Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Zenite Ventures S/A ("Kigar", "we", "us", or "our"), the controller of your personal data, collects, uses, shares, stores, and protects personal data in connection with the Kigar payments ecosystem, including our mobile application, website, and related services (together, the "Services").

Kigar is a global, app-first payments ecosystem built primarily for companies moving money domestically and internationally, and available to individuals as well. Kigar is not a bank. Regulated banking, custody, crypto-asset, payment, card, and settlement activities are performed by licensed financial partners; Kigar operates the software layer that connects you to those capabilities.

This Policy applies to every person and business that accesses or uses the Services, including account holders, their authorized representatives and beneficial owners, and visitors to our website. It is designed to comply with the Brazilian General Data Protection Law (Lei nº 13.709/2018 – "LGPD") and, where applicable to businesses and users located outside Brazil, to give effect to equivalent rights under the EU General Data Protection Regulation ("GDPR") and comparable regimes.

This Policy should be read together with our Terms of Use, of which it forms an integral part.

2. Data Controller and Contact

The controller responsible for processing your personal data is Zenite Ventures S/A, a company incorporated in Brazil, operating the Kigar ecosystem.

For any matter relating to this Policy or to the processing of your personal data, you may contact us through the in-app support channel or by writing to our Data Protection Officer (Encarregado de Proteção de Dados) at hello@kigar.pro, as described in the "Data Protection Officer and Contact" section below.

Where licensed financial partners act as independent controllers of certain data (for example, to satisfy their own regulatory obligations), their own privacy notices govern that processing and are made available to you when you enable the relevant partner services. In respect of processing they carry out on our behalf and under our instructions, such partners and providers act as operators (operadores/processors).

3. Personal Data We Collect

We collect the following categories of personal data, depending on how you use the Services:

Identification and registration data: full name, business (legal) name and trade name, date of birth, nationality, taxpayer identification numbers (such as CPF or CNPJ) and equivalent foreign identifiers, government-issued identity documents, photographs and selfies used for identity verification, and, for businesses, corporate registration data.

Contact data: email address, telephone number, postal and registered addresses.

Corporate and relationship data: for business accounts, information about the company's ownership structure, directors, authorized representatives, beneficial owners, and the roles of individuals connected to the account.

Verification and compliance data (KYC/KYB): documents and information required to verify identity, ownership, source of funds, and eligibility, and to meet anti-money-laundering, counter-terrorism-financing, sanctions-screening, and fraud-prevention obligations.

Financial and transactional data: account balances, transaction history, payment instructions, counterparties, invoice and payment references, prepaid card top-ups and card transactions, and other records generated when you move money domestically or internationally through the Services.

Device, technical, and usage data: IP address, device identifiers, operating system and app version, language and time-zone settings, log data, in-app activity, and diagnostic information.

Security and authentication data: credentials, transaction passwords/PINs, and, where you choose to enable it, indicators that biometric authentication (such as fingerprint or face recognition) was successfully performed by your device. Biometric matching is carried out on your device by the operating system; we do not receive or store your raw biometric templates.

Communications data: the content of messages, support requests, and other communications you send to us, including records of interactions for quality and compliance purposes.

Website and cookie data: information collected via cookies and similar technologies when you visit our website, as described in the "Cookies and Similar Technologies" section.

Some of this data is provided directly by you; some is generated automatically as you use the Services; and some is received from third parties such as licensed financial partners, identity-verification and anti-fraud providers, sanctions and politically-exposed-person data sources, and public registries, in each case to operate the Services and meet legal obligations. Some verification, sanctions, and politically-exposed-person data may constitute sensitive personal data under the LGPD, and where required we process it only on a lawful basis provided by law or, where applicable, with your specific and highlighted consent.

4. Purposes of Processing

We process personal data for the following purposes:

- To create, operate, and maintain your account and provide the Services, including enabling you to move money domestically and internationally and to manage payments to suppliers, invoices, and counterparties.

- To verify your identity and, for businesses, the identity of representatives and beneficial owners (KYC/KYB), and to assess eligibility.

- To process, execute, and reconcile transactions through licensed financial partners.

- To detect, prevent, and investigate fraud, unauthorized access, and other unlawful or prohibited activity, including through automated screening and risk scoring.

- To comply with legal and regulatory obligations, including anti-money-laundering, counter-terrorism-financing, sanctions, tax, record-keeping, and reporting requirements, and to respond to lawful requests from competent authorities.

- To secure the Services, authenticate users, and authorize sensitive actions.

- To provide customer support and respond to your requests.

- To improve, personalize, and develop the Services, including analytics, diagnostics, and quality assurance.

- To communicate with you about the Services, including operational, security, and administrative messages, and, where permitted, about products and features.

- To exercise or defend legal rights and to enforce our agreements.

5. Legal Bases for Processing

We rely on the following legal bases under the LGPD (and, where applicable, the corresponding bases under the GDPR):

- Performance of a contract / execution of preliminary procedures at your request (LGPD Art. 7, V; GDPR Art. 6(1)(b)): to create and operate your account and provide the Services you request.

- Compliance with a legal or regulatory obligation (LGPD Art. 7, II; GDPR Art. 6(1)(c)): to meet KYC/KYB, anti-money-laundering, sanctions, tax, and reporting requirements.

- Legitimate interests / regular exercise of rights (LGPD Art. 7, IX; GDPR Art. 6(1)(f)): to secure the Services, prevent fraud, ensure network and information security, improve the Services, and defend legal rights, provided such interests do not override your fundamental rights and freedoms.

- Consent (LGPD Art. 7, I; GDPR Art. 6(1)(a)): for certain optional processing, such as specific marketing communications or non-essential cookies, where required. Where processing relies on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

- Credit protection and fraud prevention (LGPD Art. 7, X): where applicable to protect the integrity of the ecosystem.

Where sensitive personal data is processed, we rely on the specific legal bases of LGPD Art. 11, including compliance with a legal or regulatory obligation, fraud prevention and security of the data subject, regular exercise of rights, or your specific consent.

Where we process data to fulfil legal obligations or to perform our contract with you, providing that data is necessary to use the Services; without it, we may be unable to open or maintain your account. Where we rely on legitimate interests, you may request further information about the balancing assessment performed.

6. Sharing of Personal Data

We share personal data only as necessary and in accordance with applicable law, with the following categories of recipients:

- Licensed financial partners who provide regulated banking, custody, crypto-asset, payment, prepaid card, and settlement services, so that your transactions can be executed and the applicable regulatory obligations met.

- Our infrastructure and technology providers who host and support the Services, including cloud, storage, security, communications, and analytics providers, acting as our operators (processors) under contractual data-protection obligations.

- Identity-verification, anti-fraud, sanctions-screening, and compliance providers engaged to verify users and protect the ecosystem.

- Competent authorities, regulators, and courts, where disclosure is required by law, regulation, or valid legal process, or to protect our rights, users, and the integrity of the Services.

- Professional advisers (such as legal, audit, and accounting advisers) under confidentiality obligations.

- Parties to a corporate transaction (such as a merger, acquisition, or reorganization), subject to appropriate safeguards and continuity of this Policy.

We do not sell your personal data, and we do not share it with third parties for their own independent marketing purposes. We require recipients acting on our behalf to process personal data only under our instructions and to maintain appropriate confidentiality and security. You may request information about the categories of recipients with whom your data has been shared, as described in the "Your Rights" section.

7. International Data Transfers

Because Kigar operates a global ecosystem, personal data may be processed and stored in countries other than your own, including outside Brazil and the European Economic Area.

When we transfer personal data internationally, we implement safeguards required by applicable law. Under the LGPD, transfers are made to countries with an adequate level of protection or, where such adequacy is not established, on the basis of appropriate guarantees such as standard contractual clauses, specific contractual commitments, binding corporate rules, or another lawful basis under Art. 33 of the LGPD. For data subject to the GDPR, we rely on adequacy decisions or, where applicable, Standard Contractual Clauses approved by the European Commission, together with supplementary measures where needed.

You may contact our Data Protection Officer to obtain more information about, and where available a copy of, the safeguards applied to international transfers of your personal data.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to provide the Services, and for as long as required to comply with our legal, regulatory, accounting, and reporting obligations, to resolve disputes, and to enforce our agreements.

Because the Services involve regulated financial activity, certain categories of data — in particular identity-verification (KYC/KYB) records and transaction records — must be retained for periods mandated by applicable anti-money-laundering, financial, and tax legislation, which typically require retention for several years after the account relationship ends.

When personal data is no longer required for these purposes, we will delete, anonymize, or irreversibly de-identify it in accordance with applicable law. Anonymized data that can no longer be associated with an individual may be retained and used for statistical and analytical purposes.

9. Automated Decision-Making and Profiling

To protect the ecosystem and comply with our regulatory obligations, some processing — such as fraud detection, transaction monitoring, sanctions and politically-exposed-person screening, and eligibility and risk assessment — may involve automated processing, including profiling. These processes may, in certain cases, influence decisions such as whether a transaction is allowed, delayed, or referred for manual review, or whether an account is opened, limited, or suspended.

Where a decision is taken solely on the basis of automated processing that affects your interests, you have the right, under LGPD Art. 20, to request a review of that decision and to receive clear information about the criteria and procedures used, subject to trade and commercial secrets and to legal limits where disclosure would compromise fraud prevention, security, or regulatory obligations. Where the GDPR applies, you may also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except as permitted by law, and to obtain human intervention, express your point of view, and contest the decision.

To exercise these rights, contact our Data Protection Officer using the details below.

10. Your Rights as a Data Subject

Subject to applicable law, you have the following rights in relation to your personal data:

- Confirmation and access: to confirm whether we process your personal data and to obtain access to it.

- Correction: to request the correction of incomplete, inaccurate, or outdated data.

- Anonymization, blocking, or deletion: to request anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed in non-compliance with the law.

- Deletion of data processed based on consent: to request deletion of personal data processed on the basis of your consent, subject to legal retention requirements.

- Portability: to request portability of your data to another service or product provider, subject to applicable rules and trade/commercial secrets.

- Information about sharing: to obtain information about the public and private entities with which we have shared your data.

- Information about consent: to be informed about the possibility of not providing consent and the consequences of refusal.

- Withdrawal of consent: to withdraw consent at any time, where processing is based on consent.

- Objection and restriction: to object to or request restriction of processing carried out on the basis of legitimate interests, and, under the GDPR where applicable, additional rights including the right to object to automated decision-making and to lodge a complaint.

- Review of automated decisions: to request review of decisions taken solely on the basis of automated processing that affect your interests, as described in the "Automated Decision-Making and Profiling" section.

To exercise any of these rights, contact our Data Protection Officer using the details below. We may need to verify your identity before responding and will reply within the timeframes established by applicable law (under the LGPD, generally in a simplified format immediately and in full within fifteen (15) days of your request). We do not charge a fee for exercising your rights except where permitted by law for manifestly unfounded or excessive requests. Certain rights are subject to legal limits — for example, where retention is required by law or where a request would compromise fraud prevention, compliance obligations, or the rights of others.

You also have the right to lodge a complaint with the competent supervisory authority. In Brazil, this is the National Data Protection Authority (Autoridade Nacional de Proteção de Dados – ANPD); in the European Economic Area, your local data protection authority.

11. Security

We adopt technical, administrative, and organizational measures designed to protect personal data against unauthorized access, loss, alteration, destruction, and any form of inappropriate or unlawful processing.

These measures include encryption of data in transit and at rest, strong authentication and transaction-authorization controls, strict internal controls and least-privilege access governance, network and application security monitoring, logging and auditing, and secure development practices. Regulated data handled by licensed financial partners is subject to institutional-grade custody and security controls maintained by those partners.

No method of transmission or storage is completely secure. You play an important role in protecting your account: keep your credentials, transaction password, and device secure, enable available security features, and notify us promptly of any suspected unauthorized access.

12. Data Breach and Incident Notification

We maintain procedures to detect, respond to, contain, and remediate personal-data security incidents.

In the event of a security incident that may create relevant risk or harm to you, we will notify the competent authority (the ANPD in Brazil, or the relevant supervisory authority where the GDPR applies) and affected data subjects within the timeframe and in the manner required by applicable law. Our notification will describe, to the extent known, the nature of the affected data, the individuals concerned, the measures taken, and the steps you can take to mitigate potential effects.

Where an incident affects data held or processed by a licensed financial partner or other provider acting on our behalf, we will coordinate with that partner so that the applicable notification obligations are met.

13. Cookies and Similar Technologies (Website)

Our website uses cookies and similar technologies to operate correctly, remember your preferences, ensure security, and understand how the site is used.

We use: strictly necessary cookies, which are essential for the site to function and cannot be switched off; functional cookies, which remember your choices and preferences; and analytics cookies, which help us understand aggregate usage and improve the site. Where required by law, non-essential cookies are used only with your consent.

You can manage cookies through your browser settings and, where available, through our cookie-preferences tool. Disabling certain cookies may affect the functionality of the website. Our mobile application does not use advertising cookies; it uses standard device and diagnostic technologies as described in this Policy.

14. Children and Minors

The Services are intended for businesses and for individuals who are of legal age and have full legal capacity in their jurisdiction. The Services are not directed to children, and we do not knowingly collect personal data from children.

If we become aware that we have collected personal data from a child without appropriate legal authorization, we will take steps to delete that data. If you believe a minor has provided us with personal data, please contact our Data Protection Officer.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the Services, in our practices, or in legal and regulatory requirements.

When we make material changes, we will notify you through the app, our website, or other appropriate means before the changes take effect, and we will update the "last updated" date. Your continued use of the Services after the effective date constitutes acknowledgment of the updated Policy, except where additional consent is required by law. Prior versions will be made available on request.

16. Data Protection Officer and Contact

Zenite Ventures S/A has appointed a Data Protection Officer (Encarregado de Proteção de Dados) responsible for handling questions and requests relating to the processing of personal data and for liaising with data subjects and the competent authorities.

To exercise your rights, ask questions about this Policy, or raise any privacy concern, contact us through the in-app support channel or by writing to our Data Protection Officer at hello@kigar.pro (the same address is published within the app and on our website). We will respond within the timeframes required by applicable law.

Last updated: 15 October 2026.