The Privacy Policy of the Despezzas Platform (hereinafter referred to as “Platform”) has been created under the commitment of the Platform owner (BGJ Research Ltda.) to always handle the personal data of its users with security, privacy, and transparency.

This Privacy Policy describes the personal data we collect, how it is used, stored, and shared, as well as your rights regarding this data, being in full compliance with the General Data Protection Law (Law 13.709/18) and other applicable laws. We recommend careful reading.

Introduction

BGJ Research Ltda., the owner of the Despezzas Platform, provides application development and improvement services, whose main objective is to provide users with an efficient tool for managing their personal finances. 

Utilizing advanced functionalities, such as automatic categorization of transactions and detailed reports, the Despezzas app seeks to simplify the financial tracking process, allowing users to have a clear and organized view of their expenses and revenues, thus enabling them to make more informed financial decisions.

This Privacy Policy aims to record the commitment of the Despezzas Platform to the privacy and protection of the personal data collected from individuals who access and utilize the features offered in the Despezzas app.

By using the services of the Despezzas Platform/App, the user confirms that they have read, understood, and accepted the Terms and Policies applicable to the services provided by the Platform, including this Privacy Policy, and agrees to be bound by them, being aware that the controller of their personal data, that is, the company responsible for making decisions regarding the processing of their personal data, will be BGJ Research Ltda., a corporate entity registered under CNPJ nº 51.292.115/0001-38, located at Av. Afonso Pena 3351, room 1102, Letter BG - Belo Horizonte/MG.

After reading this Privacy Policy, if you have any questions, complaints, wish to exercise your rights related to your personal data, or communicate with the Despezzas Platform about this matter, you can contact us through our customer service channels or reach out to our data protection officer (DPO) via email <dpo@despezzas.com.br>.

Application

This Privacy Policy applies to all users of the Despezzas Platform in Brazil. We collect your personal data whenever you register on the Despezzas App, navigate the Platform website, or contact us through our customer service channels;

This Privacy Policy also applies to other forms of personal data collection by the Despezzas Platform, which allow for the provision or improvement of our services, such as information collected through partners of the Platform. 

The practices described in this Privacy Policy only apply to the processing of your personal data in Brazil and are subject to applicable local laws, particularly Law No. 13.709/2018 (General Personal Data Protection Law, or “LGPD”).

What personal data is collected by the Despezzas Platform

When registering on the Despezzas app, you provide us with, and we collect, some personal data related to you. The provision and collection of data are therefore carried out manually at the time of user registration on the Despezzas app. In addition to manual collection, other data may be collected during app usage, always with the purpose of understanding the user's profile and interests.

Additionally, we also receive some personal data sent by partners we hire for specific purposes so that we can fulfill legal obligations or applicable regulations and others that will be detailed further on.

By accepting the terms of this Privacy Policy, you expressly agree to provide only true, current, and accurate personal data and not to alter your identity or your personal data in any way while accessing and using our services. You will be solely responsible for any false, outdated, or inaccurate information you provide directly to the Despezzas Platform.

These are your personal data processed by the Despezzas Platform:

Mandatory data:

• Name

• Email

• Password

Optional data:

• Phone

• Position

• Salary

• CPF

• CNPJ

• Marital status

• Children

• Work format

• Credit restriction status

• Investments

• IP address of the mobile device used to access the Platform's services and Logical Port of Origin;

• Logs (records of user activities carried out on the Platform);

• Records of interactions with the Platform;

• Accessed screens, device, browsers, click information (version of the operating system, Geolocation, installed Apps, if necessary);

• Session ID;

• Cookies, pixel tags, beacons, and local shared objects;

• Public data from social networks;

• Data provided by other platforms;

• Responses to optional questionnaires and surveys;

The Despezzas app, by allowing the registration of data related to credit cards, bank accounts, spending limits, financial goals, and expenses and revenues entries, naturally processes this data to enable the provision of its services to users.

User usage data is also collected, such as interactions within the app, financial transactions, created categories, and other activities related to financial management.

The Despezzas Platform may centralize the collected information to be used on pages and services offered by other companies in its corporate group, if applicable, respecting the purposes for which the data was collected.

BGJ Research Ltda., as the owner of the Despezzas Platform, may conduct satisfaction and preference surveys during use, collecting this information to improve the provided services, better understand user preferences, and evaluate the quality and impressions of users regarding the Platform's services and products, as well as for statistical and advertising purposes.

How the Despezzas Platform uses your personal data - Purposes

Before specifying the purposes for which the personal data processed by the Despezzas Platform are used, the Platform's commitment to continuously implement physical, technical, and administrative information security measures in the processing of your personal data, in accordance with market best practices, is highlighted. The aim is to protect your data from unauthorized access, accidental or unlawful destruction, loss, alteration, communication, or any inappropriate or illegal form of processing.

We detail below the purposes for which we use your personal data:

a) accurately identifying the user, thereby ensuring greater security and protection for the users themselves;

b) administering, providing services, and fulfilling obligations arising from the use of the Platform/App services;

c) building individualized user profiles;

d) informing about news, functionalities, content, news, and relevant events from the Despezzas Platform and/or independent partners;

e) promoting and offering services/products and enabling marketing and advertising actions from the Despezzas Platform, as well as for satisfaction surveys and promotional campaign offers of our solutions and/or those of our users and independent partners;

f) enabling the portability of registration data to another controller in the same field of activity as the Despezzas Platform, if requested by the user;

g) developing analyses and statistical studies;

h) establishing contractual relationships with the user, as well as enabling the management, administration, provision, expansion, and improvement of the services and products of the Platform to the user, tailoring them to their preferences and needs, as well as creating new services and products to be offered to users;

i) personalizing and enhancing the user browsing experience on the Platform;

j) complying with obligations established by the LGPD and Law No. 12.965/14 (Marco Civil da Internet);

k) analyzing user profiles with the aim of suggesting the best products and information according to their real needs and reality;

l) responding to requests and inquiries;

m) Contacting via phone, email, SMS, WhatsApp, or other communication means, including for notifications or push on the use of the Platform's services;

n) Improving the services provided by the Despezzas Platform;

o) Collaboration or compliance with court orders, competent authority, or regulatory body;

p) Resolving inquiries based on the collected information, with the aim of addressing questions, correcting issues, and enhancing the system, thereby improving user experience on the Platform;

q) Regular exercise of the owner's rights of the Despezzas Platform;

r) Availability of app functionalities, such as registering transactions, creating goals, spending limits, among others;

s) Sending notifications related to expenses, payments, and other financial activities, according to user-configured preferences.

Activity Records / Data Collected

We may record the activities you perform when using our website or application, creating, when possible and applicable, logs (records of activities carried out on the websites and apps and services) that will contain: the IP address, access, and actions taken by you in the service provided, date and time of each action performed, and information about the device used, such as the version of the operating system, browser, and geolocation.

We may also utilize certain tracking technologies, whether proprietary or third-party, to monitor activities performed while you access our site.

Sharing of personal data

The Despezzas Platform may share your data if you authorize it. The sharing of your data may be done with third-party partners and with authorities and regulatory bodies for different purposes, when necessary. Whenever carried out, the sharing of data will be done within the limits and purposes of our businesses and in accordance with what the applicable legislation allows.

Below we indicate the purpose of sharing personal data, when applicable:

• Improvement of our services and platform;

• Marketing, prospecting, market research, opinion surveys, and promotion of our products and services;

• Prevention and resolution of technical or security issues;

• Regular exercise of rights of the Despezzas Platform;

• Compliance with court orders, competent authority, or regulatory body;

• Compliance with legal or regulatory obligations.

Additionally, when using our App, you may be redirected to third-party websites or applications. Once you are redirected to a third-party site or application, the privacy practices will be governed by the privacy policies and terms of use of those third parties. We cannot control or be responsible for the privacy practices and content of third parties. Carefully read the applicable privacy policies to understand how they collect and process your data.

In summary, the collected data and registered activities may be shared not only with partner companies in the development of the activities of the Despezzas Platform, but also: (i) with competent judicial, administrative, or governmental authorities, whenever there is a legal determination, request, requisition, or court order; (ii) automatically in the event of corporate movements, such as mergers, acquisitions, and incorporation of the company that owns the Despezzas Platform; and (iii) for the protection of the interests of the Despezzas Platform in any type of conflict, including legal actions.

The collected data and electronic records may also be shared with companies providing the technological and operational infrastructure necessary for the activities of the Platform, such as payment intermediaries and information storage service providers.

Retention and deletion of your personal data

The data collected by the Despezzas Platform will be stored on cloud servers, which may imply the transfer or processing of this data outside the country, always in accordance with the LGPD, GDPR, or the data protection legislation in force in the respective country.

The collected data and activity records will be stored in a secure and controlled environment until they are no longer necessary for offering the services of the Platform to the user, or until the deletion of this data is requested by the user, whichever occurs first.

If it is of interest to the user, the data can be deleted or modified upon express request through customer service channels (email: dpo@despezzas.com.br).

Regardless of the user's consent, data may be retained for a longer period due to legal reasons, court orders, fraud prevention, and other legitimate interests, in accordance with Article 10 of the LGPD. Once the period and legal need expire, data will be deleted using secure disposal methods or used in an anonymized form for statistical purposes.

For audit, security, fraud control, and rights preservation purposes, the Despezzas Platform may retain the history of records of user data for a longer period in cases where the law or regulatory rule so establishes or for rights preservation.

Your rights as a holder of personal data

With the entry into force of the LGPD, you, as a holder of personal data, can exercise your rights before the controllers of your personal data, such as the Despezzas Platform. 

We provide detailed mechanisms below so that you can clearly and transparently understand how to exercise your rights, and our team will be ready to address any requests.

Confirmation of the existence of personal data processing

The fact that you are a user of the services of the Despezzas Platform already means that we are processing your personal data, even if this processing includes, among others, the storage of personal data in a secure and controlled environment. In this sense, you can request that the Despezzas Platform confirm whether it is processing your personal data.

Access to personal data

You can request that the Despezzas Platform inform and provide the personal data it has in relation to you, that is, what personal data is processed by the Platform regarding you.

Correction of incomplete, inaccurate, or outdated personal data

If you find that your personal data is incomplete, inaccurate, or outdated, you can request the correction or completion from the Despezzas Platform. To do this, you will need to provide a document that proves the correct and current form of the personal data.

Anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data under the LGPD

If, eventually, any personal data is processed unnecessarily, excessively for its intended purpose, or in non-compliance with the LGPD, you can request that the Despezzas Platform anonymize, block, or delete this data, provided that the excess, lack of necessity, or non-compliance with the law is effectively established.

Deletion of personal data processed with consent

If you have given consent for the processing of your personal data for specific purposes, you can request the deletion of this personal data at any time.

The user may also request that the processing of their data be restricted under certain circumstances or oppose the processing of their personal data in specific situations, such as the use of data for direct marketing. 

Information about the companies with which the Despezzas Platform shared or from whom it received your personal data

You can request that the Despezzas Platform inform you with whom third parties it shared or from whom it received your personal data.

Information on the possibility of not providing consent and the consequences of refusal

If your consent is necessary to access or use a particular product or service, you can request that the Despezzas Platform clarify if it is possible to provide this product or provide this service without your consent for the processing of your personal data or what the consequences are for not providing consent in this case.

Revocation of consent

If you have given your consent for the processing of your personal data, you can request the revocation of this authorization. The revocation of consent may result in the impossibility of using certain functionalities provided by the Despezzas Platform or even the termination of the services provided, but it does not prevent the use of (i) anonymized data; and (ii) data whose processing is based on another legal basis provided in the LGPD.

Automated decisions

You can request a review of decisions made solely based on automated processing of personal data that affect your interests and the indication of the criteria used for these decisions. For reasons of business secrecy, protection of confidential information, and preservation of competition, the Despezzas Platform does not disclose how these automated systems operate. 

International transfer of personal data

Some or all of your personal data may be transferred abroad, for example when they are stored by the Despezzas Platform on cloud computing servers located outside Brazil. For this, the Despezzas Platform observes all requirements established by the prevailing legislation and adopts best security and privacy practices to ensure the integrity and confidentiality of your personal data.

Security measures

The Despezzas Platform employs various types of security measures to ensure the integrity of your personal data, such as information security standards practiced in the market when collecting and storing personal data.

We treat the security of your personal data with the utmost care, using standards and best practices adopted in the market. We have a highly qualified team responsible for ensuring that the Despezzas Platform adopts the best security practices, including:

• Encryption for data in rest, in transit, and in use, to ensure the integrity of the information;

• Continuous monitoring of the environment;

• Continuous security analysis and testing of our systems, performed by internal and external teams;

• Periodic audits;

• Access to 'Open Finance' limited to read only.

• Security as code, in order to enable automations and quick and effective responses to security events in the technological environment;

All our services are stored in Google’s ‘Cloud’, with network encryption (SSL) and with advanced protection from CloudFlare, used against network attacks.

Additional Relevant Information

The Despezzas Platform does not send emails to its Users requesting payments or confirmation of personal data. Therefore, if you receive any email for this purpose, we recommend that you disregard it immediately and report it as spam.

The Despezzas Platform does not sell information or personal data of its users but may share them with partner companies in order to indicate products and services that best meet their needs or to provide products and/or services requested by the user.

The Despezzas Platform uses reasonable market means and those legally required to preserve the privacy of the data collected on its Platform. Thus, it adopts and/or may adopt the following precautions in compliance with the security standards established in Decree No. 8.771/2016, such as: (i) using standard and market methods to encrypt and anonymize the collected data; (ii) having protection against unauthorized access to its systems; (iii) establishing strict control over access to data by defining responsibilities of people who will have access and exclusive access privileges for certain users; (iv) maintaining an inventory indicating the time, duration, identity of the employee, or the person responsible for access and the object file, based on connection and access records to applications, as determined in Article 13 of Decree No. 8.771/2016; (v) having a mechanism for authentication of access to records, using, for example, two-factor authentication systems to ensure individual accountability for the processing of the records; and (vi) using record management solutions through techniques that ensure the inviolability of data, such as encryption or equivalent protective measures.

Although the Despezzas Platform makes every effort to preserve the privacy of user data, no platform is completely secure, and the Despezzas Platform cannot fully guarantee that all information transmitted on the Platform will not be subject to unauthorized access carried out by methods developed to illegally obtain information. For this reason, the Despezzas Platform encourages Users to take appropriate measures to protect themselves, such as, for example, keeping their usernames and passwords confidential.

Internally, the data collected by the Despezzas Platform is accessed only by duly authorized professionals, respecting the principles of proportionality, necessity, and relevance for the objectives of the Platform, as well as the commitment to confidentiality and the preservation of privacy under this Privacy Policy.

The database formed through the collection of data on the Platform is owned and under the responsibility of BGJ Research Ltda., and its use, access, and sharing, when necessary, will be done within the limits and purposes of our businesses as described in this Privacy Policy.

BGJ Research Ltda. is not responsible for the terms and conditions of use or privacy policy, or for the content of any other portals, platforms, or applications, even if such content or services are linked to the Despezzas Platform, including through links.

CONTACT WITH DPO

According to Law No. 13.709/2018, BGJ Research Ltda. is considered the “Controller” of your personal data. If, after reading this Privacy Policy, you still have any questions, or for any reason need to communicate with us regarding your personal data matters, you can contact our data protection officer:

• Data Protection Officer (DPO): Gabriel Delgado

• Email: suporte@despezzas.com.br

• Address: Av. Afonso Pena 3351, room 1102, Letter BG - Belo Horizonte/MG.

• Responsibilities: Article 41, §2 of the LGPD
  I - accept complaints and communications from holders, provide clarifications and take necessary actions;
  II - receive communications from the national authority and take measures;
  III - guide the entity’s employees and contractors regarding practices to be adopted in relation to personal data protection; and
  IV - perform other tasks determined by the controller or established in complementary norms.

We are always available to clarify your questions.

Modifications to this Privacy Policy

​The Despezzas Platform may change this Privacy Policy at any time, aiming at its improvement and betterment of services provided. The new Privacy Policy will take effect 10 (ten) days after its publication on the Platform.

We always prioritize transparency: whenever a significant change is made, we will highlight the information on our main page https://despezzas.com.br/. By continuing to use our products and services after a change in the Privacy Policy, you agree to the new conditions, although you can always express your disagreement through our customer service channels, if applicable.

​In the event of updates to this Privacy Policy that require new consent collection, users will be notified through the contacts provided in the registration.

​Final Provisions

​In case of any doubt regarding the provisions of this Privacy Policy, the user may contact through customer service channels (Email: dpo@despezzas.com.br).

If third parties process any data collected by the Despezzas Platform, they must respect the conditions set forth herein and the information security standards of the Despezzas Platform, mandatorily.

​If any provision of this Privacy Policy is considered illegal or illegitimate by local authority, the other conditions will remain in full force and effect.

​The user acknowledges that all communications made via email (to the addresses provided in their registration), SMS, instant messaging applications, or any other form are also valid, effective, and sufficient for the disclosure of any matter related to the services provided by the Despezzas Platform, the conditions of their provision, or any other subject addressed therein, with due regard for the expressly different provisions provided in this Privacy Policy.