Provision of payment initiation services (Pix, scheduled, recurring, Pix Automático) - Data sharing via Open Finance, only with explicit consent - Fraud prevention and security monitoring - Compliance with legal and regulatory obligations - Service improvement and personalization - Credit analysis and risk assessment, where applicable - Communication about services and updates ## Data sharing Data may be shared only when necessary to provide the contracted services or to comply with a regulatory obligation. ### Internal sharing Companies in the economic group, subsidiaries and contractually authorized business partners. ### External sharing Financial institutions, payment processors, infrastructure providers (Amazon Web Services), analytics platforms (Google Analytics) and competent regulatory authorities, such as the Central Bank of Brazil (BCB) and the National Data Protection Authority (ANPD), among others. ### Condition Sharing only takes place when **necessary for the activities and products offered**, with prior notice to the user where legally required. ## Storage and security Data is stored on **Amazon Web Services (AWS)** cloud infrastructure, with access controls restricted to authorized personnel who undergo periodic cybersecurity training. ### Technical measures - TLS/SSL encryption on all communications - Mandatory HTTPS for access to the platforms - Advanced encryption for banking credentials and private keys - FIDO2 and OpenID Certified standards for authentication - Information security policies reviewed periodically ### Retention Data is retained for the period **necessary to fulfil the stated purposes** or to comply with a specific legal or regulatory obligation. ## Data subject rights (LGPD) In accordance with Law No. 13,709/2018, the data subject may exercise the following rights: 1. **Confirmation** of the existence of data processing 2. **Access** to the data processed 3. **Correction** of incomplete, inaccurate or outdated data 4. **Anonymization, blocking or deletion** of unnecessary data, subject to legal obligations 5. **Portability** to another provider, except for content protected by trade secrets 6. **Withdrawal of consent** at any time 7. **Information** about sharing with public and private entities 8. **Explanation** of the consequences of granting or denying consent Any of these rights can be exercised by written request to [privacidade@cumbuca.com](mailto:privacidade@cumbuca.com) or through the Customer Portal. Cumbuca responds within **10 business days**. ## Consent and withdrawal Cumbuca operates on three types of consent: - **LGPD consent**, authorization to process personal data under Law 13,709/2018 - **Open Finance consent**, specific approval to share financial data between institutions - **Payment authorization**, permission to initiate Pix transactions (one-off, scheduled or recurring) Withdrawal is allowed at any time, through the Customer Portal or the same channel used to grant it. **Withdrawal takes immediate effect on future transactions**, with no retroactive effect on transactions already initiated. ## Special categories ### FIDO2 data Collected and processed for users of biometric Pix, contactless Pix and the Redirect-free Journey (JSR), used **exclusively for authentication and fraud prevention**. ### Credit data (SCR) Information from the Central Bank's credit registry may be shared upon explicit consent, for personalized credit product offers. ### Employee data Employer name and job title collected for profile analysis and identity verification. ### Minors' data Processed only when the minor is a dependent or beneficiary, in the **best interest of the child** and never for marketing purposes. ## Prohibited uses Users must not: - Violate applicable laws or regulations - Assume a false identity - Share illegal, offensive or harmful content - Infringe intellectual property rights - Transmit malware or disruptive code - Carry out financial activities without the required regulatory authorization - Use the service for money laundering or terrorism financing - Attempt to circumvent security mechanisms Non-compliance authorizes Cumbuca to suspend or block access without prior notice, notifying the competent authorities where applicable. ## Governing law and jurisdiction This document is governed by the laws of the Federative Republic of Brazil. The courts of the **District of São Paulo, SP** are chosen to settle any disputes, without prejudice to the consumer's right to file suit in the courts of their own domicile, under the Consumer Protection Code. ## Contact - **Privacy / LGPD rights:** [privacidade@cumbuca.com](mailto:privacidade@cumbuca.com) - **Technical support:** [suporte@cumbuca.com](mailto:suporte@cumbuca.com) - **Ombudsman:** [ouvidoria@cumbuca.com · 0800 715 8075](mailto:ouvidoria@cumbuca.com) - **Address:** São Paulo, SP, Brazil ## Changes to this policy Cumbuca may modify this policy at any time. Updates are published with an explicit modification date. Continued use of the services after publication of the new version constitutes acceptance of the new terms, with no retroactive effect on consents already granted. --- ## About Cumbuca CUMBUCA Instituição de Pagamento Ltda., registered with the National Registry of Legal Entities of the Ministry of Finance (CNPJ/MF) under No. 44.353.942/0001-29, is authorized as a Payment Institution (IP), in the Payment Transaction Initiator (ITP) modality, regulated by the Central Bank of Brazil, pursuant to BCB Resolution No. 80 of March 25, 2021, and is a subsidiary of FAMÍLIA CUMBUCA HOLDING Ltda., registered with the CNPJ/MF under No. 32.670.659/0001-41. CUMBUCA Serviços de Tecnologia Ltda., registered with the CNPJ/MF under No. 50.271.185/0001-47, is also part of the same corporate group. - [This page in HTML](https://www.cumbuca.com/en/privacy) - [Site index for LLMs (llms.txt)](https://www.cumbuca.com/llms.txt) - [Sitemap](https://www.cumbuca.com/sitemap.xml)