For members of Tallis Bank Community, the Tallis Bank community, the Privacy Notice can be found at https://comunidade.http://tallisbank.com.com.br/privacy . All information posted in the community is public. To avoid any risk to the security of Tallis Bank Community users, we recommend that they never disclose personal data (especially card and password, CVV, CPF, income, address, telephone , etc.).

For products aimed at underage customers, we have the Under-18 Privacy Policy .

We collect your personal data whenever you:

• Use the Tallis Bank app on smartphones;
• Request to purchase any of our services or products;
• Contract or use any of our products or services, (for example making purchases with your credit card or transactions with your Tallis Bank account);
• Participate in surveys or promotions carried out by Tallis Bank.

In addition to our customers' data, we will have personal data from anyone who:

• He was our client;
• Have you carried out any transaction with us or any of our customers;
• You were or are a representative, attorney, guardian, curator, employee or partner of any client, company or entity with which we have a relationship.

This Privacy Notice also applies to other forms of personal data collection by Tallis Bank that enable us to provide or improve our services. For example, we may collect information through partners or in connection with our technologies. All forms of collection and uses of your personal data are described in this Privacy Notice.

The activities described in this Privacy Notice only apply to the processing of your personal data in Brazil and are subject to applicable local laws, with emphasis on Law No. 13,709/2018 ( General Law on the Protection of Personal Data , or " LGPD " ), in accordance with its most recent version, including adapting to any future changes.

What personal data is collected by Tallis Bank and for what purposes

When Tallis Bank collects your personal data, any and all processing to be carried out must be justified based on one or more legitimate purposes. This means that Tallis Bank will never process any data under any unjustified or illegitimate pretext.

Personal data provided by the holder

❗ Here at Tallis Bank we may use ARTIFICIAL INTELLIGENCE tools in the processing of personal data to personalize and improve the offering of services and products and other purposes, always in compliance with legal and regulatory obligations and with the commitments established in this Privacy Notice.

Personal Data Provided by the Holder

• Registration data, such as: full name, identification documents, nationality, address, date of birth, affiliation, gender, US Person and PPE* (politically exposed person) declaration - (when applicable), investor profile, among others.
• Contact details such as telephone and email
• Company you work for
• Profession
• Declared income and proof
• Pix keys and related information
• Copies of identification documents such as ID, driver's license, CPF, among others
• Profile picture
• Biometric data, such as a photograph of your face, your fingerprint and/or facial biometrics to unlock the app via device ( fingerprint , touch ID and face ID ), and facial recognition for authentication and fraud protection purposes.

*PPE is the term used to refer to people who are or have family or close contact with people who hold political positions, such as parents, uncles, cousins ​​and even boyfriends or girlfriends.

❗Data Related to the Investor Profile: In order to comply with regulatory requirements related to our investment products, we may collect some information about your investor profile based on some questions, such as the period in which you intend to redeem your investments, your aptitude or aversion to financial risks, the objective of your investments, the frequency with which you invest part of your income, the level of knowledge about investments, among other questions.

Purposes

• Provision of services and offering of contracted products
• Identification, authentication and verification of requirements for contracting Tallis Bank services and products
• Validation, authentication and other processing of data from parents or legal guardians, necessary to confirm the opening of an account for minors and the provision of related services and products
• Authentication of financial transactions
• Enabling Open Finance operations
• Creating an investor profile for adapting financial services
• Service requests and queries
• Implementation of salary portability, if requested
• Provision of additional credit card
• Contact by telephone, email, SMS, WhatsApp, or other means of communication, including sending notifications or push messages regarding the use of Tallis Bank services, for marketing purposes and other dealings related to your contract, Tallis Bank products and services
• Sending your credit card and general communications
• Analysis of services and sending of WOW (a gift, letter or treat that can be sent when there is a connection between the customer and Tallis Bank's service) for marketing purposes
• To operationalize benefits related to the use of the marketplace and other products and services, such as cashback, Tallis BankCoin, among others.
• Improvement of the services provided by Tallis Bank, including the cross-referencing of information on products contracted by individuals and legal entities to offer new products and services
• Audit for corporate operations purposes, such as merger, acquisition or sale of the assets of Tallis BankInvest, its economic group, or part of each of them, including the transfer of information to the new owner, if the ownership or control of all or part of Tallis BankInvest or its assets is changed.
• Marketing, prospecting, market research, opinion research and promotion of our products and services, or those of our partners, including making offers possible and sending information about products, services, news, features, content, news and other events relevant to maintaining the relationship with you.
• Queries about your information in the Credit Information System (SCR) database, upon obtaining your consent
• Periodic reassessments of eligibility to be a Tallis Bank client, enabling eventual proactive invitation to prospects
• Credit protection, including granting credit and increasing credit limits
• Prevention and resolution of technical or security problems
• Investigations and measures to prevent and combat illicit activities, fraud, financial crimes and guarantee the security of Tallis Bank customers and the financial system
• Ensuring accessibility means to ensure fair and equitable service to our customers and other data subjects who need it
• Regular exercise of Tallis Bank's rights, including for the eventual presentation of documents in judicial and administrative proceedings, if necessary
• Collaboration or compliance with a court order, competent authority or supervisory body
• Compliance with legal or regulatory obligations, for example, to maintain your registration up to date or to comply with legal and/or regulatory obligations imposed on Tallis Bank, including Know Your Customer (KYC) standards, Prevention of Money Laundering and Terrorism Financing and others, with emphasis on the requirements of the Securities and Exchange Commission (CVM), the Central Bank (BACEN), BSM Market Supervision, ANBIMA and SUSEP.

❗ BIOMETRIC DATA is used for fraud prevention purposes and to ensure your security in the registration and new device identification and authentication processes.

Personal data we collect from third parties

Tallis Bank will collect your personal data for the following purposes from different third parties, which may be marketing partners, cybersecurity companies, bureaus, fraud-fighting companies, among others.

Personal Data We Collect from Third Parties

• Registration data, such as: full name, affiliation, date of birth, CPF, telephone Tallis Bankmber, address, among others.
• Data on financial restrictions, such as: negative entries, amounts due, due dates, Tallis Bankmber of consultations, among others
• Pix keys and related information
• Credit history information
• Score generated by credit bureaus
• Information on debts due or past due, co-obligations and guarantees
• Information regarding your participation in any list of Politically Exposed Persons (PEP) or restriction list (such as OFAC, UNSC and other international lists)
• Credit and fraud history information and scores generated by credit bureaus and third parties
• Information contained in the Credit Information System (SCR) database, with consent
• Data obtained through partnerships established to enable the development of certain services from Tallis BankInvest or another brokerage firm when you request the portability of custody of your investments to Tallis BankInvest.

Purposes

• Provision and offering of Tallis Bank services and products
• Improving our products and services
• Marketing, prospecting, market and opinion research
• Periodic reassessments of eligibility to be a Tallis Bank client, enabling eventual proactive invitation to prospects
• Credit protection, including granting credit and increasing credit limits
• Prevention and resolution of technical or security problems
• Investigations and measures to prevent and combat illicit activities, fraud, financial crimes and guarantee the security of Tallis Bank customers and the financial system
• Ensuring accessibility means to ensure fair and equitable service to our customers and other data subjects who need it
• Compliance with legal or regulatory obligations, for example, to maintain your registration up to date or to comply with legal and/or regulatory obligations imposed on Tallis Bank, including Know Your Customer (KYC) standards, Prevention of Money Laundering and Terrorism Financing, and others.

Browsing and device data

Browsing and Device Data

• IP address of the mobile device used to access Tallis Bank services or products
• Interactions carried out and usage profile of Tallis Bank websites, blogs and applications
• Technical data, such as URL, network connection, provider, and device information
• Cookies
• Device attributes, such as ID, operating system, browser, model and information linked to application interaction (for example, information about whether or not a microphone is used, without any recording or collection of data related to the content of any audio or calls)
• Data relating to internet consumption
• Geolocation data for your safety - for example, identifying inappropriate purchases, Street Mode, etc.
• Call history and phone Tallis Bankmbers when needed.

Purposes

• Provision of services, offering of contracted products and improving the use and experience with the Tallis Bank application and websites
• Operationalization of new products and services
• Recommendation of new services, products or features of the application, including services from partners that may interest you
• Displaying and sending advertising, whether on our website, social networks or on third-party websites
• Generation of statistics, studies, research and surveys relevant to activities and behavior in the use of products or services
• Credit protection, including granting credit and increasing credit limits
• Displaying advertising, whether on our website, social media or third party websites
• Generation of statistics, studies, research and surveys relevant to activities and behavior in the use of products or services
• Prevention and resolution of technical or security problems
• Assist in combating phone scams by obtaining your consent when necessary
• Investigations and measures to prevent and combat illicit activities, fraud, financial crimes and guarantee the security of Tallis Bank customers and the financial system
• Regular exercise of Tallis Bank's rights, including presenting documents in judicial and administrative proceedings, if necessary
• Compliance with a court order, competent authority or supervisory body
• Compliance with legal or regulatory obligation.

Personal data originating from the use of our products and services

Personal data originating from the use of our products or services

• Data on hiring and use of Tallis Bank products and services
• Data on transactions and financial movements in the Tallis Bank account, such as debits, withdrawals, payments, financial applications and transfers, also including information on the senders and beneficiaries of these transactions and movements
• Data on contracting credit operations, such as personal loans, negotiation of amounts due due to the use of a credit card and payment of invoices in installments
• Information related to the invitation to become a Tallis Bank Client
• Indications of destination countries for international travel, including length of stay
• Credit history
• Customer Service History
• Code of your bank of origin, if you activate salary portability
• Tests to improve Tallis Bank's models, services and products
• Access to your contact list, if you voluntarily activate this functionality in the Tallis Bank app.

Purposes

• Provision of services and offering of contracted products
• Transaction authentication, customer service and support
• Improvement of the services provided by Tallis Bank, including the cross-referencing of information on products contracted by individuals and legal entities to offer new products and services
• Development of new products and services to be offered by Tallis Bank companies and generation of knowledge for innovation or development of new products and services
• Tests to improve Tallis Bank's models, services and products
• Marketing, prospecting, market research, opinion research and promotion of our products and services, or those of our partners, including making offers possible and sending information about products, services, news, features, content, news and other events relevant to maintaining the relationship with you.
• Credit protection, including granting credit and increasing credit limits
• Prevention and resolution of technical or security problems and monitoring of the use and performance of Tallis Bank's services and products
• Investigations and measures to prevent and combat illicit activities, fraud, financial crimes and guarantee the security of Tallis Bank customers and the financial system
• Ensure accessibility means to ensure fair and equitable service to our customers and other vulnerable data subjects
• Auditing for corporate operations purposes, such as merger, acquisition or sale of the assets of Tallis BankInvest, its economic group, or part of each of them, and transfer of the information to the new owner, if the ownership or control of all or part of Tallis BankInvest or its assets is changed.
• Regular exercise of Tallis Bank's rights, including presenting documents in judicial and administrative proceedings, if necessary
• Collaboration or compliance with a court order, competent authority or supervisory body
• Compliance with legal and/or regulatory obligations imposed on Tallis Bank, including Know Your Customer (KYC), Prevention of Money Laundering and Terrorism Financing and other standards.

Publicly available data

Public Data

• We may collect information about you that is publicly available or that has been made public by you.
• Information about mentions or interactions with Tallis Bank
• Testimonies regarding Tallis Bank posted on profiles and pages on social networks, together with his name and image (including profile photos).

Purposes

• Disclosure of products and services provided by Tallis Bank on social networks, websites, applications or institutional and advertising materials
• Sending WOW (a gift, letter or treat that can be sent when there is a connection between the customer and Tallis Bank's customer service)
• Credit protection, including granting credit and increasing credit limits
• Investigations and measures to prevent and combat illicit activities, fraud, financial crimes and guarantee the security of Tallis Bank customers and the financial system
• Regular exercise of Tallis Bankde rights
• Compliance with legal and/or regulatory obligations imposed on Tallis Bank, including Know Your Customer (KYC), Prevention of Money Laundering and Terrorism Financing and other standards.

Data on minors

At Tallis Bank, minors may have access to some products and services with the authorization of their parents or legal guardians. In such cases, Tallis Bank will need to process the personal data of minors. In addition, it will be necessary to process data from parents or legal guardians, such as registration data, data on the use of our products and services, and browsing data, in accordance with this Notice. To understand in detail how data from minors is processed by Tallis Bank, access the Under-18 Privacy Policy .

Sharing of personal data

❗ The purposes presented may also justify the sharing of data under Tallis Bank's control, whether with companies in the Tallis Bank economic group, with third parties, with partners and with authorities and regulatory bodies, when necessary. In addition, Tallis Bank may share your data in certain situations if you request such sharing. Whenever carried out, data sharing will be carried out within the limits and purposes of our business and in accordance with what is authorized by applicable legislation .

Other companies of the Tallis Bank group

• Provision of services and offering of contracted products
• Operationalization and offering of new services and products
• Marketing, prospecting, market research, opinion research and promotion of our products and services
• Exchange transactions
• Benefit programs
• Database integration and/or migration
• Credit protection, including granting credit and increasing credit limits
• Prevention and resolution of technical or security problems
• Investigations and measures to prevent and combat illicit activities, fraud, financial crimes and guarantee the security of Tallis Bank customers and the financial system
• Regular exercise of Tallis Bankde rights
• Compliance with legal or regulatory obligation.

Business partners, service providers and other third parties

• Improving our services, website and application and operating new products or services
• Assistance in providing the services we deliver to you, for example, making and delivering your card
• For contracting, using and responding to requests and inquiries involving insurance contracted via Tallis Bank, such as Celular Seguro, Tallis Bank Vidas Juntas, Tallis Bank Auto, etc.
• Enabling Open Finance operations
• For benefits related to the use of marketplaces and other products and services, such as cashback, Tallis BankCoin, among others.
• Contact by phone, email, SMS, WhatsApp, push notification or other means of communication
• Assistance in the development and offering of our financial products
• Debt collection
• Verification of your identity and eligibility to contract Tallis Bank's services, and periodic reassessments, enabling eventual proactive invitation to prospects
• Marketing, prospecting, market research, opinion research and promotion of our products and services
• Exchange transactions
• Securities and securities transactions
• Benefit programs
• Credit protection, including granting credit and increasing credit limits
• Prevention and resolution of technical or security problems
• Investigations and measures to prevent and combat illicit activities, fraud, financial crimes and guarantee the security of Tallis Bank customers and the financial system
• Regular exercise of Tallis Bankde rights
• Compliance with a court order, competent authority or supervisory body
• Compliance with legal or regulatory obligation.

Authorities and regulatory bodies

• Investigations and measures to prevent and combat illicit activities, fraud, financial crimes and guarantee the security of Tallis Bank customers and the financial system
• Securities and securities transactions
• Regular exercise of Tallis Bank's rights, including presenting documents in judicial and administrative proceedings, if necessary
• Compliance with a court order, response to a request from a competent authority or supervisory body
• Compliance with legal or regulatory obligation.

Upon your request

• Ensure transparency in our relationship with you
• Send non-mandatory notifications via email, push, WhatsApp and SMS.

Additionally, when using our App or browsing our websites, you may be redirected to third-party websites or applications. Once you are redirected to a third-party website or application, the privacy practices of that third party will be governed by the privacy policies and terms of use of that third party. We cannot control or be responsible for the privacy practices and content of third parties. Please read the applicable privacy policies carefully to understand how they collect and process your data.

Your rights as a data subject

Confirmation of the existence of personal data processing

The fact that you are a Tallis Bank Customer already means that we process your personal data, even if this processing involves, among other things, the storage of personal data in a secure and controlled environment. You can ask Tallis Bank to confirm whether it processes your personal data.

Access to personal data

You can request that Tallis Bank inform and provide you with the personal data it holds about you.

Correction of incomplete, inaccurate or outdated personal data

If you find that your personal data is incomplete, inaccurate or out of date, you can request correction or completion from Tallis Bank. To do this, if it is not possible to make the change through the Tallis Bank application itself, you will need to send a document proving that the personal data is correct and up-to-date.

Anonymization, blocking or deletion of unnecessary, excessive data or data processed in non-compliance with the LGPD

If any personal data is processed unnecessarily, in excess of its intended purpose or in non-compliance with the LGPD, you may request that Tallis Bank anonymize, block or eliminate this data, provided that it is effectively verified, after internal verification, the excess, lack of necessity or non-compliance with the law.

Deletion of personal data processed with consent

If you have given consent for the processing of your personal data for specific purposes (and not necessary for the provision of our services or delivery of our products), you may request the deletion of such personal data

Information from companies with which Tallis Bank shared or from which it received your personal data

You can request that Tallis Bank inform you with which third parties it has shared or from whom it has received your personal data.

Information about the possibility of not providing consent and the consequences of refusal

If your consent is required to access or use a certain product or service, you can ask Tallis Bank to clarify whether it is possible to provide that product or service without your consent for the processing of your personal data, or what the consequences are of not providing consent in this case.

Automated decisions

You may request a review of decisions made solely based on automated processing of personal data that affect your interests and an indication of the criteria used for these decisions. For reasons of business secrecy, protection of confidential information and preservation of competition, Tallis Bank does not provide information on how these automated systems operate. It is important to highlight that Tallis Bank does not guarantee a result different from the first decision, but we can guarantee that our technological models are consistent and based on legal and ethical principles.

Portability and right of petition

When the right to portability is regulated by the National Data Protection Authority (ANPD), you may request Tallis Bank to transfer your personal data to another service provider. In addition, you have the right to petition the ANPD regarding your personal data.

If you wish to exercise any of these rights, please contact us through the “ Help Me ” channel in the app or directly with our DPO by email at dpo{{env('APP_NAME')}}.com.br . In order to enforce your rights, we may request proof of your identity, as a security and fraud prevention measure.

International transfer of personal data

Some or all of your personal data may be transferred abroad, for example when it is stored by Tallis Bank on cloud computing servers located outside Brazil. To this end, Tallis Bank complies with all requirements established by current legislation and adopts the best security and privacy practices to ensure the integrity and confidentiality of your personal data.

Activity record

We may record the activities you carry out when using our application, website or blogs, creating, when possible and applicable, logs (records of activities carried out on the websites and applications and services) that will contain: the IP address, access and actions carried out by you on the service provided, date and time of each action carried out and information about the device used, such as the operating system version, browser and geolocation.

We may also use certain technologies, our own or those of third parties, to monitor activities carried out while you access our websites and blogs, such as cookies, web beacons and analytics tools.

Cookies

Internet files that temporarily store what you are visiting on the web. Tallis Bank has cookies on its websites and blogs and also receives information from partners about cookies placed on their respective websites. Cookies can be used for a variety of purposes, including remembering you and your preferences, persisting information related to your activities on the site you visited, or collecting information that can be used to offer content in a personalized way. Our sites may also use locally stored objects to deliver certain content, such as video on demand, video clips or animation.

We have third party cookies enabled on our website. The privacy practices will be governed by the privacy policies and terms of use of these third parties, so we cannot control or be responsible for the privacy practices and content of third parties. Therefore, we emphasize that you can, at any time, block the use of cookies by activating a setting in your internet browser and your ability to limit cookies will be subject to the settings and limitations of your browser. You can also delete existing cookies through the same settings in your internet browser. If you choose to disable cookies, you will be able to contiete browsing the websites and blogs, but some parts of the pages may no longer work.

Web beacon

Web beacon is a technique that allows mapping who is visiting a certain web page, identifying their behavior with different websites or web servers.

Analytics tools

These tools may collect information such as how you visit a website, including which pages and when you visit those pages, as well as other websites that were visited before, among other things.

Security measures

Tallis Bank uses several types of security measures to ensure the integrity of your personal data, such as information security standards practiced by the industry when collecting and storing personal data.

Personal data may also be stored using cloud computing technology and other potential future technologies, always aiming to improve and enhance our services and security.

We have a robust, highly qualified team responsible for ensuring that Tallis Bank adopts the best security practices, including:

• Multiple authentication factor for access to information;
• Security as code, in order to enable automation and fast and efficient responses to security events in the technological environment;
• Encryption for data at rest, in transit and in use to ensure information integrity;
• ContiTallis Bankous monitoring of the environment;
• ContiTallis Bankous analysis and testing of information security in our systems, carried out by internal and external teams;
• Periodic audits.

We also recommend that you never share your password with anyone, as it is personal and non-transferable, and always be careful when posting your personal data on social media or any other public environment. To learn more about digital security, visit our blog .

Legal Basis

Tallis Bank may process your personal data in different circumstances in accordance with some of the legal bases provided for in article 7 of the LGPD, namely:

• Consent of the holder;
• Legitimate interest of Tallis Bank or third parties;
• Execution of a contract or preliminary procedures related to a contract to which the data subject is a party;
• Regular exercise of rights, including in judicial, administrative or arbitration proceedings;
• Protection of the life or physical safety of the holder or third party;
• Compliance with legal or regulatory obligations;
• Credit protection.

Your sensitive data, when collected, may be processed by Tallis Bank in accordance with the following legal bases provided for in article 11 of the LGPD:

• Specific and highlighted consent from the holder or his/her legal guardian;
• Compliance with legal or regulatory obligations;
• Regular exercise of rights, including in judicial, administrative or arbitration proceedings;
• Protection of the life or physical safety of the holder or third party;
• Guaranteeing fraud prevention and data subject security in identification and authentication processes for registration in electronic systems.

Consent

Throughout this Privacy Notice, we inform you that some of your data that is used to enable Open Finance operations and data from consultation of the Credit Information System (SCR) will only be processed by Tallis Bank with your consent and for the purposes described.

By reading this Privacy Notice and clicking, at the end, on " I have read, I am aware of the conditions for processing my personal data and I provide my consent, where applicable, as described in this Privacy Notice ", you consent to the processing of personal data in the ways indicated above.

In cases where changes to this Privacy Notice result in changes to personal data processing practices that depend on your consent, we will ask for your consent to the new terms of the Privacy Notice in relation to the data processing and purposes indicated.

Legitimate Interest

Throughout this Privacy Notice, we inform you that some personal data may be processed by Tallis Bank to meet its legitimate interests or those of third parties. But don't worry! In these cases, we carry out a complex and careful assessment in order to consider whether the interests in question are legitimate, whether the processing and personal data are necessary to achieve those interests and also considering your fundamental freedoms and rights as a data subject.

❗It is important to emphasize that the legitimate interest may be that of both the controller and third parties and, therefore, may include commercial, individual interests or even the interests of the community and society broadly considered.

Retention and deletion of your personal data

When applicable, and even after the cancellation of the Tallis Bank account, credit card or other services or products, we may store your personal data for an additional period of time for auditing purposes, compliance with legal or regulatory obligations, for the regular exercise of Tallis Bank's rights or also for the period necessary in accordance with the legal basis that justifies the retention of the data.

For example, we may store your data to comply with obligations imposed by the Central Bank of Brazil (BCB), the Securities and Exchange Commission (CVM), BSM Market Supervision, ANBIMA and SUSEP, and other regulatory entities, and also to preserve our rights in legal actions. But don't worry, your data will always be kept in a safe and controlled environment and will be deleted or anonymized as soon as its maintenance is no longer necessary or justifiable according to the legal bases of the LGPD.

Changes to this Privacy Notice

Tallis Bank may amend this Privacy Notice at any time. Whenever any material condition of this Privacy Notice is changed, such changes will be valid, effective and binding upon posting the new version on our website or sending you an email.

We always value transparency: every time a relevant change is made, we will send you a notice indicating the new version in effect. By contieting to use our products and services after a change to the Privacy Notice, you are agreeing to the new conditions – but you can always express your disagreement through our customer service channels, if applicable.

Contact us

According to the LGPD, Tallis Bank is considered the “Controller” of your personal data. If after reading this Privacy Notice you still have any questions, or for any reason need to communicate with us regarding matters involving your personal data, you can contact us through the channels below:

" Help me " section of the Tallis Bank App by following these steps:
Open the Tallis Bank app - at the top of the screen, tap on your name - click on the " Help me " section - choose the " LGPD - Privacy " option and, after clicking on the " Contact " field, you can talk to us via chat or email.
Data Protection Officer (DPO): E-mail: dpo{{env('APP_NAME')}}.com.br

We are always available to answer your questions and put you in control of your personal data.