Privacy Policy

Introduction

UTUA aims to share information and commercial proposals of interest to its Users, making them aware of products and services that best suit their reality, according to their needs and preferences.

UTUA follows international and national standards and security norms in data storage, protection, privacy, and transmission.

By using UTUA’s services, the user confirms that they have read, understood, and accepted the Terms and Policies applicable to the service provided by UTUA, including this Privacy Policy, and agree to be bound by them, aware that the controller of their personal data—that is, the company responsible for making decisions regarding the processing of their personal data—will be NEXUS INTERNATIONAL VENTURES BRASIL LTDA, a private legal entity registered under CNPJ No. 65.836.872/0001-30, headquartered at Av. Afonso Pena, No. 3351, Suite 1101NIV, Bairro Serra, Belo Horizonte/MG, CEP 30.130-008, Brazil.

After reading this Privacy Policy, if you have questions, complaints, wish to exercise your rights related to your personal data, or communicate with UTUA on this subject, you may contact us through our customer service channels or contact our Data Protection Officer (DPO), Gabriel Machado Delgado, via email at compliance@nexusiv.org.

1. Scope

This Privacy Policy applies to all UTUA users and all those who, in any way, make use of the services provided by this tool. We collect your personal data whenever you:

• Fill out the registration form available on the company’s website;
• Participate in surveys or promotions offered by UTUA;
• Report a problem to UTUA, requesting a solution from the company;
• Browse UTUA’s website – https://utua.com.br/;
• Contact us through our customer service channels;
• Sign up for the “Clube Utua” (Utua Club) to participate in specific sweepstakes and promotions, as described in the specific Privacy Policy of this program.

This Privacy Policy also applies to other forms of personal data collection by UTUA that allow for the provision or improvement of our services. For example, we may collect information through partners, related to our technologies, or for participation in duly regulated sweepstakes, as in the case of Clube Utua.

The practices described in this Privacy Policy are subject to applicable local laws, with emphasis on Law No. 13,709/2018 (Brazilian General Data Protection Law, or “LGPD”).

2. What Personal Data is Collected by UTUA

By using UTUA’s services, you provide us with, and we collect, certain personal data related to you. From the moment you interact with UTUA, we collect your personal data. In some cases, you provide your personal data directly to UTUA, but we may also collect your data automatically when you browse UTUA’s website.

In addition, we also receive certain personal data sent by partners we engage for specific purposes, so that we can comply with legal obligations or applicable regulations, as detailed below.

By accepting the terms of this Privacy Policy, you expressly agree to provide only true, current, and accurate personal data and not to alter your identity or your personal data in any way when accessing and using our products or services. You will be solely responsible for any false, outdated, or inaccurate information you directly provide to UTUA.

These are the personal data categories processed by UTUA:

Personal data that may be requested from and provided by the data subject:

• (i) Registration data: full name, phone number, email, CPF (tax ID), date of birth, address, gender, RG (ID number and issuing body), full names of father and mother;
• (ii) Desired transaction data: information related to the financial product or credit category you wish to contract;
• (iii) Professional status and banking data: information related to the user’s current or previous occupation, as well as any transactions or balances in accounts linked to FGTS (severance fund) and bank details provided to receive funds;
• (iv) Pension/social security benefit data: profile (retiree, pensioner, public servant, member of the armed forces, etc.); type of benefit received (retirement, pension, etc.); benefit amount; registration number; state, bank, account, and branch of receipt;
• (v) Loan guarantee/collateral data: whether you own a vehicle or property in your name; value and address of the property to be used as collateral; and credit blacklisting status, if applicable;
• (vi) Data from information systems: SCR, Positive Credit Registry, and Open Finance data, respecting applicable legal and regulatory limits.

Personal data collected from third parties:

• Registration data, such as: name, date of birth, CPF, phone number, and address;
• Financial restriction data, such as: credit blacklisting, amounts owed, and due dates;
• Credit history information;
• Credit score generated by credit bureaus;
• Information on upcoming or overdue debts, co-obligations, and guarantees;

Browsing and device data:

• IP address of the mobile device used to access UTUA’s services or products;
• Interactions performed and usage profile of UTUA’s website;
• Technical data, such as URL information, network connection, provider, and device information;
• Cookies;
• Device attributes, such as device ID, operating system, browser, and model;
• Device geolocation data, provided you authorize collection on your device;
• Application access logs;
• Date and time of application usage;
• Browsing data, reflecting visited areas;
• Interaction data with ads and advertising content, such as clicks, page dwell time, and displayed ads;
• Unique behavioral profile identifier, generated jointly with advertising and digital identity partners (e.g., Lotame), based on cross-referencing contact data provided by the data subject;

Personal data resulting from the use of our services:

• Service contracting data;
• Data on credit operations contracted with partners, such as personal loans, debt negotiation, and debt installment plans;
• Credit history;
• Customer service history;

UTUA does not collect or process sensitive data, such as racial or ethnic origin, religious or political beliefs, trade union membership, or genetic or biometric data, unless strictly necessary and based on a valid legal ground.

3. How UTUA Uses Your Personal Data

UTUA uses your personal data to offer you the best products and, in the case of Clube Utua, to enable your participation in sweepstakes held under their respective Regulations.

UTUA commits to continuously implementing physical, technical, and administrative information security measures in processing your personal data, in accordance with market best practices. This aims to protect your data against unauthorized access, accidental or unlawful destruction, loss, alteration, communication, or any form of inappropriate or unlawful processing.

Below we detail the purposes for which we use your personal data:

Personal data provided by the data subject

Purposes:

• Correct and precise identification of the user, ensuring greater security and protection for users themselves;
• Access to services and products made available by UTUA;
• User profile analysis to recommend the best products and information suited to their real needs and reality;
• Identification, authentication, and eligibility verification for using UTUA’s services;
• Sending articles and text content related to partner products, which in the case of Clube Utua enables point accumulation for participation in regular sweepstakes;
• Responding to inquiries and requests;
• Contact by telephone, email, SMS, WhatsApp, or other communication channels, including push notifications regarding service usage;
• Improvement of services provided by UTUA, including cross-referencing information on contracted products to offer new products and services;
• Marketing, prospecting, market research, opinion polls, and promotion of partners’ products and services, including offering deals and sending news, features, content, and relevant updates to maintain our relationship with you;
• Credit protection, including credit granting and limit increases;
• Prevention and resolution of technical or security issues;
• Investigations and measures to prevent and combat illegal acts, fraud, financial crimes, and to ensure the security of UTUA clients and the financial system;
• Collaboration with or compliance with court orders, competent authorities, or regulatory bodies;
• Compliance with legal or regulatory obligations;
• Resolving inquiries based on collected information to answer questions, fix issues, and improve system user experience.

Personal data collected from third parties

Purposes:

• Improvement of our products and services;
• Marketing, prospecting, market research, and opinion polls;
• Credit protection, including credit granting and limit increases;
• Prevention and resolution of technical or security issues;
• Investigations and measures to prevent and combat illegal acts, fraud, financial crimes, and to ensure the security of UTUA clients and the financial system;
• Compliance with legal or regulatory obligations, keeping registration data updated, or complying with legal/regulatory duties imposed on UTUA.

Browsing and device data

Purposes:

• Service provision, offering contracted products, and optimizing website usage and experience;
• Operationalizing new products and services;
• Recommending new services, products, or features, including partner services of potential interest;
• Displaying advertising on our website, social media, or third-party websites;
• Generating statistics, studies, research, and surveys regarding activities and usage behavior;
• Credit protection, including credit granting and limit increases;
• Prevention and resolution of technical or security issues;
• Investigations and measures to prevent and combat illegal acts, fraud, financial crimes, and ensuring system security;
• Compliance with court orders, competent authority requests, or regulatory oversight;
• Compliance with legal or regulatory obligations;
• Lead qualification and audience segmentation to optimize advertising campaigns on third-party platforms (e.g., Facebook, TikTok, Google Ads), including through digital identity partners;

Personal data resulting from the use of partner products and services

Purposes:

• Provision of services and offering of contracted products;
• Enhancement of services provided by UTUA, including cross-referencing product data to offer new offerings;
• Development of new products and services by partner companies and generating insights for innovation;
• Testing to improve UTUA models, services, and products;
• Marketing, prospecting, market research, opinion polls, and promotion of partner products and services;
• Credit protection, including credit granting and limit increases;
• Prevention and resolution of technical/security issues and performance monitoring;
• Investigations and measures to prevent and combat fraud, financial crimes, and security threats;
• Collaboration with or compliance with court orders or regulatory authorities;
• Compliance with legal or regulatory obligations.

Public data

Purposes:

• Promotion of UTUA products and services on social networks, websites, apps, or corporate/advertising materials;
• Credit protection, including credit granting and limit increases;
• Investigations and measures to combat fraud, illegal acts, and financial crimes;
• Regular exercise of UTUA’s legal rights;
• Compliance with legal and/or regulatory obligations imposed on UTUA.

Applicable Legal Bases

In general, UTUA bases the personal data processing described in this Policy on the following legal grounds provided in Articles 7 and 11 of the LGPD, depending on the data category and purpose:

• Performance of a contract or preliminary procedures related to a contract (Art. 7, V): data directly provided by the subject to access and receive UTUA services;
• Compliance with a legal or regulatory obligation (Art. 7, II): data processed to meet legal, regulatory, or supervisory requirements, including fraud and financial crime prevention;
• Legitimate interest of the controller (Art. 7, IX, c/w Art. 10): browsing data processed for service improvement, information security, and aggregated statistics, provided it does not involve behavioral advertising or sharing with digital identity partners;
• Consent of the data subject (Art. 7, I, c/w Art. 8): browsing and behavioral data processed for behavioral advertising, profile enrichment, and sharing with advertising and digital identity partners (Section 4);
• Credit protection (Art. 7, X): data related to credit analysis, granting, management, history, and scoring, under applicable credit protection laws.

This list is general and does not replace specific legal basis analyses for each purpose. If you have questions about which legal ground applies, contact our Data Protection Officer (Section 13).

4. Personal Data Sharing

UTUA may share your data under certain circumstances. Data sharing may occur with economic group companies, service providers, and authorities/regulatory bodies for various purposes when necessary. Whenever performed, data sharing will occur within the limits and purposes of our business and according to applicable law.

Additionally, personal data may be shared with Assertiva Tecnologia da Informação LTDA, always respecting applicable legal bases, LGPD principles, and legitimate data processing chains, with due commitments to confidentiality, security, and compliance. At any time, the User will have free access to their personal data through NEXUS or Assertiva customer service channels to exercise all rights provided under this Policy and applicable laws, especially the LGPD.

Below is a summary category breakdown of the types of suppliers with whom we share personal data:

Business partners, service providers, and other third parties

Purposes of sharing:

• Enhancement of our services and website, as well as launching new products or services;
• Contact via phone, email, SMS, WhatsApp, push notifications, or other channels;
• Assistance in developing and offering our services and Clube Utua sweepstakes;
• Marketing, prospecting, market research, opinion polls, and product promotion;
• Credit protection, including credit granting and limit increases;
• Prevention and resolution of technical or security issues;
• Investigations and measures to prevent and combat illegal acts, fraud, and financial crimes;
• Regular exercise of UTUA’s legal rights;
• Compliance with court orders, competent authority requests, or regulatory oversight;
• Compliance with legal or regulatory obligations;
• Verification and enhancement of UTUA credit lines by cross-referencing information with partners and credit bureaus;

Advertising and digital identity partners

Purposes of sharing:

• Enriching user behavioral profiles and generating unique identifiers for lead qualification and audience segmentation;
• Optimization of advertising campaigns run on third-party platforms (e.g., Facebook, TikTok, Google Ads).

Partner example: Lotame, a digital identity and advertising company headquartered in the United States. International data transfer to this type of partner is detailed in Section 8 of this Policy.

Authorities and regulatory bodies

Purposes of sharing:

• Investigations and prevention measures against fraud, financial crimes, and threats to security;
• Regular exercise of UTUA rights, including presenting evidence in judicial and administrative proceedings;
• Compliance with court orders, regulatory requests, or official mandates;
• Compliance with legal or regulatory obligations.

Furthermore, while browsing our website, you may be redirected to third-party websites or applications. Once redirected, privacy practices will be governed by those third parties’ privacy policies and terms of use. We cannot control or assume responsibility for third-party content or privacy practices. Please read their privacy policies carefully.

All third parties with whom UTUA shares personal data must sign agreements containing data protection clauses aligned with the LGPD.

5. Retention and Deletion of Personal Data

While you are a UTUA Client or Prospect, during your use of our services and throughout the period UTUA stores your personal data, it will be maintained in a secure and controlled environment.

When applicable, even after termination of UTUA services or partner relationship, we may retain your personal data for an additional period for auditing, legal/regulatory compliance, regular exercise of rights, or as required by legal bases justifying retention. Lacking a legal basis for retention, data will be deleted from UTUA’s database after a period of 5 (five) years following the termination of your relationship with UTUA.

6. Your Rights as a Data Subject

Under the LGPD, as a personal data subject, you may exercise your rights regarding the controller of your data.

We provide the detailed mechanisms below so you understand clearly how to exercise your rights. Our team is ready to process your requests. The rights below may be exercised at any time via express request to our Data Protection Officer at compliance@nexusiv.org.

Confirmation of processing existence (Art. 18, I)

Being a user of UTUA services means we process your personal data (including secure storage). You may request UTUA to confirm whether your data is being processed.

Access to personal data (Art. 18, II)

You may request UTUA to inform and provide the personal data held about you, including a full electronic copy in a usable format.

Correction of incomplete, inaccurate, or outdated data (Art. 18, III)

If you notice your personal data is incomplete, inaccurate, or outdated, you may request correction or completion by providing supporting documentation.

Anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data (Art. 18, IV)

If any personal data is processed unnecessarily, excessively, or in violation of LGPD, you may request UTUA to anonymize, block, or delete it, provided such non-compliance is verified.

Data portability (Art. 18, V)

You may request data portability to another service or product provider upon express request, respecting UTUA commercial/industrial secrets and ANPD regulations.

Deletion of personal data processed with consent (Art. 18, VI)

Where processing relies on consent, you may request data deletion at any time, subject to statutory retention exceptions under Art. 16 of the LGPD.

Information on third parties with whom data was shared or received (Art. 18, VII)

You may request information about third parties with whom UTUA shared or from whom it received your personal data.

Information on the option not to consent and consequences of refusal (Art. 18, VIII)

If consent is required for a product or service, you may ask UTUA to clarify whether the service can be provided without consent and what consequences follow a refusal.

Right to object (Art. 18, §2)

You have the right to object to data processing at any time for reasons related to your particular situation, where processing is based on consent waiver hypotheses or non-compliance with the LGPD.

Revocation of consent (Art. 18, IX)

Where you provided consent, you may revoke it at any time. Revocation may result in unavailability of certain UTUA features or service termination, but does not affect (i) anonymized data; or (ii) processing grounded on another LGPD legal basis.

Review of automated decisions (Art. 20)

You may request human review of decisions made solely on automated processing of personal data that affect your interests, including decisions defining personal, professional, consumption, or credit profiles, as well as disclosure of decision criteria.

For trade secret and confidentiality protection, UTUA may restrict technical detail disclosure while providing clear and adequate criteria and procedures, under Art. 20, §1 of the LGPD.

Additionally, browsing data processing includes persistent identifiers and audience segment mapping conducted with digital identity partners (e.g., Lotame) for lead qualification and ad optimization. This may qualify as an automated decision defining consumption profiles under Art. 20 of the LGPD, granting you review and disclosure rights.

Complaints to the National Data Protection Authority (ANPD)

If you are not satisfied with UTUA’s response to your request, you may submit a complaint to the National Data Protection Authority (ANPD) via official channels at https://www.gov.br/anpd.

7. Activity Logs / Collected Data

We may record your activities when using our website, creating logs containing: IP address, access times, actions taken, date/time stamps, and device information (OS version, browser, geolocation).

We may also use tracking technologies, proprietary or third-party, such as:

Cookies: Internet files temporarily storing browsing data. UTUA uses cookies and receives partner cookie data. Cookies remember preferences, maintain activity states, or deliver personalized content.

You can manage cookie settings in your browser at any time. Disabling cookies may affect certain site functionalities.

Third-party cookies are active on our site. Their practices are governed by third-party policies. You may block or delete cookies via your browser settings.

For transparency, we classify cookies as: (i) essential cookies (necessary for site operation); (ii) analytical cookies (measuring site usage); and (iii) advertising cookies (ad personalization and data sharing with digital identity partners like Lotame). You can manage preferences per category via our consent tool in the site footer.

Web beacons: Techniques mapping website visitors and tracking interactions across servers.

Google Adsense DART Cookie: UTUA displays Google Adsense ads. Google uses cookies to serve ads based on user visits. Users may disable the DART Cookie at: http://www.google.com/ads/preferences/.

Analytics Tools: Collect visitor interaction data (pages visited, visit timestamps, referring sites).

All technologies comply with this Privacy Policy. Activity logs are stored for at least 6 months under Art. 15 of the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet), expandable for audit/security purposes.

8. International Personal Data Transfers

Some or all of your personal data may be transferred abroad, such as when stored by UTUA, NEXUS, or Assertiva Tecnologia da Informação LTDA on cloud servers outside Brazil. All legal requirements and security practices are adopted to ensure data integrity and confidentiality.

Data shared with overseas advertising and digital identity partners, such as Lotame (USA), for purposes in Section 4 may also be transferred internationally. UTUA complies with CD/ANPD Resolution No. 19/2024, incorporating ANPD-approved standard contractual clauses and/or obtaining specific, highlighted consent under Art. 33 of the LGPD.

9. Security Measures

UTUA uses industry-standard security measures to safeguard personal data during collection and storage, including:

• Multi-factor authentication for data access;
• Security as Code for automated, rapid incident response;
• Encryption for data at rest, in transit, and in use;
• Continuous environment monitoring;
• Ongoing security testing by internal and external teams;
• Periodic audits.

“In addition to internal reviews, UTUA may retain specialized external auditors to verify security controls.”

10. Consent

Certain data collection occurs only with your consent. By checking “I have read, understand the data processing conditions, and grant my consent as described in this Privacy Policy,” you authorize processing as outlined.

For advertising browsing data—including partner sharing and international transfers—UTUA collects specific, highlighted consent separate from general policy acceptance. You may manage or revoke category consents anytime via the footer cookie manager tool.

Data processing is necessary for service provision. Contact customer support for any clarifications.

11. Additional Relevant Information

UTUA never sends emails asking for payments or personal data confirmation. Disregard and report suspicious emails as spam.

UTUA may share data with partners to recommend suitable products/services or fulfill requested offerings.

12. Changes to this Privacy Policy

UTUA may update this Policy at any time. Significant updates will be effective upon posting on our website or notification via email, highlighted on our homepage https://utua.com.br/.

13. DPO Contact

Under Law No. 13,709/2018, NEXUS INTERNATIONAL VENTURES BRASIL LTDA (UTUA) is the Data Controller. Contact our DPO:

• Data Protection Officer (DPO): Gabriel Machado Delgado
• Email: compliance@nexusiv.org
• Address: Av. Afonso Pena, nº 3351, Sala 1101NIV, Bairro Serra, Belo Horizonte/MG, CEP 30.130-008, Brazil.
• Duties: Art. 41, §2 of the LGPD

I – accept complaints/communications from subjects, provide clarifications, and take measures;

II – receive ANPD communications and take measures;

III – guide staff/contractors on privacy practices; and

IV – perform other duties determined by the controller or regulations.

14. FINAL PROVISIONS

For questions regarding this Policy, contact UTUA channels or our DPO.

Contractors processing UTUA data must adhere to these terms and security standards.

If any provision is deemed unlawful by local authorities, remaining provisions remain in full force.

Electronic communications (email, SMS, instant messaging) are acknowledged as valid and binding for service and policy updates.