Last updated: September 2026
Finadi Capital Securitizadora de Créditos S.A., enrolled with the CNPJ under No. 52.781.181/0001-34, with registered office at Avenida Paulista, 1636, Suite 1105/632, Bela Vista, São Paulo/SP, postal code 01310-200 ("Finadi Capital", "we"), respects your privacy. This Policy explains how we process personal data collected through this website, contact and registration forms, and our relationship with noteholders, assignors and partners, in accordance with Law No. 13.709/2018 — Brazil’s General Data Protection Law (LGPD).
This English version is a professional translation of the original Portuguese text, intended for human legal review. In case of conflict, the Portuguese text prevails.
1. Who is the controller
Finadi Capital is the controller of the personal data processed under this Policy. Questions and requests may be sent to our Data Protection Officer at the email indicated in section 10.
2. What data we collect
Data you provide to us
- Contact form: name, email, phone, company and the content of the message.
- Noteholder registration (individual): identification data (name, CPF, ID document, date of birth, filiation, nationality, marital status, occupation), contact details, address, financial information (income and net-worth brackets, source of funds, investor profile), politically exposed person status, bank details and copies of documents.
- Noteholder registration (legal entity) and assignor registration: company registration data, revenue, corporate structure and identification and contact data of partners, officers, representatives and ultimate beneficial owners, as well as corporate and personal documents.
Data collected automatically
- IP address, date and time of access, browser and device type, recorded for security and fraud prevention, under the Brazilian Internet Civil Framework (Law No. 12.965/2014).
- Cookies, as described in our Cookie Policy.
We do not request sensitive personal data. Please do not include them in messages or documents unless indispensable.
3. Why we use the data and on what legal basis
| Purpose | Legal basis (LGPD) |
|---|---|
| Responding to contacts and requests | Legitimate interest and pre-contractual steps (Article 7, IX and V) |
| Identifying and qualifying investors and assignors (KYC), assessing risks and preventing money laundering and terrorist financing | Compliance with a legal and regulatory duty — Law No. 9.613/1998 and CVM Resolution No. 50/2021 (Article 7, II) |
| Assessing the feasibility of assignment and securitization transactions | Pre-contractual steps and performance of a contract (Article 7, V) |
| Formalizing and administering the relationship with noteholders, including payments and information | Performance of a contract and compliance with a legal duty (Article 7, V and II) |
| Ensuring website security and preventing fraud | Legitimate interest and fraud prevention (Article 7, IX; Article 11, II, "g") |
| Measuring website audience (analytics cookies) | Consent (Article 7, I) |
| Exercising rights in judicial, administrative or arbitral proceedings | Regular exercise of rights (Article 7, VI) |
4. With whom we share
We share data only when necessary and with partners subject to a duty of confidentiality:
- companies in the Finadi ecosystem, for the performance of operations;
- the trustee, registrar, registration entities, custodians and auditors of the issuances;
- financial institutions involved in payment settlement;
- technology, hosting, storage and communications providers;
- legal and accounting advisers;
- public authorities and regulators, such as CVM, the Central Bank, COAF and the Federal Revenue Service, when required by law or court order.
We do not sell personal data.
5. International transfer
Some technology providers may store data on servers outside Brazil. In those cases we adopt the safeguards provided in Article 33 of the LGPD, such as standard contractual clauses.
6. How long we keep data
We keep data for as long as necessary for the stated purposes and to meet legal duties. Customer and counterparty registration data and documents are kept for at least five years after the end of the relationship, under anti-money-laundering rules. Access logs are kept for six months, under the Internet Civil Framework. Contact messages with no follow-up are deleted after two years.
7. Your rights
Under Article 18 of the LGPD, you may request: confirmation that processing exists; access to the data; correction of incomplete or outdated data; anonymization, blocking or deletion of unnecessary data or data processed in non-compliance; portability; information about sharing; withdrawal of consent; and review of automated decisions.
Some requests may be limited where retention is required by law — for example, KYC records. In those cases we will inform the legal basis.
8. How we protect the data
We adopt technical and administrative measures consistent with the nature of the data: encryption in transit (HTTPS), document storage in a private area not publicly accessible, role-based access control with access logs, and staff training. No system is fully immune to incidents; if a relevant incident occurs, we will notify data subjects and the ANPD as required by law.
9. Minors
Our services are not intended for persons under 18, and noteholder registration is restricted to adults.
10. Data Protection Officer and contact
Data Protection Officer: [email protected]. You may also use the contact form, selecting the subject “Privacy and personal data”. If you consider that your requests have not been addressed, you may file a complaint with Brazil’s National Data Protection Authority (ANPD).
11. Updates
This Policy may be updated at any time. The current version will always be available on this page, with the date of the last update.