At Base, we value the privacy and security of your personal information. This Privacy and Cookies Policy ("Policy") describes how we collect, use, store, and protect the personal data of our employees, clients, partners, and visitors. Our mission is to treat your information with the utmost respect and confidentiality, in compliance with applicable laws and regulations, such as the General Personal Data Protection Law (LGPD).
We are committed to providing transparency regarding our privacy practices and ensuring that your information is always protected. Thank you for trusting Base, and we are always available to answer any questions you may have about our privacy practices.
Objective
This Privacy Policy (“Policy”) aims to explain how Base Exchange (“Base”) processes the personal data it collects through internet applications, and to reaffirm our commitment to the privacy, confidentiality, and security of everyone who uses our institutional channels, including our employees, potential clients, and potential candidates.
All personal information will be handled in accordance with applicable Brazilian legislation on privacy and personal data protection, specifically Law No. 12.965/2014, known as the “Internet Civil Rights Framework”, and Law No. 13.709/2018, known as the General Personal Data Protection Law (“LGPD”)
Application and Scope
This Policy applies to the personal data processing activities of our employees, as well as our clients and their users, potential clients, potential employees, website visitors, users of our platform or support systems such as WhatsApp, Skype, and Email, suppliers, and others.
Definitions and Abbreviations
· Personal Data: all information that allows for the identification of a natural person, such as: name, tax ID (CPF), identification document, physical address, email, phone number, among others.
· Sensitive Personal Data: data defined by the LGPD as information with potential for discrimination, which requires extra care when processed. According to the law, this includes data related to racial or ethnic origin, religious conviction, political opinion, membership in a union or religious, philosophical, or political organization, data concerning health or sex life, and genetic or biometric data, when linked to a natural person. Base does not collect sensitive data through its institutional channels covered by this Policy.
· Processing or Process: any operation involving the collection, storage, consultation, use, sharing, classification, reproduction, processing, and evaluation of Personal Data.
· Legal Bases: the legal grounds determined by the LGPD that authorize Base to process Personal Data. Any and all processing of Personal Data carried out by Base is based on a legal basis.
· Data Subject or Subject: the natural person to whom the Personal Data relates.
· Controller: a natural or legal person, under public or private law, who makes decisions regarding the processing of personal data.
· Operator: a natural or legal person, under public or private law, who processes personal data on behalf of the controller.
· Data Protection Officer (“DPO”): the person appointed by the controller and operator to act as a communication channel between the controller, data subjects, and the National Data Protection Authority (ANPD).
· Group or Flowa Group: includes (i) Flowa Technologies; (ii) Base Clearing; and (iii) Base Exchange.
Cookies
Cookies are files saved on your computer when you access our website. When our site is visited, it sends the cookie to your computer or mobile device, where it is stored in a folder within your browser. Cookies do not transfer viruses or malware to your computer or mobile device, as the information in a cookie does not change when moving back and forth between websites, and there is no way to alter the operation of your device. Therefore, they act as logs (user activity), being updated every time the website is accessed. We may obtain information about your browsing once you have consented to cookie collection via our website.
What do we use cookies for?
We use cookies to analyze how users navigate our website, as well as to record and improve its performance and functionality. We may use cookies to track which pages are most popular and the most effective method of linking between them. This also helps us identify if you found us through another website, allowing us to improve our future advertising campaigns.
Types of cookies we use
• Necessary Cookies: These cookies are essential for our website to function. Without them, our websites would not perform at their best. These are stored temporarily as session information and expire as soon as the browser is closed.
• Statistical Cookies: The information provided by analytical cookies allows us to analyze visitor behavior patterns, and this information is used to improve the overall experience or identify areas of the website that need maintenance. This information is anonymous (it cannot be used to identify you and does not contain personal information such as name and email address) and is used only for statistical purposes. Behavioral cookies are similar to analytical ones and record your visit to the website, using the information to provide content according to your interests.
• Preference Cookies: Preference cookies enable a website to remember information that changes the way the site behaves or looks, such as your preferred language or the region that you are in.
Processing of Personal Data
Why Base processes Personal Data
Base is committed to offering quality products and services and works daily to improve its security measures and ensure the protection of the Personal Data necessary for its activities. Data security involves respect and commitment to the proper use of this information, ensuring that it does not exceed the expectations of the Data Subjects and the purposes for which it was shared.
In addition to legal compliance, we follow strict internal procedures and develop technologies appropriate to the volume and sensitivity of the data processed.
When interacting with Base's products and services, the user may transfer information containing their Personal Data through the features available in our channels, and such collection is limited to the minimum necessary to achieve our purposes.
Whenever possible, we process anonymized information so that the Data Subject cannot be identified, considering the use of reasonable technical means available at the time of processing (especially through cookies).
When registering, it is important that the user enters only the information requested by Base, and that it is truthful and up-to-date. In any case, you are responsible for the veracity, accuracy, and authenticity of the information included in our records.
If you are a minor, please ensure you are assisted and have obtained authorization from your parents or guardians before applying for a job opening or submitting any information.
What Personal Data is collected?
Base may collect personal data provided directly by the user, by third parties, or collected automatically, depending on the service provided.
· Personal data provided directly by the User: Base will collect personal data entered or submitted when accessing our channels (websites, social media, technological environment testing programs, or applications) or when contracting products and/or services provided by companies in the Flowa Group.
· Personal data provided by third parties: If you are an Investor, we receive your registration data from the Authorized Participant and store records of every transaction performed. If you are a user of our systems, we receive your registration data from the Authorized Participant to grant access to our operational systems, and we store your access data, which may be used for audits and reports to the Authorized Participant with whom you have a relationship. Base may receive personal data through third parties, whether they are clients, partners, or service providers who have a relationship with the user. It is also possible for Base to collect data from public databases made available by authorities (such as the Federal Revenue Service, for example) or by third parties, or even data made public on websites or social media, always respecting privacy.
The data collected may vary depending on the User's interaction (via website, systems, email, phone, third-party social media, among others), as described below:
· Personal Contact Information: Includes any user information that allows us to contact you or verify your registration, such as full name, tax ID (CPF), date of birth, email, phone number, and other data necessary for contact or registration.
· Service/Communication Usage Information: As the user navigates and interacts with our platforms, Base may collect information about their actions, such as which links were accessed, which pages or content were viewed, for how long, which products the user subscribed to, geolocation data, provider and browser data, among other similar information and interaction statistics.
· Technical Information about the computer/mobile device: Information about the computer system or browser the user employs to access our channels, such as IP address, operating system type, and web browser type and version.
· Financial Information: Includes information regarding transactions performed.
· Human Resources Information: Includes user information for job applications, such as educational background, resumes, professional experience, among others.
For security reasons, Base may request additional data to prevent fraud attempts.
Purpose of Personal Data processing
Base processes Personal Data primarily to offer products and services, facilitate business relationships, and fulfill contractual, legal, and regulatory obligations. In certain cases, we may collect data to serve specific purposes, as outlined below:
• Customer Support: To provide support through our service channels and respond to questions, complaints, and requests. This typically requires the use of your personal contact data and registration information, as well as information regarding the products and services acquired.
• Service Provision: To facilitate and manage operations, user requests, and the acquisition of products and services.
• Compliance Processes: To fulfill legal obligations and conduct internal compliance processes, including, for example, "Know Your Customer," "Know Your Partner," and "Know Your Employee" processes.
• Whistleblowing Channel: To address reports and complaints.
• Control and Monitoring: To monitor orders and record transactions to ensure market security and integrity.
• Account Opening and Registration Maintenance: To identify the Client, in compliance with regulatory requirements.
• Recruitment Processes: To make job openings offered by Base available to candidates and manage selection processes.
• Legal/Regulatory Obligation Compliance: To comply with legal or regulatory obligations.
• Prevention and Investigation of Fraud and Financial Crimes: For assessments related to anti-money laundering, fraud, money laundering, concealment of assets, rights and values, and combating the financing of terrorism and the proliferation of weapons of mass destruction (“AML/CFT”).
• Compliance with Court Orders: Base uses Personal Data to comply with court orders, or requests from competent authorities or regulatory bodies.
• Advertising: We may use your personal data to ensure you are always well-informed to use our systems.
• For the protection of legitimate interests: We process personal data to protect our legitimate interests, respecting the principles of purpose and necessity. Some examples of such activities include:
• initiate legal claims and prepare our defense in cases of litigation;
• perform analysis of financial transactions to prepare strategic reports;
• establish monitoring systems for our facilities for security reasons;
• business management measures, platform performance optimization, and product and service development;
• share your personal data with companies to update/verify your personal information in accordance with anti-money laundering and other crime frameworks; and
• enhance our services to improve our users' experience and provide customized offers and channels with products tailored to your profile.
• For human resources management: We process personal data for personnel management. Some examples of such activities include:
• compliance with legal and regulatory obligations;
• execution of the employment contract;
• payroll and benefits management;
• recruitment and selection;
• training and development;
• performance evaluation;
• promotion of occupational health and safety;
• access control and security; and
• internal communication.
Sharing of Personal Data
Given the nature of Base's business, there are a number of mandatory disclosures to regulators and market agents, such as Authorized Participants, Clearing Members, Custody Agents, and public authorities. Furthermore, Base partners with other companies to facilitate its operations and provide its services. Consequently, Personal Data may be shared with other companies, suppliers, and regulatory authorities and bodies, in accordance with the purposes of collection and the roles of each agent within the market infrastructure relationship chain. Below are some of the situations in which Base shares Personal Data:
· Suppliers, Service Providers, and Business Partners: Base hires other companies to perform certain activities, such as payroll processing, time tracking, data hosting services, auditing, benefits management, and specialized consulting, among others (operators). In the context of providing these services, such entities may receive User Personal Data. Base evaluates its partners and includes clear provisions in its contracts with third parties to protect the privacy of data subjects and manages compliance with such provisions.
· Public Authorities: To comply with legal obligations, Base may share user Personal Data with government authorities, such as the Central Bank of Brazil (BACEN), the CVM (Securities and Exchange Commission), and other regulatory agencies and bodies.
· Flowa Group Companies: Base shares Personal Data among companies belonging to the Flowa Group for the development of Services and compliance with legal and regulatory obligations.
· Protection of rights: Base reserves the right to access, read, preserve, and disclose any data necessary to comply with legal, regulatory, judicial, or administrative obligations, or to protect the rights, property, or safety of Base, its clients, and employees.
User Rights
As provided for under Brazilian law, as a Personal Data subject, you have rights regarding your personal information, including:
· Request confirmation regarding the existence of processing of your personal data;
· Request a copy of your processed Personal Data;
· Request the correction and/or rectification of Personal Data if you identify that any of it is incorrect;
· Request the anonymization, blocking, or deletion of Personal Data from the database;
· Request the deletion of Personal Data collected and used based on your consent;
· When processing activities require your consent, you may refuse to provide it or withdraw it at any time; and
· Object to specific data processing.
To exercise these rights, Base may request additional information and documentation to prevent fraud, as well as to comply with applicable legal provisions and guidelines from the National Data Protection Authority.
Base may decline a user's request to exercise the rights listed above if there are legitimate grounds to do so. Examples of legitimate grounds include: (a) if disclosing the information would violate trade secrets of Base or third parties; (b) if the request for anonymization, blocking, or deletion of data is contrary to a legal or regulatory obligation applicable to Base, or would prevent the full and unrestricted defense of the rights of Base or third parties, including in disputes of any nature.
Some requests may require a longer response time due to their complexity or impact.
Personal Data Storage
Base follows Personal Data storage periods in accordance with applicable law.
Personal Data is stored for the time necessary to fulfill the purposes for which it was collected, unless there is another reason for its retention, such as compliance with legal, regulatory, or contractual obligations, provided there is a legal basis for doing so.
Base periodically conducts technical reviews of the appropriate retention period for each type of Personal Data collected, considering its nature, the necessity of collection, and the purpose for which it will be processed.
International Personal Data Transfer
Base may transfer and process personal data in other countries in accordance with the conditions set forth in the General Data Protection Law (LGPD), and such data will be subject to the obligations of this Policy.
Personal Data Security
We observe all necessary security standards to preserve the confidentiality and integrity of Personal Data, as provided for in our applicable institutional policies, especially the Information and Cyber Security Policy, considering:
· Any and all User Personal Data under the control of Base or in the custody of any of its employees;
· Personal Data processed by our employees, representatives, or authorized partners, provided they require access to such information based on the specific purposes for which your Personal Data was collected; and
· The storage of Personal Data performed across all operational environments.
Base follows security protocols and measures to protect Personal Data. Access to information is restricted to authorized personnel trained in the proper use of such information. Employees who misuse this information in violation of this Privacy Policy will be subject to legal action, as well as penalties under Base's disciplinary and ethical processes.
Communications
If you have any other questions, comments, or suggestions regarding this Policy, or suspect any misuse of your Personal Data, please contact Base through the support channels available on the website or reach out to our Data Protection Officer via email at: encarregadodedados@baseexchange.com.br.
Base is not responsible for fraudulent emails sent in its name, including false promises, fake offers, fraudulent forms, and/or any other type of communication sent by third parties.
Therefore, if you have any questions, please contact us through our official channels.
Changes to this Privacy Policy
Base may update this Privacy Policy at any time. Whenever a significant condition of this Privacy Policy is changed, such changes will be valid, effective, and binding once the new version is published on our website.
In compliance with current data protection legislation, we provide the name and email address of Base's Protection Officer: Felipe Deco – encarregadodedados@baseexchange.com.br. You may use this address to exercise your rights as a data subject, request information, or ask questions regarding the LGPD.
