01Controller and Data Protection Officer (DPO)
Máximo Pay acts as controller of the personal data collected for registration, identity verification and account operation. With regard to the data of the Users' end customers (payers), Máximo Pay acts as processor, handling it according to the User's instructions and legal requirements.
The Data Protection Officer can be contacted at [E-MAIL DO DPO].
02Data we collect
We may collect the following categories of personal data:
- Registration data: name, company name, CPF/CNPJ, e-mail, phone, address and details of legal representatives;
- Identity verification (KYC) data: identification documents, proof of address, articles of association and other documents required by regulation;
- Transactional data: amounts, dates, Pix keys, transaction identifiers, payer details provided in the charge (name, CPF/CNPJ, e-mail) and payout history;
- Access and security data: IP address, device identifiers, access logs, API keys and authentication events;
- Support data: content of messages exchanged with our team.
03Purposes and legal bases
We process personal data for the following purposes, relying on the corresponding LGPD legal bases:
- Provision of the payment service, account management and processing of charges and payouts – performance of a contract (art. 7, V);
- Identity verification, anti-money-laundering, counter-terrorism-financing and fraud prevention – compliance with legal and regulatory obligations (art. 7, II) and credit protection (art. 7, X);
- Platform security, access logging and incident detection – legitimate interest (art. 7, IX) and compliance with legal obligations;
- Operational communications about the account and transactions – performance of a contract;
- Marketing communications – consent (art. 7, I), revocable at any time;
- Responding to court orders and requests from authorities – compliance with legal obligations.
04Data sharing
We share personal data only to the extent necessary, with:
- Payment service providers and settlement institutions authorised by the Central Bank of Brazil (including OnlyUp), to execute Pix charges and payouts;
- Identity verification, fraud prevention, cloud hosting, e-mail delivery and support providers, bound by contractual confidentiality and security obligations;
- Public authorities, regulators and the judiciary, when required by law or a valid order;
- The Users themselves, in the case of data about the payers of their charges.
05International transfers
Some service providers may store or process data outside Brazil. In such cases we adopt the safeguards provided for in the LGPD, such as specific contractual clauses and the selection of providers with an adequate level of protection.
06Data retention
Data is kept for as long as necessary to fulfil the purposes described in this Policy. Registration, identity verification and transactional data are retained for at least the period required by the regulation applicable to payment services and anti-money-laundering, even after the account is closed. After that period, data is deleted or anonymised.
07Data subject rights
Under art. 18 of the LGPD, you may request at any time:
- confirmation that processing takes place and access to your data;
- correction of incomplete, inaccurate or outdated data;
- anonymisation, blocking or deletion of unnecessary data or data processed in breach of the law;
- portability of the data to another provider, subject to trade and industrial secrets;
- information about the sharing of data with third parties;
- withdrawal of consent and information about the consequences of refusal.
08Information security
We adopt technical and administrative measures to protect personal data against unauthorised access and accidental or unlawful situations, including encryption in transit, access control, audit logging, two-factor authentication and signing of requests and webhooks. Relevant security incidents will be reported to the National Data Protection Authority and to data subjects, as required by law.
09Cookies
We use strictly necessary cookies for authentication, session maintenance and platform security. Analytics or marketing cookies, when used, depend on your consent and can be managed in your browser settings.
10Changes to this Policy
This Policy may be updated to reflect legal or operational changes. The current version and the date of the last update will always be available on this page.
11Contact
To exercise your rights or ask questions about this Policy, contact the Data Protection Officer at [E-MAIL DO DPO] or at [ENDEREÇO].
Read also
Read the Terms of use