Introduction
This Privacy Policy is issued by MOVCASH SOLUCOES TECNOLOGICAS LTDA, a company incorporated in Brazil under CNPJ 67.878.724/0001-03, with registered offices at Avenida Aldino Pinotti, 601, Bloco 7 Apt 133, Centro, São Bernardo do Campo — SP, Brazil (hereinafter "Movcash", "we", "our", or "us"). We operate the website located at this domain and provide the technology solutions described therein.
We are committed to protecting the personal information of every person who visits our website or otherwise interacts with us. This policy sets out, in clear terms, our practices regarding the collection, processing, storage, and disclosure of personal data, in compliance with Brazil's General Data Protection Law — Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018) — and, where applicable, the European Union's General Data Protection Regulation (GDPR, Regulation EU 2016/679).
By accessing or using our website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of it, please discontinue your use of our website. This policy applies to all personal data collected through the website — including through contact channels, analytics tools, and cookie technologies — but does not extend to third-party websites linked from our pages.
Information We Collect
We collect personal data through several channels, each described in detail below. We always aim to collect the minimum necessary for the stated purpose.
2.1 — Information you provide directly
When you contact us by email, telephone, or through any contact channel listed on this website, you may provide us with personal details such as your full name, email address, telephone number, company name, job title, and the content of your message. This information is used solely to respond to your enquiry and, with your consent, to keep you informed about our services.
2.2 — Information collected automatically
When you visit our website, our servers and third-party analytics tools automatically record certain technical information. This may include:
- Your Internet Protocol (IP) address and approximate geographic location derived from it
- Browser type, version, and operating system
- The URL of the page that referred you to our site and the pages you visit during your session
- Date and time of each request, and the duration of your visit
- Device identifiers and screen resolution
- Interaction data such as clicks, scroll depth, and session duration, collected via analytics cookies
This data is processed in aggregate or pseudonymised form and is used exclusively to understand how visitors use our website, to identify technical issues, and to improve content and performance. It is not used to identify you as a natural person unless combined with other information you have provided voluntarily.
2.3 — Cookies and similar technologies
We use cookies and similar tracking technologies as described in full in Section 04 of this policy. By continuing to use our website after the cookie notice has been displayed, you consent to the placement of non-essential cookies in accordance with the settings you select.
How We Use Your Information
Movcash processes personal data only for specified, explicit, and legitimate purposes. We do not process personal data in a manner that is incompatible with the purposes listed below. For each purpose, we identify the applicable legal basis under the LGPD and GDPR.
- To respond to enquiries and communications — When you contact us, we use the information you provide to answer your questions and to follow up as needed. Legal basis: performance of a pre-contractual relationship and our legitimate interest in providing quality customer service (LGPD Art. 7, II and IX; GDPR Art. 6(1)(b) and (f)).
- To improve and maintain our website — We analyse automatically-collected technical and behavioural data to diagnose errors, optimise page performance, and enhance the overall user experience. Legal basis: legitimate interests (LGPD Art. 7, IX; GDPR Art. 6(1)(f)).
- To measure marketing effectiveness — If you arrive at our website via a paid advertisement (such as Google Ads), we use analytics and conversion-tracking data in aggregated, privacy-safe form to assess the performance of those campaigns. Legal basis: legitimate interests and, where consent is required for cookies, your explicit consent (LGPD Art. 7, I and IX; GDPR Art. 6(1)(a) and (f)).
- To comply with legal obligations — We may process and retain certain data as required by Brazilian law, tax regulations, or court orders. Legal basis: compliance with a legal obligation (LGPD Art. 7, II; GDPR Art. 6(1)(c)).
- To protect our rights and those of third parties — We may use data to investigate fraud, prevent abuse, or enforce our Terms of Use. Legal basis: legitimate interests and the exercise of rights in judicial, administrative, or arbitration proceedings (LGPD Art. 7, VI and IX; GDPR Art. 6(1)(f)).
We do not make automated decisions, including profiling, that produce legal or similarly significant effects in relation to any individual.
Cookies & Tracking Technologies
Cookies are small text files placed on your device by a web server when you visit a website. They allow the site to remember information about your visit — for example, your preferred language or whether you have dismissed a notice — and enable analytics and advertising tools to function. We use the following categories of cookies:
| Category | Purpose | Examples | Consent required? |
|---|---|---|---|
| Strictly Necessary | Enable core website functions such as page navigation and security. The website cannot function properly without these. | Session cookies, CSRF tokens, cookie-preference storage | No |
| Analytics & Performance | Collect anonymised data about how visitors use our site — pages visited, time on site, error pages — so we can improve the experience. | Google Analytics 4 (GA4), including anonymised IP processing | Yes |
| Advertising & Conversion | Track conversions from paid campaigns (e.g. Google Ads) to measure return on investment. We use this data only in aggregate. | Google Ads conversion tags, Google Tag Manager | Yes |
| Functional / Preference | Remember choices you have made (e.g. cookie-banner preference, UI display settings) to provide a more personalised experience on return visits. | Preference cookies set by our CMS | Yes |
Managing your preferences: When you first visit our website, a cookie-consent banner will appear offering you granular control over which non-essential categories you wish to allow. You may change or withdraw your consent at any time by clicking the "Cookie Settings" link in the footer of every page. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal.
You may also control cookies directly through your browser settings. Most modern browsers allow you to refuse all cookies or alert you when a cookie is being placed. Note that refusing strictly necessary cookies may affect the proper functioning of certain website features. For guidance, refer to the help section of your browser.
Regarding Google Analytics specifically: we have activated IP anonymisation so that your full IP address is never stored by Google. We have also disabled cross-site data sharing and advertising features within our GA4 property. Google's privacy practices for Analytics are governed by the Google Privacy Policy.
Sharing With Third Parties
Movcash does not sell, rent, or trade your personal data to any third party for commercial purposes. We share data only in the limited circumstances described below, and we require all recipients to maintain appropriate security and confidentiality obligations.
- Service providers and data processors: We engage vetted third-party companies to perform services on our behalf — such as website hosting, cloud infrastructure, analytics, and email delivery. These companies access personal data only as necessary to perform their contracted services and are bound by data-processing agreements that prohibit any other use of your data.
- Analytics and advertising platforms: We share pseudonymised interaction data with Google LLC for the purposes of analytics (Google Analytics 4) and conversion measurement (Google Ads). This sharing occurs through cookie-based technology and is subject to your consent choices. Google is certified under the EU–US Data Privacy Framework and has entered into Standard Contractual Clauses to cover international data transfers.
- Legal and regulatory authorities: We may disclose personal data to Brazilian courts, regulators, law enforcement agencies, or other public authorities where we are required to do so by law, or where such disclosure is necessary to protect our legal rights, prevent fraud, or ensure the safety of our users.
- Business transactions: In the event of a merger, acquisition, or sale of all or part of Movcash's assets, personal data held by us may be transferred to the acquiring entity. We will notify affected individuals in advance and, where required, obtain their consent.
- Professional advisers: We may share data on a strictly confidential basis with our legal counsel, accountants, auditors, and insurers where necessary for the conduct of their professional services.
We do not transfer personal data to countries outside Brazil or the European Economic Area unless appropriate safeguards are in place — such as the European Commission's Standard Contractual Clauses, an adequacy decision, or equivalent mechanisms recognised by the ANPD (Brazil's National Data Protection Authority).
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our retention criteria are as follows:
- Enquiry and correspondence data (names, email addresses, message content): retained for up to 2 years from the date of last correspondence, unless a longer period is required to resolve a dispute or comply with a legal obligation.
- Website analytics data collected via Google Analytics 4: retained for 14 months within the GA4 platform, in line with Google's default configuration, after which it is automatically deleted or aggregated beyond personal-data level.
- Server access logs (IP addresses, request timestamps): retained for up to 12 months for security and diagnostic purposes, then deleted.
- Cookie-consent records: retained for 13 months from the date of consent, consistent with cookie lifecycle, to demonstrate compliance.
- Accounting and tax records that may incidentally contain personal data: retained for the minimum period required under Brazilian tax law (typically 5 years).
When data is no longer required for any of the above purposes, we securely delete or anonymise it so that it can no longer be associated with any individual.
Data Security
We implement technical and organisational measures appropriate to the sensitivity of the personal data we process and the risks associated with its unauthorised access, loss, alteration, or disclosure. These measures include, but are not limited to:
- Transport Layer Security (TLS 1.2 or higher) for all data transmitted between your browser and our servers
- Access controls restricting personal data to authorised personnel who require it in the course of their duties, enforced by role-based permissions and strong authentication requirements
- Regular security reviews and vulnerability assessments of our website infrastructure
- Contractual security obligations imposed on all third-party processors, including the requirement to notify us promptly of any data breach
- Physical security measures at our data hosting facilities, which are ISO 27001-certified data centres
- Staff training on data-protection obligations and secure-handling practices
No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your personal data, we cannot guarantee its absolute security. In the event of a personal data breach that is likely to result in a high risk to the rights and freedoms of individuals, we will notify the ANPD and affected data subjects in accordance with the timelines and requirements of the LGPD (and the GDPR where applicable), without undue delay.
Your Rights
Under the LGPD (and, where applicable, the GDPR), you have a comprehensive set of rights in relation to your personal data. We take these rights seriously and will respond to any verified request within the timeframes prescribed by law — in most cases within 15 calendar days for LGPD requests.
Right of Access
You may request confirmation of whether we hold personal data about you, and if so, a copy of that data together with information about how it is processed.
Right of Correction
If your personal data is inaccurate, incomplete, or out of date, you have the right to request that we correct or update it without undue delay.
Right of Deletion / Erasure
You may request the deletion of personal data processed with your consent, or data that has been processed in violation of the LGPD, subject to exceptions where retention is required by law.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
Right to Object
You may object to processing carried out on the basis of legitimate interests or in the public interest. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to Data Portability
You may request that we provide your personal data in a structured, commonly-used, machine-readable format, and where technically feasible, transmit it directly to another controller.
Right to Restriction
In certain circumstances — such as while we verify the accuracy of your data or assess an objection — you may request that we restrict our processing of your data to storage only.
Right to Lodge a Complaint
If you believe we have processed your data unlawfully, you have the right to lodge a complaint with Brazil's ANPD or, where GDPR applies, with the relevant EU supervisory authority in your country of residence.
How to exercise your rights: Send a written request to [email protected] with the subject line "Privacy Rights Request". To protect your privacy, we may need to verify your identity before processing the request — typically by asking you to confirm information we already hold about you. We will not charge a fee for reasonable, good-faith requests.
Children's Privacy
Our website and services are directed exclusively at adults and business professionals. We do not knowingly collect personal data from children under the age of 18, and we do not market to or target individuals below that age.
If we become aware that we have inadvertently collected personal data from a minor without verified parental or guardian consent, we will take immediate steps to delete that data from our systems. If you are a parent or guardian and believe that a child under your care has provided us with personal information, please contact us at the address in Section 11 and we will act promptly to resolve the matter.
Where the processing of children's data is required in the context of any future service offering (for instance, parental-consent management), we will implement additional safeguards consistent with LGPD Article 14 and equivalent provisions of the GDPR.
Changes to This Policy
We review this Privacy Policy at least once a year and whenever there is a material change in our data-processing activities, applicable law, or our technology infrastructure. When we make changes, we update the "Last updated" date at the top of this page.
If we make significant changes — for example, changes to the purposes for which we process your data, to the categories of third parties with whom we share it, or to your rights — we will take additional steps to inform you. Depending on the nature of the change and the data we hold, this may include displaying a prominent notice on our website or contacting you directly if we have your email address and the change materially affects you.
Your continued use of our website after the effective date of any revised policy constitutes your acknowledgement of the changes. We encourage you to review this page periodically to stay informed about how we protect your information.
Contact & Data Protection Officer
Questions, concerns, or requests relating to this Privacy Policy or to our data-processing practices should be directed to us using the contact details below. We are committed to working with you to resolve any privacy-related concern in a timely and transparent manner.
Under the LGPD, Movcash has designated a Data Protection Officer (Encarregado de Proteção de Dados) who can be reached via the email address listed below.
Centro, São Bernardo do Campo — SP, Brazil
If you are not satisfied with our response, you have the right to escalate your concern to Brazil's National Data Protection Authority (Autoridade Nacional de Proteção de Dados — ANPD) at www.gov.br/anpd, or to the competent data-protection supervisory authority in your country of habitual residence if you are located within the European Economic Area.