Privacy Policy

1. Controller and scope

The controller identified for this institutional website is Swapo Finance Sociedade Prestadora de Serviços de Ativos Virtuais Ltda, CNPJ 52.854.278/0001-20, headquartered at Rua Fidêncio Ramos, 100, Vila Olímpia, São Paulo/SP, CEP 04551-010. The Data Protection Officer (DPO) is Matheus Puppe, at [email protected].

This policy describes the website swapofinance.com, its contact channels and, in general terms, the processing of data of clients of the platform (app.swapofinance.com). The institutional website does not collect identity documents, biometrics, passwords or private keys through forms; that data is processed during registration in the app.

Updating the identification in this document does not, by itself, transfer databases or prior contracts. Any change of controller must respect the legal basis, the purpose, the duties of disclosure and the rights of data subjects.

2. Concepts

Personal data is information related to an identified or identifiable person. Sensitive data includes biometrics linked to a person. The controller decides the purposes and means of processing; processors process data on its behalf. The DPO acts as the channel with data subjects and the ANPD (Brazilian Data Protection Authority).

3. Data processed

• Browsing: IP address and technical logs necessary for delivering and securing the website, according to the hosting service.
• Preferences: language, theme and cookie choices stored in the browser.
• Origin of the visit: campaign parameters present in the address, such as UTM. They may accompany links to the app.
• Marketing, with authorization: visit and interaction events, session identifier and Meta campaign/cookie identifiers when available.
• Campaign quiz: declared answers, such as profile, monthly volume in dollars and payment method used. The commercial questionnaire does not replace the regulatory risk profile assessment.
• Contact: data and messages you decide to send by e-mail, phone or WhatsApp. Avoid sending unnecessary documents or financial information through channels not intended for that purpose.

Platform clients: identification and contact data (name, CPF, identity document, address, phone and e-mail), bank details, data on the company, its partners and the ultimate beneficial owner, source of funds, risk profile, wallets indicated and transaction records. Depending on the risk, there may be a liveness check with facial biometrics, which is sensitive data processed for fraud prevention and compliance with a legal obligation. Visiting the website does not collect this data. Sensitive data cannot be processed on the generic basis of legitimate interest.

4. Purposes and legal bases

• Responding to requests and preparing contracting: preliminary procedures related to a contract, at the data subject’s request, or performance of a contract, as the case may be.
• Managing registration and executing transactions: performance of a contract, including sending the order to the liquidity provider, settlement, receipts and support.
• Security and abuse prevention: legitimate interest, where applicable after assessing necessity and impact, legal obligation or another basis suited to the situation.
• Regulatory identification, AML/CFT/CPF, transaction records and compliance with requests from authorities: compliance with a legal or regulatory obligation. This processing does not cease upon withdrawal of consent.
• Defense in proceedings: regular exercise of rights, within the limits necessary.
• Optional cookies and advertising: specific, revocable consent. Refusing does not prevent you from using the website.

A purpose does not authorize unlimited use of the data. Processing must observe necessity, adequacy, transparency, security and non-discrimination. The legal basis must match the specific processing.

5. Sharing

Hosting and technical support providers may process data necessary to make the website available, within their duties. The Meta Pixel, when authorized, transmits events to Meta for campaign measurement. It is not loaded by the website before valid marketing consent.

In the quiz, with marketing consent, Meta receives events of the journey and the answers, including declared profile, monthly volume range and payment method. The exact volume typed is not part of those events. Refusing marketing prevents this sending, without preventing completion of the questionnaire.

When you click to continue registration from the quiz, the app receives the answers, including the exact volume entered, through parameters in the destination address. This forwarding results from the action of proceeding to the app and occurs even without advertising consent; it serves the continuity of the commercial request. These parameters may appear in the browser history and in the destination’s access logs. Do not share the resulting address if you do not want to reveal your answers.

When you open WhatsApp or a social network, you access an external service, subject to its provider’s practices. See the Meta policy and the WhatsApp policy.

To execute transactions, client and transaction data are shared with the OTC desks that supply the liquidity and with the institutions that hold the Pix receiving accounts, identified in the Transparency Center. External auditors may access records to the extent necessary for their work.

Sharing with authorities or participants in a transaction depends on a legal basis and on the necessity of the data, including identification of sender and beneficiary when required. Stablecoin issuers must not be presumed to be providers contracted by Swapo merely because they are mentioned on the website.

You may request information about the entities with which your data has been shared. Disclosing categories in this policy does not replace identifying the relevant providers before a transaction is contracted.

6. International data transfers

Advertising, communication or infrastructure services may involve processing outside Brazil. An international transfer requires a legal basis for the processing and a valid mechanism under art. 33 of the LGPD (Brazil’s General Data Protection Law), such as an adequacy decision or applicable contractual clauses, subject to ANPD Board Resolution No. 19/2024.

The existence of this policy or the use of a foreign supplier does not, on its own, prove that these mechanisms have been adopted. The data subject may request the destination countries, agents involved, purpose, duration and safeguards relevant to their processing, including information on applicable contractual clauses, with legally protected secrets preserved.

When the mechanism used is specific consent for international transfer, it must be obtained prominently and with the necessary information. It is not presumed from browsing.

7. Retention and deletion

Data must be kept for the time necessary for the purpose and for the applicable legal periods. Access logs, registration data and transaction documents may have different periods; no generic unlimited retention applies to all data.

When the purpose ends, data must be deleted or anonymized, except where the law allows retention, such as a legal/regulatory obligation or exercise of rights. A deletion request must receive an explanation of the data that must be retained and the corresponding basis.

In the browser, theme, language and consent preferences persist until changed or removed. The advertising identifier fb_session_id and its date are kept in local storage, are used only with marketing consent and are renewed after 24 hours on next use. Quiz answers and campaign parameters are kept in memory during browsing and may accompany links. Third-party cookies follow their own periods and controls. You can remove this data in your browser settings.

8. Your rights

Under the LGPD, you may request confirmation of processing, access, correction, information on sharing, anonymization, blocking or deletion of unnecessary or irregular data, portability as regulated, revocation of consent and deletion of data processed on the basis of consent, subject to legal exceptions.

You may also object to irregular processing and request review of decisions made solely by automated processing that affect your interests, as well as clear information on criteria and procedures, with trade and industrial secrets protected.

Send the request to the DPO at [email protected], stating the right you wish to exercise. Identity verification must be proportionate to the protection of the data. Do not send a password, authentication code or private key.

Swapo responds to requests within 15 days. Confirmation and access may be provided immediately in a simplified format or through a complete statement within that period, under art. 19 of the LGPD. Handling the data subject’s request must not be charged for.

You may petition the ANPD and appeal to consumer protection bodies.

9. Cookies and preferences

The panel lets you accept, refuse or customize categories. Optional categories start unchecked. The choice is recorded with a date in local storage; you do not need to accept advertising to browse.

The change applies to this browser. Revoking does not undo previous processing or automatically delete cookies already set by third parties; also use the browser controls to remove them. If the choice cannot be saved, optional cookies stay blocked for this visit, including when there was a prior authorization. The website tries to remove the old choice and reports the failure. If the browser also prevents that removal, clear this website’s data in the browser settings so the old authorization is not read on a future visit.

10. Information security

Data protection requires controls proportionate to the risk, such as access limitation, credential protection, updates, monitoring and incident response. See the summary of the Information security policy.

This website does not claim SOC 2 or ISO 27001 certification for Swapo, nor inviolability. The existence of cyber risks does not eliminate legal liability for defects in the service or irregular processing of data.

11. Security incidents

An incident that may cause significant risk or harm to data subjects requires notification to the ANPD and to data subjects within three business days, counted from the controller’s knowledge that the incident affected personal data, subject to the specific rules that apply, under ANPD Board Resolution No. 15/2024.

The notification must explain the nature of the incident, the data involved, risks, response measures and contact means, in clear language. Complementary information and the incident record follow the regulations. It is not necessary to wait for an order from the ANPD to give notice when the legal obligation is established.

If you suspect data exposure, inform the official channel with the subject “Security incident”. Send only what is necessary to identify the event and preserve the evidence.

12. Children and adolescents

The intermediation service disclosed is intended for persons aged 18 or older. Registration of children or adolescents is not requested on this website. If incidental processing occurs, the best interest of the minor, the legal basis and the need for blocking, deletion or legal retention must be assessed, without a promise of deletion that is incompatible with legal duties.

13. Changes and versions

This is version 4.0, published on November 1, 2026. Relevant changes must be reported prominently. New processing that depends on consent requires a new choice; continuing to browse does not replace that expression of will.

Previous versions and clarifications may be requested through the contact channel. Changes do not reduce the rights provided by law.

14. Contact and Data Protection Officer

Swapo Finance Sociedade Prestadora de Serviços de Ativos Virtuais Ltda
CNPJ 52.854.278/0001-20
Rua Fidêncio Ramos, 100, Vila Olímpia, São Paulo/SP, CEP 04551-010

Data Protection Officer (DPO): Matheus Puppe, designated by Swapo as the channel with data subjects and the ANPD (LGPD, art. 41). E-mail: [email protected].

Other matters: [email protected] · +55 (11) 91004-2300.

15. Applicable legislation

Law No. 13,709/2018 (LGPD), the Marco Civil da Internet (Brazil’s Internet Civil Framework), the CDC (Consumer Defense Code) and the regulatory rules relevant to the specific processing apply. The conditions of the services are in the Terms of Use. In matters of data protection, the rights and obligations provided by law prevail.