Unlimit and its group companies or businesses are part of a global payments and technology organisation holding various licenses and authorizations as each business is obliged to under the laws and regulations it operates in.
Unlimit Brasil Instituição de Pagamento Ltda (“Unlimit” or “we” or “us” or “Company”) provides our merchants with payment services and the platforms and applications (“platforms”) through which credit card payments services and other alternative payment methods are offered (“payment services”) to merchants.
The purpose of this Privacy Notice is to provide you with information on how Unlimit processes your personal data when you correspond, apply or establish relations with us as a customer, partner or merchant or when you use our corresponding services and website.
This Privacy Notice sets out our current policies and commitment to data protection and privacy. In line with this, we aim to collect and process only personal data strictly necessary in the context of our relationship with customers and merchants (collectively referred to as “Customers” or “you”) and online resources, in order to provide services and/ or information for specific and legitimate purposes.
Unlimit while providing it’s services to you is committed to appropriate use and protection of personal data in respect with Law No. 13.709 of 14 August 2018, Lei Geral de Proteção de Dados (‘LGPD’) any amending or replacing Brazil legislation adopted with regard to the protection of Personal Data (“data protection law”).
If you are looking for a privacy notice in respect of another jurisdiction/country please select the country of choice on www.unlimit.com.
What this Notice tells you
This Notice contains a description of:
1. Scope and General Provisions; 2. Why do we process personal data; 3. When do process personal data; 4. What types of personal data do we process; 5. What are the purposes for processing your personal data; 6. Who do we share your personal data with; 7. Automated decision making and profiling; 8. Website and Automatic collection — Cookies and IP addresses; 9. What are your rights and how to raise a complaint; 10. How long we keep your personal data; 11. How we keep your personal data secure; 12. Your responsibilities; 13. How do we tell you when we change this Notice.
This Notice should be read together and in conjunction with the relevant Terms and Condtions of the service/product (as applicable) provided by Unlimit.
In this Notice:
If you are an end-user of a Customer’s services or product (like a payer or a shopper), we act as a processor for the Customer and we recommend that you review the privacy policies of the Customer. If you want to know how we process any of your personal data as a processor on the instructions of the Customer, then this Notice applies.
Some links on Unlimit websites may contain links or lead/originate to/from non-Unlimit websites or areas with their own data protection policies, which may differ from our Privacy Notice. Please ensure that the relevant policies of other entities are acceptable to you prior to using other sites or areas. Unlimit does not accept any responsibility or liability for third party websites. Additionally, if you are not a data subject to whom this Notice is addressed, please refer to the privacy policy of the relevant data controller entity of your personal data to learn more about how the entity processes it.
For us to be able to provide our services to our Customers, we require that the Customer shares information (including certain personal data) requested by us for the following grounds:
Unlimit, as a provider of payment services and payment methods to Customers of services often acts as a processor of personal data in respect to these businesses, who are the responsible parties as controllers for your personal data and its processing.
Various types of personal data are collected and processed in the context of the relationship arising between you and Unlimit and according to the service/product used and your capacity. Indicatively, the following are examples of categories and types of personal data may be processed:
Your personal data is processed with the data minimization principle in mind. We aim to limit the processing of your personal data to what is needed for a lawful purpose. The Company uses personal data, amongst others, to:
Legal bases — Lawful reasons for processing
When we process your personal data, we will rely on one of the processing legal bases below. We may process your personal data for more than one legal basis depending on the specific purpose for which we are using your data.
Conclusion and performance of a contract
This is when processing of personal data is needed to conclude a service contract with you and/or perform our obligations under a contract (to provide services) concluded with Customers. This is also processing in the course of the application to be able to complete our acceptance process of a potential Customer to be able to enter into a contract.
Legal obligation or for public interest
This is when we are required to process your personal data to comply with a legal obligation. Unlimit is subject to various legal obligations, legal and regulatory requirements which include AML Laws and Laws on provision of payment services among others. We are also required to implement regulations and directives of competent supervisory authorities of Unlimit’s business. The purposes of processing include verification controls of identity, money laundering and fraud prevention, compliance with our record reporting obligations, tax obligations, risk control measures, as well as providing information to a competent authority, public body or law enforcement agency.
Legitimate interests
Where necessary, we may process personal data where there is a legitimate interest for us or a third party in pursuing commercial and business interests, except where such interests are overridden by your interests, fundamental rights and freedoms.
Your consent
In particular circumstances, we may ask you for specific permission to process personal information for specific purposes. Your data will be processed in this way if you agree to this. Where the legal basis is the consent you provided, you may withdraw your consent any time. The revocation of your consent will not affect the legality of the data processed prior to the revocation.
We have set out below for in a table format, an indicative description for your convenience, of the ways we may use your personal data as set out above, and which of the legal bases we may rely on to do so; we have also identified what our legitimate interests are and may be where appropriate.
To review Customer’s application
Legal Obligation
Record Keeping
Legal obligations during the review of an application
To identify, examine, prosecute and prevent crime or fraud
To verify Customer and identify his (continued) eligibility for the requested services and ability for management of the account
To manage risk internally for the Company and externally for the Customers
To comply with applicable laws and regulations
To provide information to authorities upon request
To respond and solve complaints and data subject requests
Performance of contract
Legitimate Interest
Compliance with applicable regulations governing the provision of Company’s services
Cooperation with authorities at a national and international level
To fulfill our legal and contractual obligations
To deliver the requested products and services
To execute and manage Customer’s payment orders and to perform our obligations arising from Customer’s transaction
To apply on the Customer’s account any fees and charges;
To collect any due funds
To communicate with the Customer and provide information
Company’s interest in providing the requested services at a satisfactory and anticipated level
Record Keeping maintenance
and business ability, communication channels and organizational planning
To fulfill its legal and contractual obligations
To communicate with Customers and provide support to meet Customer’s needs
To manage relations of the Company with counterparties, partners, and service providers
To develop and improve products and services and to define applicable charges
To identify the target market
To manage our cooperation with other service providers
To analyze Customers, and efficiency of operation of products and services
To launch and test new products
To develop new products and expand its business
For Marketing activities
To fulfill legal and contractual obligations
To exercise rights set out in agreements
To inform the Customer in relation to any changes to the Terms and Conditions of the services provided
Unlimit shares your personal data to carry out your requests, to provide our services and perform our business or as may be required by applicable laws.
Third parties under these circumstances include:
Service providers
We will disclose personal data to third-party partners and service providers (processors) so they can process it on our behalf where required and under our instructions. These service providers are required to provide sufficient assurances in accordance with data protection law. (e.g., being bound contractually to confidentiality and appropriate data protection obligations). We will only share personal data necessary for them to provide their services.
Auditors, advisors and consultants
We may disclose personal data for purposes and in the context of audits (e.g. external audits, security audits), to legal and other advisors, in order to investigate security issues, risks, complaints etc.
As such, personal data may be transferred and disclosed to:
Internal
Entities which are affiliated/related to us that are bound to equivalent data protection obligations as us. We may disclose your personal data to those companies to:
Regulatory authorities, law enforcement, courts
We may disclose personal data to comply with applicable legislation, regulatory obligations, to respond to requests of regulatory authorities, government and law enforcement agencies, courts and court orders in Brazil, such as:
Transfers outside Brazil or to international organisations
We are a company with a global reach. Your personal data may be processed locally in the Brazil, or in another country where we or our partners operate worldwide, as permitted by law. Your personal data may be transferred from the Brazil or from another country that restricts transfers of personal information to third countries or to international organizations if the transfer is necessary and has a legal basis as described in this notice. Such transfers take place for example:
Should data movement take place, we may use the standard contractual clauses for restricted transfers (as amended or when made available by the Brazil Data Protection Agency (ANPD)) or other locally-compliant mechanisms (such as local transfer agreements orconsent) to ensure that an adequate or equivalent level of protection is appliable to personal data as the one in the country of origin.
We aim to take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Notice (e.g., requirement to observe privacy standards equivalent to ours, maintaining security standards and procedures to prevent unauthorised access, use of technology such as encryption and firewalls) to protect the security of data in transit and at rest.)
Automated decision-making means the process of making decisions through automated means of processing personal data, without human intervention. In establishing and carrying out a business relationship, we do not generally use automated decision-making.
We may process some specific data automatically, by using systems to make automated suggestions or decisions, including profiling, based on information we have or collect from other authorized sources. This helps us ensure we are able to react quickly and efficiently, with an aim also to protect our Customers. Automated decisions we may make include:
Detecting fraud: We are required to take anti-money laundering and anti-fraud measures. We may use your personal data to help us decide if an account/payment instrument is potentially being used for purposes of fraud or money-laundering/terrorist financing or sanctions contraventions. Such assessments are carried out in order to help us detect if an account/payment instrument is being used in ways fraudsters work or in a way unusual for you or the business of our Customer. If we determine there is a risk of fraud, unauthorized use, unusual activity, we may stop activity on the account/block the payment instrument and/or refuse access to them.
You, as a data subject, have the right under Article 20 of the LGPD to request for the review of decisions made solely based on automated processing of personal data affecting your interests. Should you wish to exercise this right, please contact us.
Unlimit’s website contains forms which may be used by website visitors. When website visitors send us information online via forms on the website, in the context of provision of services, the information will be used for purposes and in ways set out in the Privacy Notice.
If you send us a CV/resume through our Website, your personal data is processed in terms of our Talent Acquisition Privacy Notice accessible on Unlimit’s careers page. Please read it should you require more information.
In some instances, Unlimit and other entities (such as service providers) may use cookies and other technologies to collect certain types of data automatically when you visit Unlimit websites and online platforms. The collection of this data enables Unlimit to improve security, usability of Unlimit’s websites and online resources and to measure effectiveness of marketing activities. We may collect information about your computer or mobile device (including for example type of operating system and browser) for system administration.
For detailed information on cookies and the purposes for which we use them, please refer to our Cookie Notice available on our website.
An IP address is a number assigned to your computer when you access the internet, which allows computers and servers to recognize and communicate with one another. IP addresses of website visitors may be recorded for IT security and diagnostic purposes. This information may also be used in aggregate form to conduct website trend and performance analysis. In the context of provision of services, IP addresses may also be used for the purposes and in ways set out in with the Privacy Notice including fraud prevention.
Depending on the applicable law, you may have rights as afforded under applicable data protection law – these rights are afforded to natural persons who are data subjects of personal data which we hold as a controller. We ensure that you may exercise your rights under applicable privacy and data protection laws, which means that Unlimit endeavours to provide reasonable assistance in respect to requests from individuals regarding processing of personal data, rights to access, deletion, amendment etc.
Please note that your rights are not absolute and may be limited due to a legal basis replied upon by us to process your personal data. As the majority of processing we perform is a consequence of legal obligations, some of the rights may be limited by our legal and regulatory requirements or legitimate interests.
Depending on the applicable laws, you may have certain rights under data protection law. For example, under the LGPD you have the following rights:
Processing is conducted on the lawful ground of legitimate interest or of serving the public interest; however you object on grounds relating to your particular situation;
In such a case, we may continue processing if we demonstrate that we have compelling legal grounds for processing which override your rights or that processing is necessary to establish, exercise of defend a legal claim;
Please note that despite your objection, we may continue to use your personal data. This will be in cases where processing is required in compliance with legal obligations imposed on us (the requirements of legal obligations to process and retain data will supersede any right to objection.);
Processing is conducted for marketing purposes;
In certain circumstances, if you objection to the processing of certain personal data, we may not be able to provide you services and may need to terminate provision of services.
Processing is no longer required for the reasons the data was collected or processed;
We are relying on consent as a legal basis, and you withdraw your consent;
You have objected to the processing of data;
The data has been unlawfully processed (i.e. breach of legal basis requirement);
Required by law;
We may continue to retain you data if another legitimate reason for doing so exists;
Our requirements to comply with legal obligations (record-keeping requirements in particular) to process and retain certain data will supersede any right to erasure requests, and we may also continue to retain/use your data if another legitimate reason for doing so exists (for exercise of legal claims and or serving in the public interest).
You requested that we verify the accuracy of your personal data we have;
Processing is unlawful but you do not request its erasure;
Processing and retention of data is no longer needed by us, but you wish that we retain it as this data is required by you to establish, exercise or defend a legal claim;
You have objected to the processing of data and are waiting for verification on our overriding legitimate interest;
In some cases restriction might prevent the Company from performing its obligations under the contractual relationship with the Customer. In such event, we will notify Customer accordingly.
We may continue to process your information if another lawful basis exists for doing so. If we are unable to provide you with services due to the withdrawal of consent, we will inform you accordingly.
in an easily re-used format or to a third party if technically possible.
This right applies only to personal information provided by you to us for the performance of contractual relationship with us, or which we process based on your consent.
This right may not be fully applicable in cases where the processing is done due to a legal obligation of the Company.
Exercising your rights
Please contact our data protection team directly at contact details indicted below to exercise your rights or if you have questions about the use of your personal data.
You may be subject to identification procedures and measures in order to ensure that no personal data is disclosed to unauthorized persons. We may also request additional information/clarifications to process your request as rapidly and efficiently as possible.
All requests should contain a clear description of the object of the request in English or Portuguese.
We will not normally charge a fee to access your personal data (or exercise other rights). We may charge a fee where your request is clearly unfounded, excessive or repetitive. Alternatively, we may reject such a request as manifestly or excessively burdensome, unfounded and not submitted in good faith.
Depending on the complexity of your request and volume of data associated with it, we will aim to satisfy all legitimate requests within one month of receipt or to inform you of refusal, or of an extension period of up to three months to satisfy your request. We will notify you appropriately if your request requires more than one month to fulfil.
Right to file a complaint
If you have any complaints about the use of your personal data, exercise of your rights, please notify and/or file a complaint with our data protection function directly at the contact details indicated below or fill out and submit the relevant form available on the Company’s website: www.unlimit.com. We will immediately investigate and inform you in regard to your complaint.
Complaints must be made in English or Portuguese in a comprehensive manner and contain sufficient details and a clear description of the complaint.
If you believe that we have not been able to resolve your complaint, you may also submit a complaint to the ANPD by visiting www.gov.br.
Contact details:
Unlimit has appointed a Group Data Protection Officer at its headquarters, who can address questions and concerns and can be contacted as follows:
Data Protection Function
Unlimit Brasil Instituição de Pagamento Ltda
Av. das Nações Unidas, 12551, cj 2201, Brooklin Novo, São Paulo, 00004-578, Brazil Email: [email protected]
Our retention period is primarily determined by our obligations under applicable legislation to retain data for a specific period of time. Destruction will not be possible prior to the lapse of this period.
We are obliged to keep Customer data (including personal data) during the existence of the business relationship and for a minimum period of 5 years after business relationship termination, or after Customer application rejection/withdrawal, in accordance with AML legislation and other requirements applicable to our business.
We may retain certain documents which contain personal data for longer than 5 years. For example, we may keep your personal data (which may be part of certain documents) for a period of 10 years to comply with tax laws.
The retention period may be extended in case of other lawful reasons justifying longer retention (such as for complaints handling, legal proceedings, investigations, regulatory, tax, money laundering and crime and fraud prevention purposes).
Unlimit has established security internal policies and procedures for secure processing of personal data in order to protect data from unauthorised access, loss, misuse, alteration or destruction. We ensure to the best of our abilities that access to personal data is limited to persons on a need-to-know basis, and that persons who have access are required to maintain its confidentiality. We utilise a series of technology and security solutions to protect data (such as storage of information you provide us on secure servers, perimeter security mechanisms, such as encryption etc.). Nonetheless, security cannot be absolutely guaranteed against all threats despite our best efforts.
Transmission of information via the internet is not completely secure. We cannot guarantee the security of data transmitted to us via email, to our website or online resources; such transmissions are at your own risk.
Where you have access to our resources via user authentication means (e.g. user credentials), you are responsible for keeping your user credentials secure and confidential and not to disclose them to any persons. Please also consult our security tips available on our website.
You are responsible for ensuring that the information provided to Unlimit by you/about you or on your behalf is accurate and up to date, and you must inform us if anything changes as soon as possible.
If you provide information about another person, you must direct them to this Privacy Notice and ensure they also agree to Unlimit using their information as described in it.
We may revise or update our Privacy Notice from time to time. In such a case, we make the most recent version of the Privacy Notice available on our website, informing you accordingly by displaying in the updated version and relevant date of update.
You are advised to visit our website frequently to consult our Privacy Notice in its most recent version. An unofficial translation is made available here.
One of our sales team will bein touch ASAP.