Privacy Policy

1. Who we are and scope of this Policy

Pushfy is the brand operated by OMNILINK TECNOLOGIA E COMUNICACAO LTDA, a private legal entity registered with the CNPJ/MF (Brazilian corporate taxpayer registry) under No. 65.889.259/0001-80, headquartered at Alameda Rio Negro, nº 503, Sala 2020, Alphaville Centro Industrial e Empresarial, Barueri/SP, CEP 06454-000 (“Pushfy”, “we”). Pushfy is a provider of Communications Platform as a Service (CPaaS) and Software as a Service (SaaS). Through our platform, customer companies send and receive communications with their own end users across multiple channels, such as SMS, RCS, voice, e-mail, push notifications, webchat and messaging apps.

We believe that the responsible use of personal data underpins relationships of trust between brands, partners and consumers. This Privacy Policy describes, transparently, which personal data we process, for what purpose, with whom we share them, how long we keep them and what your rights are. It applies to the website, the Pushfy Portal, our APIs and all the services we provide (“Services”).

This Policy was drafted in compliance with the Lei Geral de Proteção de Dados (Brazil's General Data Protection Law), Law No. 13.709/2018 (“LGPD”), and other applicable regulations. Where required, we will provide additional and specific privacy notices.

2. Definitions

Customer

The company (or individual) that contracts Pushfy's Services.

Account user

A person authorized by the customer to access and use the Pushfy Portal or the APIs on the customer's behalf.

Business contact

A person who represents the customer or acts as a point of contact between the customer and Pushfy.

End user

A person who receives or sends communications through our platform in the context of their relationship with our customer.

Controller

The party that decides the purposes and means of the processing of personal data.

Processor

The party that processes personal data on behalf of and under the instructions of the controller.

3. Our roles: processor and controller

3.1. When we act as processor

Our customers integrate the Services into their operations through their own applications (via API) or the Pushfy Portal. When transmitting our customers' communications to their end users, we act as processor: we process the data exclusively on the customer's behalf, within the limits of its instructions and in accordance with the Services agreement and/or data processing agreement entered into with it. We have no direct relationship with our customers' end users.

3.2. When we act as controller

We are controller when we process personal data for our own purposes, for example to manage customer accounts, invoice, provide support, ensure the security of the platform and comply with legal obligations. The following sections describe these activities.

4. What personal data we process

4.1. Customer relationship data

• Account data: registration, authentication, financial and billing information necessary to maintain the business relationship.
• Business contact data: contact and professional information of customers' representatives and employees.
• Support data: customer service and support communications, including the content of requests and tickets.

4.2. Communications-related data

• Communication content: text, voice, audio, video, documents or images exchanged between the customer and its end users through the Services.
• Traffic data: data processed for the transmission and charging of a communication, for example the type, routing, duration and time of the communication, as well as its origin and destination (including the end user's telephone number or e-mail address, depending on the channel used).
• Delivery and engagement data: sending and delivery status and technical interactions with the message (for example, delivery confirmation, read or click), when the channel makes such information available.

4.3. Usage data

Information generated during use of the Services: IP addresses, access and activity records on the platform (logs), routing information and technical device and browser data. Application access records are also kept in compliance with the Marco Civil da Internet (Brazilian Internet Civil Rights Framework, Law No. 12.965/2014).

4.4. How we collect

• Directly from you (for example, at registration, when using the portal or in contacts with our team);
• From the organization you represent, when it is our customer;
• From our customers, who provide us with their end users' contact data for the transmission of communications;
• Automatically, during the transmission of communications and use of the platform;
• From verification and due diligence service providers, where applicable.

5. Purposes and legal bases

We process personal data, as controller, for the purposes and on the legal bases below:

When processing is based on legitimate interest, we weigh our interests against your fundamental rights and freedoms, and you may object to such processing (Section 12).

The content of communications is processed exclusively on the customer's behalf, in our capacity as processor, in accordance with its instructions (Section 3.1).

6. With whom we share data

We do not sell personal data. As a rule, we do not share personal data with third parties, except when strictly necessary and under the principle of necessity.

• Telecommunications carriers and communication service providers: to the extent necessary for the routing, connectivity and delivery of the communications contracted by our customers, on any channel and in any destination location.
• Service and technology providers: that carry out specific activities on our behalf (for example, infrastructure, payment processing, customer service tools). Before engaging any supplier, we carry out a security and privacy assessment; when the supplier acts as our sub-processor, the processing is governed by a written data processing agreement, and the supplier is periodically reassessed.
• Pushfy group companies: subsidiaries and affiliates, as part of regular operations, under internal data processing and transfer agreements.
• Public authorities: when required by law, judicial proceedings, an order of a competent authority or a regulatory request (including record retention and disclosure obligations applicable to communication providers), as well as auditors and tax authorities to demonstrate accounting, financial and tax compliance.
• Parties to corporate transactions: in the event of a merger, acquisition, sale of assets or similar transaction, your data may be transferred as part of the transaction, as permitted by law, with the safeguards of this Policy maintained.

7. International transfers

Our Services enable the delivery of communications on a global scale. For this purpose, personal data may be transferred outside Brazil, for example to carriers and communication providers in the destination country of the message, or to infrastructure providers located abroad.

When we carry out international transfers, we adopt the safeguards provided for in arts. 33 et seq. of the LGPD, such as: transfer to countries with an adequate level of protection, specific contractual clauses or standard contractual clauses approved by the ANPD (Brazil's National Data Protection Authority) (Resolution CD/ANPD No. 19/2024), and contractual guarantees that the recipient ensures a level of protection equivalent to that required by Brazilian legislation.

8. How long we keep data

At the end of these periods, data are securely deleted or anonymized, unless additional retention is required by law or by a competent authority, or is necessary for the regular exercise of rights (Section 11).

9. How we protect data

Security and privacy go hand in hand at Pushfy. We continuously invest in technical and organizational measures aligned with international information security best practices (including controls inspired by the ISO/IEC 27000 family of standards), among them:

• Encryption of communications in transit (TLS) and protection of access credentials;
• Role-based access control, segregation of duties and the principle of least privilege;
• Logical segregation of data by customer (multi-tenancy) on the platform;
• Logging and monitoring of activities (audit trails) and abuse and fraud detection mechanisms;
• Backup routines and continuity plans;
• Vulnerability management and periodic security assessments;
• Ongoing privacy and security training for the entire team, starting at onboarding;
• Security and privacy assessment of suppliers before engagement and periodic reassessments.

No system is absolutely immune to risk; for this reason, we maintain continuous improvement and incident response processes (Section 10).

10. Security incidents

We maintain a security incident management and response process. If a security incident occurs that may entail relevant risk or harm to data subjects, we will notify the Autoridade Nacional de Proteção de Dados (ANPD, Brazil's National Data Protection Authority) and the affected data subjects, under art. 48 of the LGPD and the Security Incident Reporting Regulation, Resolution CD/ANPD No. 15/2024, which sets a deadline of 3 (three) business days, counted from knowledge of the incident, for notification to the ANPD and to the affected data subjects. The notification will include a description of the nature of the affected data, the related risks and the measures adopted.

11. Specific retention and legal obligations

The periods in Section 8 are our general rule. In certain circumstances, we may retain data for a different period, when:

• Required by specific legislation (for example, tax, accounting or telecommunications regulations or the Marco Civil da Internet);
• Ordered by a competent authority or necessary to cooperate with investigations;
• Necessary for the regular exercise of rights in judicial, administrative or arbitration proceedings, in which case access to the data is restricted until the case is concluded.

12. Your rights as a data subject (LGPD)

Under the LGPD, you may, at any time and upon request:

• Confirm the existence of processing of your personal data;
• Access your data and request a copy of them;
• Correct incomplete, inaccurate or outdated data;
• Request the anonymization, blocking or deletion of unnecessary or excessive data or data processed in non-compliance with the LGPD;
• Request the portability of your data to another service or product provider, subject to commercial and industrial secrets;
• Request the deletion of data processed on the basis of your consent, except in the cases of retention provided for by law;
• Obtain information about the public and private entities with which we share your data;
• Be informed about the possibility of not giving consent and about the consequences of refusal;
• Revoke consent at any time, without affecting the lawfulness of processing carried out before the revocation;
• Object to processing carried out on a legal basis other than consent, in the event of non-compliance with the LGPD;
• Request a review of decisions made solely on the basis of automated processing that affect your interests;
• Petition the ANPD and consumer protection bodies.

For Pushfy's own marketing communications, you may unsubscribe at any time through the link included in the messages or through our customer service channels.

We will respond to requests within the time limits and in the formats provided for in the applicable legislation. We may request additional information to confirm your identity before fulfilling the request, as a security measure.

13. Our customers' end users and opt-out

If you receive messages sent by one of our customers through our platform, the customer is the controller of your data: it is the customer that defines the purpose of the sending and the legal basis for the contact. We recommend that you exercise your rights directly with the company that communicates with you. Requests received by Pushfy in this capacity will be forwarded to the responsible customer.

Unsubscribe (opt-out): we offer end users opt-out mechanisms on the channels where this is technically supported, for example by replying to the message with the word indicated for unsubscribing or by using the link/exit option available in the message itself. Opt-out requests are recorded and applied to subsequent sends made through our platform for that sender.

14. Cookies and similar technologies

We use cookies and similar technologies:

• Essential cookies: necessary for the operation of the website and the Pushfy Portal (for example, authentication and session maintenance). Without them, the Services do not work properly;
• Analytics and performance cookies: used to understand the use of our pages and improve the experience, where applicable;
• Advertising cookies: when used in our marketing activities, respecting the options you have configured.

You can manage cookies in your browser settings, including blocking or deleting them. Blocking essential cookies may impair the operation of the Portal.

15. Automated decisions

We employ automated mechanisms to operate the platform securely and efficiently, for example message routing, fraud, spam and abuse prevention filters, and technical sending validations. When a solely automated decision affects your interests, you may request a review under art. 20 of the LGPD, through the channels indicated in Section 18.

16. Children and adolescents

Pushfy's Services are intended for businesses (B2B) and are not directed at children or adolescents. We do not knowingly collect personal data from persons under 18 years of age. Our customers are responsible for ensuring that their campaigns and communications comply with the legislation applicable to their audience, including sector-specific age restrictions. In particular, customers operating in the fixed-odds betting sector are solely responsible for observing the prohibitions on communication, advertising and acquisition directed at persons under 18 years of age set forth in Law No. 14.790/2023 (Brazil's regulated betting law) and in the regulations of the Secretariat of Prizes and Bets of the Ministry of Finance (SPA/MF), refraining from directing any messages to minors through our platform. If we identify inappropriate processing of minors' data, we will take the appropriate deletion and blocking measures.

17. Changes to this Policy

We may update this Policy periodically to reflect legal, regulatory or operational changes. The current version will always be available on this page, with the date of the last update indicated at the top. In the event of material changes, we will notify customers through the usual channels (for example, e-mail or a notice on the Portal).

18. Data Protection Officer (DPO) and contact

For the purposes of the LGPD, Pushfy has appointed a Person in Charge of Personal Data Processing (Encarregado, Data Protection Officer or DPO), who acts as a communication channel between Pushfy, data subjects and the ANPD.

Additional customer service channels are available on the Pushfy Portal and on our website. You also have the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) and with consumer protection entities.