privacy

1. controller

GB is the controller of personal data for the site, the portal and the relationship with corporate clients, under Brazil’s LGPD (Law 13,709/2018).

2. which data

Depending on onboarding, KYC and the operation:

• company: legal name, CNPJ or website, activity, address, revenue, constitutional documents, officers and beneficial owner;
• representatives, when needed: name, id document, address and, if required, biometric check;
• PEP status, purpose and source of funds;
• order ids, status, timestamps and Travel Rule data;
• support, whistleblowing and strictly necessary session cookies. This site does not use advertising cookies.

3. why

To perform the service, run KYC and AML, prevent fraud, answer authorities and keep records for the legal period.

4. sharing

GB does not sell personal data. It shares with the custodian, liquidity providers, settlement institutions, verification bureaus and authorities, including the Central Bank and Coaf. A payment abroad may require an international transfer, only as far as that operation needs.

5. retention

AML records are kept for at least ten years. PEP status stays for five years after the person leaves office.

6. rights

Access, correction and deletion when the law allows, plus information on sharing. Deletion does not override a legal duty to keep records.

7. security

Internal access is limited to the job. A suspected leak is reported to the technology director and to compliance.