ADATVÉDELMI IRÁNYELVEK
Last updated: September 2022
1. Introduction
This statement outlines the privacy policy adopted by XP Investimentos ("us," "we," or "our") concerning our products and services (the "Services") and website (the "Website"). Safeguarding your privacy and the confidentiality of your information is crucial to us in delivering our Services and operating the Website.
Our Services and Website may link to third-party sites and services. We are not accountable for the privacy practices of these third-party entities. It is advisable to review their privacy policies before using them.
All information acquired by us in connection with our Services is treated as confidential. We employ robust technical, security, and organizational measures to protect Personal Data (as defined below) against unauthorized processing, accidental loss, destruction, damage, theft, or disclosure.
When sending your information through our website, you may be required to provide personal information, (for example) your name, email, phone number, date of birth, and various identification details. This information may be utilized, inter alia, to verify identity, administer information, offer technical support, and fulfill contractual and legal obligations. We may communicate important details through notifications, and with your consent, provide information about products and services via SMS, email, etc. You have the option to manage notification preferences and unsubscribe from certain communications.
2. Website; Visitors and Users
2.1. General
This section delineates the specifics of data collection from different groups: Website's visitors ("Visitors"), users ("Users"), and business partners (collectively "Partners"). Personal Data includes IP address, name, contact details, and information about the relationship with us, as defined by applicable data protection regulations.
2.2. Collection and Use
By visiting the Website, you consent to the collection and use of your Personal Data. Failure to agree with these terms should deter you from visiting the Website. We may collect information through page view activity, IP addresses, and cookies. Additionally, we process volunteered data from forms and registrations.
2.3. Purpose of Processing Personal Data
We process Personal Data to enhance, understand, and personalize our Website and Services. This includes improving accuracy, communication about Services, support, contractual obligations, and collaboration with partners. Consent or legal basis is essential for any processing.
The following outlines the purposes and legal basis for processing Personal Data:
| Registration as an account holder | Your consent; Performance of Services or contract obligations |
| Providing and using Services | Performance of Services or contract obligations |
| Operational updates | Performance of Services or contract obligations |
| Responding to queries and providing support | Legitimate interests or performance of Services |
| Tailor-made Services, advertising, and marketing | Legitimate interests or your consent |
| Improving and offering new Services | Consent and legitimate interests |
| Sending advertising and marketing materials | Your consent |
| Analyzing marketing campaign effectiveness | Legitimate interests or consent |
| Performing various support activities | Legitimate interests or performance of Services |
| Analysis, including statistical analysis | Legitimate interests |
| Protecting interests, rights, and assets | Legitimate interests or legal obligations |
2.4. Sharing Personal Data
We may share information with service vendors, Partners, and contractors. For Visitors and Users in the European Data Region, data processing complies with GDPR and Data Protection Laws and applicable regulations.
3. Partners
3.1. General
To provide Services and collaborate with Partners, we collect and process specific data types. Partners are responsible for their data, and we may access it through secure means.
3.2. Processing of Personal Data
We rely on Partner consent or legitimate interests to process Personal Data. Data Aggregations may be created for development and quality improvement.
3.3. Controller/Processor
We may act as a Controller or Processor depending on the data type:
- Visitor/User data: Controller
- Partner data: Processor
- All data is securely hosted, following the highest security standards. We implement physical, technical, and organizational safeguards.
3.4. Third-Party Data Protection
If Services involve processing Personal Data on a third-party platform:
- We act as a Processor
- Comply with the third party's instructions
- Implement security measures
- Inform about data breaches
- Do not subcontract without consent
- Do not process data outside the European Economic Area without consent
- For electronic marketing communications, consent and unsubscribe options are ensured.
4. Security
We employ administrative, organizational, and technical safeguards to protect Personal Data from unauthorized access, disclosure, alteration, loss, misuse, or damage. When sharing data with third parties, we ensure they uphold the same data protection standards, and contractual obligations are established for exclusive, secure processing aligned with this Policy.
If there's a belief that the interaction with us is compromised, Visitors, Users, or Partners should promptly notify us. It's important to note that, despite our security measures, we cannot guarantee complete immunity from third-party hacking. Users acknowledge the inherent risks and potential breaches.
5. Cookies
Refer to our Cookie Policy for detailed information about the types of cookies and tracking technologies used on the Website, reasons for use, and how to accept or reject them.
6. Links to Other Sites
While navigating the Website, Users may encounter links to external sites beyond our control. We don't bear responsibility for the content or privacy policies of these sites. Users are advised to review the privacy policies of such third-party websites and services before disclosing any Personal Data.
7. Retention and Deletion
Data, including Personal Data, will not be retained longer than necessary. Visitors and/or Users with active accounts are responsible for timely data deletion. Upon termination of an account or partnership, related Personal Data collected through the Website and/or Services will be deleted in compliance with applicable laws and our internal policies.
Withdrawal of consent for processing Personal Data may limit access to some or all requested Services, with no claims or contentions to be available.
8. Your Rights
Users are entitled to specific rights regarding their Personal Data:
8.1. Right of Access
- Confirm if Personal Data is processed
- Access to Personal Data and related information
- Information about processing purposes, categories, recipients, storage duration, rights, and profiling existence
8.2. Right to Rectification
- Rectification of inaccurate Personal Data
- Completion of incomplete Personal Data
8.3. Right to Erasure
- Request erasure of Personal Data under specific grounds
8.4. Right of Restriction of Processing
- Obtain restriction of processing under specific circumstances
8.5. Right to Data Portability
- Receive Personal Data in a structured, machine-readable format
- Transmit Personal Data to another controller
8.6. Right to Object
- Object to processing based on legitimate interests or direct marketing
- Cease processing unless compelling and/or legal grounds applicable
8.7. Right to Withdraw Consent
- Withdraw consent for processing Personal Data at any time
9. Advertising and Marketing Materials
Consent is obtained to use Personal Data and contact details for providing advertising and marketing materials. Withdrawal of consent is possible by sending written notice to the provided email address.
10. Acceptance of this Policy
By using the Website and/or Services, Visitors, Users, and/or Partners are presumed to have read and agreed to this Policy. Any disagreement implies refraining from using the platform. We reserve the right to modify the Policy, and Users are encouraged to check for updates periodically. Continued use after changes indicates acceptance.
11. Legal Obligation to Disclose Personal Data
Personal Data may be disclosed without prior permission if there's a belief that it's necessary to establish identity, contact, or initiate legal proceedings against individuals suspected of infringing rights or property. Disclosure shall be made when legally required to.
12. Data Protection Officer
For privacy and data protection matters, a designated "Data Protection Officer" can be reached at