Privacy Policy

01Our commitment

This Privacy Policy describes how KODEKASH TECNOLOGIA LTDA (Brazilian CNPJ 64.648.362/0001-76) processes personal data on the website and platform, in compliance with the Brazilian General Data Protection Law (Law 13,709/2018, the LGPD).

We collect only what is necessary for the platform to work, and on this page we explain what is done with each piece of information.

02Processing roles

In website, sales and Client relationship activities, KodeKash acts as the controller of personal data.

In white-label operations, end-user data (buyers, students, affiliates) belongs to the Client's operation: in that context, KodeKash acts as the processor, handling data according to the instructions and purposes defined by the Client, who is the controller.

03Data we collect

• Contact and registration data: name, email, phone, company and role, provided in forms, proposals and onboarding.
• Verification data (KYC/KYB): corporate and identity documents required to enable operations, in line with regulatory obligations.
• Transactional data: records of payments, payouts and movements processed by the platform in the Clients' operations.
• Browsing data: IP address, device identifiers, pages visited and cookies, collected automatically.

04Legal bases and purposes

• Contract performance: providing the platform, processing transactions and offering support.
• Compliance with legal or regulatory obligations: identity verification, anti-money-laundering (AML/CFT) and record keeping.
• Legitimate interest: platform security, fraud prevention, usage metrics and product improvement.
• Consent: marketing communications and non-essential cookies. You can withdraw consent at any time.

05Sharing

We do not sell personal data. We share data only when necessary to operate:

• Acquirers, payment institutions and banks that settle the operations' transactions.
• Infrastructure providers (cloud, monitoring, transactional email) contractually bound to security standards.
• Identity verification and fraud prevention services.
• Public authorities, when required by law, regulation or court order.

06Cookies

We use essential cookies (site functioning) and, only with your consent, campaign measurement cookies and events (Meta and Google Analytics). No measurement data is collected before you accept in the cookie notice.

Upon acceptance, we record anonymous browsing identifiers (we do not collect name, email or phone in this measurement) together with IP address and browser data, used to attribute visits and conversions to campaigns. This data is sent to our media partners through direct server integration.

You can change your choice at any time through the Cookie preferences link in the site footer. If you decline, measurement cookies already stored are deleted and no new events are sent.

07Information security

We apply encryption in transit and at rest, least-privilege access control, environment segregation, audit logging and continuous monitoring. Card data flows follow the PCI DSS standard together with the connected providers.

No system is immune to incidents. If a security incident with relevant risk to data subjects occurs, KodeKash will notify those affected and the Brazilian National Data Protection Authority (ANPD) under the terms of the LGPD.

08Retention and disposal

We keep personal data only for as long as necessary for the purposes of this Policy, for legal retention periods (including transactional records and AML/CFT obligations) and for the regular exercise of rights. At the end, data is securely deleted or anonymized.

09Your rights (LGPD)

As a data subject, you may request at any time:

• Confirmation that processing exists and access to the data.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of unnecessary data or data processed in non-compliance.
• Portability, information about sharing and review of automated decisions.
• Withdrawal of consent, when consent is the legal basis.

Requests from end users of white-label operations will be directed to the controlling Client, with KodeKash's operational support.

10Data Protection Officer (DPO)

To exercise your rights or ask questions about this Policy, contact KodeKash's Data Protection Officer at contato@kodekash.com with the subject "Privacy". We will respond within the periods set by the LGPD.

11International transfers

Some infrastructure providers may store data outside Brazil. In those cases, we adopt safeguards provided for in the LGPD, such as specific contractual clauses and the choice of providers with adequate protection standards.

12Updates to this policy

This Policy may be updated to reflect legal or platform changes. The current version will always be available on this page, with the date of the last update. Relevant changes will be communicated through the official channels.