Privacy Policy

Last Updated: January 2025

SOL CORRETORA DE CÂMBIO S.A. ("SOL Corretora," "we," "us," or "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, share, and protect your personal information in compliance with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais - LGPD - Law No. 13,709/2018) and other applicable data protection regulations.

1. Data Controller

The data controller responsible for your personal information is:

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Identification Data

• Full name
• CPF (individual taxpayer registration) or CNPJ (business registration)
• RG (identity card) or passport number
• Date of birth
• Nationality
• Marital status
• Professional occupation

2.2 Contact Data

• Email address
• Phone number
• Residential and/or business address

2.3 Financial Data

• Bank account information
• Income and asset information
• Transaction history
• Tax identification numbers

2.4 Compliance Data

• Know Your Client (KYC) documentation
• Source of funds information
• Politically Exposed Person (PEP) status
• Anti-Money Laundering (AML) screening results

3. Legal Basis for Processing

We process your personal data based on the following legal grounds under the LGPD:

• Compliance with legal obligation: To comply with BCB regulations, AML/CTF laws, and other applicable legal requirements.
• Contract execution: To perform the exchange contracts and provide our services.
• Legitimate interest: For purposes such as fraud prevention, risk management, and improving our services.
• Consent: For marketing communications and other purposes where we specifically request your consent.

4. How We Use Your Data

We use your personal data for the following purposes:

• Processing and executing currency exchange transactions
• Verifying your identity and conducting due diligence checks
• Complying with legal and regulatory obligations
• Preventing fraud, money laundering, and terrorist financing
• Communicating with you about your transactions and our services
• Improving our services and customer experience
• Sending marketing communications (with your consent)

5. Data Sharing

We may share your personal data with:

• Banco Central do Brasil (BCB): As required for regulatory reporting and compliance.
• Financial institutions: For processing transactions and settlements.
• Regulatory and law enforcement authorities: As required by applicable law.
• Service providers: Third-party providers who assist us with compliance, IT, and administrative services, under strict confidentiality agreements.

6. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including legal, regulatory, and contractual requirements. Under BCB regulations, certain transaction records must be retained for a minimum of 5 years. After the retention period, your data will be securely deleted or anonymized.

7. Your Rights Under the LGPD

Under the LGPD, you have the following rights regarding your personal data:

Right	Description
Confirmation and Access	Confirm whether we process your data and access copies of such data.
Correction	Request correction of incomplete, inaccurate, or outdated data.
Anonymization, Blocking, or Deletion	Request anonymization, blocking, or deletion of unnecessary or excessive data.
Data Portability	Request transfer of your data to another service provider.
Deletion	Request deletion of data processed with your consent.
Information about Sharing	Know which public and private entities we share your data with.
Consent Withdrawal	Withdraw your consent at any time, without affecting the lawfulness of prior processing.
Review of Automated Decisions	Request review of decisions made solely based on automated processing.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, firewalls, and regular security audits.

9. International Data Transfers

Your personal data may be transferred to and processed in countries outside Brazil when necessary for international transactions. We ensure that such transfers comply with the LGPD and that adequate data protection measures are in place.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on our website and, where appropriate, by direct communication.

11. Contact and Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

You also have the right to lodge a complaint with the Brazilian National Data Protection Authority (ANPD) if you believe your privacy rights have been violated.