Privacy Policy
Last updated: October 27, 2026
This Policy explains how [COMPANY LEGAL NAME] ("VupiCard") processes personal data in accordance with the EU General Data Protection Regulation (GDPR), the Brazilian General Data Protection Law (LGPD), the California Consumer Privacy Act (CCPA) where applicable, and other relevant laws.
1. Controller and Data Protection Officer
The data controller is [COMPANY LEGAL NAME], [COMPANY REGISTRATION NUMBER], [REGISTERED OFFICE ADDRESS]. Data Protection Officer contact: [email protected].
2. Data we collect
- Identification and contact data: name, date of birth, nationality, ID document number, address, email and phone number.
- Biometric data: facial image (selfie) for liveness checks and fraud prevention.
- Financial and transaction data: balances, transactions, payment details, source of funds and card usage.
- Technical data: IP address, device identifiers, approximate location, access logs and cookies.
- Communications: messages exchanged with support.
3. Purposes and legal bases
- Opening and maintaining your account and providing the services — performance of a contract;
- Identity verification, anti-money laundering, sanctions screening and regulatory obligations — compliance with a legal obligation;
- Fraud prevention and security — legitimate interests;
- Product improvement and service communications — legitimate interests;
- Marketing — consent, which you may withdraw at any time.
4. Sharing
We share data only to the extent necessary with: partner financial, payment and card-issuing institutions; identity verification and fraud prevention providers; card networks; cloud and technology providers; and public authorities, when required by law. We do not sell personal data.
5. International transfers
As a global service, data may be transferred to other countries. In such cases we implement appropriate safeguards, such as standard contractual clauses and providers offering an adequate level of protection.
6. Retention
We keep data for as long as necessary for the purposes described and for the period required by anti-money laundering laws (generally at least 5 years after the end of the relationship).
7. Security
We apply technical and organizational measures such as encryption in transit and at rest, access controls, multi-factor authentication and continuous monitoring.
8. Your rights
You may request: confirmation of processing and access to your data; correction; anonymization, restriction or deletion of unnecessary data; portability; information about sharing; withdrawal of consent; and objection to processing. Some requests may be limited by legal retention obligations. Send your request to [email protected]. You may also lodge a complaint with the competent data protection authority.
9. Cookies
See our Cookie Policy.
10. Minors
Our services are not intended for anyone under 18, and we do not knowingly collect their data.
11. Changes
This Policy may be updated from time to time. The date of the last update is shown at the top of this page.