Legal

Data Privacy Policy

Effective date: April 2025 · Version 002 — External · Permanent nature; refer always to the latest version.

Your privacy is very important to us. We are committed to respecting the confidentiality of information and individuals’ privacy. This Policy outlines how Trace Finance processes personal data in compliance with current laws and regulations. It applies to the processing of personal data from clients, potential clients, job applicants, visitors to Trace Finance offices, websites and platforms, suppliers, and partners.

1. Introduction and glossary

To make this document easier to understand, we’ve included definitions of key terms below:

• LGPD: the Brazilian General Data Protection Law. It introduces protective principles and rules for how companies handle individuals’ data, giving you more privacy, freedom, transparency, and control over your personal data.
• Personal Data: any information related to a natural person that can identify or make them identifiable in a given context — e.g. name, tax ID, passport number, address, phone number, email, and IP address.
• Sensitive Data: information related to racial or ethnic origin, religious beliefs, political opinions, union membership, health, sexual life, genetic or biometric data, when linked to a person.
• Processing: the ways Trace Finance uses personal data, including collection, storage, consultation, sharing, classification, reproduction, processing, and analysis.
• Legal Grounds: legal justifications that allow Trace Finance to process personal data, such as your consent or compliance with legal obligations.
• Data Subject: you — the individual to whom the personal data refers (a client, a client’s representative, or a job applicant).
• Platform or Website: the websites and applications owned by Trace Finance.

2. Information security

Trace adopts technical and organizational procedures to ensure that your information is always secure. We regularly train and raise awareness among all our employees about the importance of maintaining, safeguarding, and respecting your personal information. We take data privacy violations very seriously, constantly monitor for breaches, apply appropriate disciplinary measures, and maintain technological infrastructure to prevent data leaks.

3. What data does Trace Finance collect?

Data may be provided through forms, surveys, email, websites, mail, applications, phone calls, contracts, or by submitting personal documents.

Types of data collected

Personal data is requested for identification and qualification purposes depending on the specific use case:

• Registration data such as name, email, phone number, gender, home address, CPF (tax ID), identification document, date of birth.
• Financial data such as average monthly income and net worth.
• Professional data such as professional experience, current employer and job title, education, and languages.
• Sensitive data such as ethnicity or whether the person has a disability.
• Operational data such as documents involved in the use of our services.

Purpose of data collection

• Registration and operations: to allow your registration and access to our products and services, such as the global banking platform and foreign exchange operations. Some data is required to comply with legal obligations; other data ensures your account’s security.
• Work with us: we use our website and LinkedIn to publicize open positions so you can apply.
• Contact us: we ask for basic contact information (name and email or phone) so you can reach our support team.

4. Why does Trace Finance collect and use your personal data?

I. To create your account. We need to verify your identity and qualifications to validate you as a client, as we have a legal obligation to comply with “Know Your Customer” (KYC) regulations and other requirements related to the Fraud Prevention Program.

II. To provide the contracted services. Once your account is opened, we use your personal data to perform our services and fulfill our obligations — processing orders and executing the purchase and sale of products and services as requested, based on our contractual relationship with you.

III. To comply with legal obligations. Various legal requirements (financial services legislation, tax laws, etc.) and oversight by regulatory authorities require us to process personal data for identity verification, compliance with court orders, tax laws, and other regulations.

IV. To send communications and satisfaction surveys. From time to time we may send communications and satisfaction surveys as part of our customer feedback process. It is in our legitimate interest to gather this feedback to deliver our services at the highest standard.

V. To analyze behavior on our websites. Our websites may contain analytics tools to understand user behavior and ensure quality. The information collected is anonymized and not linked to any identifiable user, so it is not considered personal data under the LGPD.

VI. For marketing purposes. We may use your personal data to send marketing communications (email, phone, or other agreed methods, including social media) based on your consent. If you do not wish to receive marketing materials, notify us and we will promptly remove your email from our marketing database.

VII. To ensure asset protection and physical safety. If you visit our facilities, we may record your image through our surveillance systems for security and collect information to provide access credentials.

IX. To prevent fraud and ensure data subject security. We process personal data for fraud analysis and prevention, to protect data subjects from potential crimes and intrusion attempts, and to ensure the security of our assets.

X. To protect legitimate interests. Examples include initiating legal claims and preparing our defense; analyzing financial transactions to generate strategic reports; implementing monitoring systems at our facilities; business management and development of new products; and reviewing and updating your personal data in anti-money-laundering compliance.

XI. To manage relationships with third parties. We verify identity and qualifications to validate third parties, in line with “Know Your Employee” and “Know Your Supplier” best practices and our Integrity Program.

5. Legal bases used by Trace Finance

• Consent: processing based on the data subject’s free, informed, and unambiguous agreement for a specific purpose. For sensitive data, consent must be given explicitly and specifically for each purpose.
• Legitimate interest: processing (even without consent) where necessary to serve the legitimate interests of Trace or third parties, provided it does not conflict with Brazilian legislation and your rights and transparency are respected.
• Contract execution: processing necessary to perform a contract or preliminary procedures at the data subject’s request, including in employment relationships.
• Compliance with legal or regulatory obligation: processing required by law or regulation, especially in regulated sectors such as financial services, healthcare, and insurance.

6. Sharing of personal data

Trace Finance will not disclose its clients’ personal data to third parties, except: to comply with applicable laws, rules, or regulations; where there is a legal obligation to disclose; when there is a legitimate interest requiring disclosure; or at the client’s request, with their consent.

Any organization outside of Trace Finance that handles or accesses personal data must recognize its sensitivity, respect all individual privacy rights, and comply with all relevant data protection laws. Situations in which we may share your personal data include:

• Third-party commercial service providers and consultants — Trace acts as an intermediary for account opening and foreign exchange correspondence, so registration and operational data is shared with partners that perform these services. When opening a global account, information may be sent to a different jurisdiction, where data processing laws may differ from the Brazilian LGPD.
• Specialized third parties hired for administrative, financial, legal, security, research, and other services.
• Third parties performing auditing tasks.
• Business partners, credit providers, courts, supervisory bodies, and regulatory authorities.
• Payment service providers and/or financial institutions for generating and managing payments.
• Business partners such as payment companies who may store your data to comply with their own legal obligations.
• Any person or company, provided we have your consent.

Trace Finance is not responsible for the use of cookies by third parties; such cookies may continue to track your activity after you leave our website. You can delete cookies manually via your browser settings, though deleting certain cookies may render some website features unavailable.

7. Data retention period

Your personal data is stored only for as long as necessary to fulfill the purposes for which it was collected, unless there is another legal reason to retain it (legal, regulatory, or contractual obligations). For example, data related to financial transactions carried out within the Brazilian National Financial System must be stored for 10 (ten) years, as required by the Central Bank of Brazil.

8. Your rights as a data subject

Your personal data belongs to you, and the Brazilian General Data Protection Law (LGPD) guarantees you the following rights:

• Confirmation and access: confirm whether we process your personal data and request a copy of what we hold.
• Correction: request the correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion: request that we anonymize, temporarily block, or completely delete your data — except where the law requires otherwise.
• Data portability: request that we provide your data to you or a third party in a structured, interoperable format, provided it does not violate Trace Finance’s intellectual property or trade secrets.
• Information on sharing: know which public and private entities we share your data with.
• Information about the option not to consent: receive clear information about the possibility and consequences of not giving consent.
• Withdrawal of consent: withdraw consent at any time (this does not affect processing carried out before the withdrawal).
• Objection: object to processing carried out without consent under certain conditions and request that it be stopped.

9. Contact information

We have appointed a professional responsible for matters related to this Privacy Policy and data protection. If you have questions about accessing your data or exercising your rights, please contact us through our LGPD Channel: forms.gle/kQAay2uZujyyWmAD7

10. Legal notice

Trace Finance is not responsible for the misuse or loss of personal data to which it does not have access or control. We are also not liable for the illegal or unauthorized use of such information resulting from the misuse or compromise of your login credentials, negligence, or malicious conduct, whether caused by you or by someone authorized to act on your behalf.

By signing up you agree to our Terms of Service and Privacy Policy, to all applicable laws and regulations, and agree that you are responsible for compliance with any and all applicable local laws. Please be advised that the services and products provided by PIX Inc. are not available to, intended for, or marketed to individuals or entities residing in, incorporated in, or operating from the United Kingdom. PIX Inc. does not solicit clients in the UK jurisdiction.