1. Introduction
Trio values the privacy and protection of the personal data provided by its data subjects, whether they are customers, partners, suppliers, employees or third parties affected by its activities. Recognizing that the sector in which Trio operates every day involves sensitive information subject to a strict regime of protection and confidentiality, Trio undertakes to process personal data in compliance with the Lei Geral de Proteção de Dados Pessoais (LGPD — Brazil's General Data Protection Law, Law No. 13,709/2018), Lei Complementar nº 105/2001 (Complementary Law No. 105/2001, on banking secrecy), the rules of the Central Bank of Brazil (Bacen), the National Monetary Council (CMN) and the Council for Financial Activities Control (COAF), as well as other applicable legislation.
Trio operates in various sectors of the Brazilian Financial System with intensive use of technology, in full observance of the General Data Protection Law, offering solutions that involve the comprehensive and strategic processing of personal data. These activities include the collection and management of registration, financial and technological information of customers, partners, suppliers and end users, always in compliance with the applicable legal and regulatory requirements. This Privacy Policy was developed to cover these various operations, ensuring that data processing is carried out with transparency, security and respect for the rights of data subjects. The data subject understands and expressly agrees to the terms of this Policy.
Trio respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains, in a transparent and objective manner, how we collect, use, store, share and protect your personal information when you use our products, services, platforms and customer service channels. Trio's commitment is to ensure that the processing of personal data is conducted ethically, transparently and responsibly, respecting the data subjects' fundamental rights of freedom, privacy and informational self-determination. In addition, rigorous measures are adopted to ensure the integrity, security and confidentiality of the personal and financial data processed hereunder.
2. Terms and definitions
2.1. When referred to in this policy, the following terms shall have the following meanings:
2.1.1. ANPD (Autoridade Nacional de Proteção de Dados — National Data Protection Authority): The public administration body responsible for safeguarding, implementing and overseeing compliance with the General Data Protection Law (LGPD) in Brazil.
2.1.2. Bacen (Banco Central do Brasil — Central Bank of Brazil): The federal autonomous agency responsible for ensuring the stability of the currency's purchasing power, supervising the financial system and ensuring the proper functioning of the credit market.
2.1.3. CMN (Conselho Monetário Nacional — National Monetary Council): The highest body of the National Financial System, responsible for formulating monetary and credit policy, with a view to the economic stability and development of the country.
2.1.4. Coaf (Conselho de Controle de Atividades Financeiras — Council for Financial Activities Control): The federal government's financial intelligence unit, responsible for preventing and combating money laundering and terrorist financing.
2.1.5. Cookies: files stored on the user's device to improve the browsing experience and enable the personalization of services
2.1.6. Controller: Trio, which is responsible for decisions regarding the processing of personal data.
2.1.7. Personal Data: information that identifies or can identify a natural person, such as name, CPF (individual taxpayer ID), address and telephone number.
2.1.8. Sensitive Personal Data: information of a special nature, such as racial origin, religious beliefs, political opinion, health, sex life, biometrics and genetics.
2.1.9. Data Protection Officer (Encarregado, DPO): the professional appointed by Trio to act as the communication channel between data subjects, the institution and the National Data Protection Authority (ANPD).
2.1.10. LGPD: Lei Geral de Proteção de Dados Pessoais (General Data Protection Law) - Law No. 13,709/2018.
2.1.11. Logs: Electronic records documenting users' activities in systems and platforms, used for security, audit and control purposes.
2.1.12. Processor: A natural person or legal entity that processes personal data on behalf of the controller, following its instructions. In the context of this policy, it refers to contracted third parties or partners that process data on Trio's behalf.
2.1.13. Data Subject: The natural person to whom the personal data being processed refers.
3. Scope
3.1. This policy applies to all personal data processing operations carried out by Trio, covering both physical and digital environments.
3.2. The following are included in this scope:
3.2.1. Customers, whose corporate, contractual and registration data are processed in the context of contracting for and performing the services provided.
3.2.2. End users, whose financial data, identifiers and transaction information are processed during the use of the platforms and services offered.
3.2.3. Shareholders, legal representatives, attorneys-in-fact, employees, interns, service providers, business partners and suppliers, as well as any other personal data subjects whose information is collected, stored, used or otherwise processed by Trio in the course of its activities.
3.3. This approach ensures that all data processed by the organization is subject to the guidelines and obligations set forth in this Policy, in compliance with the LGPD and other applicable rules.
4. Principles and guidelines
4.1. Legal and Regulatory Bases
4.1.1. Trio's processing of data is based on the legal grounds provided for in the LGPD, such as the data subject's consent, compliance with legal and regulatory obligations, the performance of contracts or of preliminary procedures related to contracts, the regular exercise of rights in administrative and judicial proceedings, credit protection and fraud prevention. In addition, Trio strictly observes the provisions of Complementary Law No. 105/2001, ensuring full respect for banking secrecy, as well as the resolutions issued by Bacen, the CMN and COAF governing the prevention of money laundering and terrorist financing.
4.2. Data Collected
4.2.1. In the course of its activities, Trio may collect different categories of data: registration data (name, corporate name, CPF, RG (national identity card), CNPJ (company tax ID), address, telephone, email), financial data (information on account activity and transaction history, fully protected by banking secrecy), technological data (IP address, access records, geolocation, cookies, digital identity, facial biometrics, selfie) and data from third parties (credit bureaus, lists of Politically Exposed Persons (PEP), reports from regulatory bodies and other official sources).
4.3. Purpose of Processing
4.3.1. The information collected is used for legitimate purposes that have been previously disclosed and are compatible with the relationship established with the data subjects. These purposes include: registration review, performance of contracts and provision of payment services; compliance with legal and regulatory obligations; preventing and combating fraud, financial crimes, money laundering and terrorist financing; security of operations and audits; customer service and support; and the development of products, services and technological solutions that improve the user experience.
4.4. Information Security
4.4.1. Trio adopts appropriate technical and administrative measures to protect personal data, including encryption, firewalls, multi-factor authentication, restricted access controls and continuous monitoring of systems. In addition, all employees, service providers and suppliers are bound by contractual clauses containing confidentiality obligations, including, but not limited to, provisions relating to personal data.
4.5. Use of Artificial Intelligence for Data Collection and Analysis
4.5.1. Trio may employ Artificial Intelligence (AI) technologies, advanced analytical models and automated systems in the processing of personal data, including the collection, classification, analysis, monitoring and processing of information, for the purpose of strengthening operational security mechanisms, fraud prevention and detection, risk management, and the prevention of money laundering and terrorist financing (PLD/FT — anti-money laundering and counter-terrorist financing, AML/CFT), as well as ensuring compliance with the legal, regulatory and prudential obligations applicable to payment institutions and with the other regulations issued by the Central Bank of Brazil. Such technologies may also be used to improve, develop and offer personalized products, services and financial solutions, in observance of the principles of purpose, necessity, transparency, security and non-discrimination and the other guidelines set forth in the applicable personal data protection legislation.
4.5.2. The use of AI shall observe the principles of purpose, necessity, transparency, security and non-discrimination, and the use of personal data for purposes incompatible with those disclosed to the data subjects is prohibited.
4.5.3. Trio ensures that relevant decisions capable of affecting the rights of data subjects are not made solely by automated means, guaranteeing, where applicable, the possibility of human review. In addition, controls are adopted to mitigate risks related to bias, errors and misuse of data. The models and systems used are also subject to periodic validation, monitoring and ongoing review processes, in order to ensure their suitability, reliability and compliance.
4.5.4. Where applicable, the use of AI solutions provided by third parties shall observe contractual, technical and information security requirements, ensuring a level of protection compatible with the LGPD, banking secrecy and Bacen regulations.
4.5.5. Trio does not use sensitive personal data or data protected by banking secrecy to train general-purpose AI models without an adequate basis, security controls and risk assessment.
4.6. Storage and Retention
4.6.1. Data is stored in secure environments, on proprietary or contracted servers located in Brazil or abroad, provided that a level of protection equivalent to that required by the LGPD is ensured and banking secrecy rules are observed. By force of law and regulation, certain data must be retained for a minimum period of ten years after the end of the contractual relationship, as required by Bacen, COAF and Complementary Law No. 105/2001. After this period, the data is securely deleted or anonymized.
4.7. Sharing and International Transfer
4.7.1. The sharing of personal data is restricted and occurs only when necessary, such as for compliance with legal obligations, mandatory reports to regulatory bodies, partnerships with financial institutions or the engagement of technology and infrastructure providers. Whenever there is an international transfer of data, Trio will ensure that the recipient country or entity adopts protection standards equivalent to those required by the LGPD, without prejudice to compliance with the rules on banking secrecy.
4.8. Rights of Data Subjects
4.8.1. Trio ensures that data subjects have all the rights provided for in the LGPD, including confirmation of the existence of processing, access to information, correction of inaccurate data, anonymization, blocking or deletion of unnecessary data, portability, withdrawal of consent and the right to file complaints with the ANPD.
4.8.2. Finally, the Data Subject should be aware that certain requests may not be fulfilled by Trio for legal, regulatory or security reasons, including when the data must be retained to comply with legal obligations, prevent fraud, meet AML/CFT requirements or for the regular exercise of rights. In such cases, Trio will provide the data subject with the appropriate justification.
4.8.3. To exercise these rights, data subjects may contact Trio's Data Protection Officer (DPO) directly by email at dpo@trio.com.br.
5. General provisions
5.1. This Privacy Policy will be reviewed periodically, at least once a year, or whenever there are relevant legal, regulatory and operational changes. Substantial changes will be communicated to data subjects through Trio's official channels. 5.2. If you have any questions about any item or the application of this policy, contact compliance@trio.com.br or use the website trio.com.br.
5.3. If you are aware of, or have any indication of, non-compliance with the terms of this policy, contact compliance@trio.com.br, anonymously or with identification, or use the website trio.com.br.
6. Annexes and related documents
6.1. Code of Ethics and Conduct.
6.2. Information Security Policy.
6.3. Policy for the Prevention and Combating of Money Laundering and Terrorist Financing.
7. Regulatory references
7.1. Lei Geral de Proteção de Dados Pessoais (LGPD — General Data Protection Law), Law No. 13,709/2018: Governs the processing of personal data, including in digital media, by natural persons or by legal entities governed by public or private law, with the purpose of protecting the fundamental rights of freedom and privacy and the free development of the personality of the natural person.
7.2. Lei Complementar nº 105/2001 (Complementary Law No. 105/2001): Addresses the secrecy of the operations of financial institutions and establishes rules for the sharing of information within the National Financial System.
7.3. Resolução BCB nº 80 (Central Bank of Brazil Resolution No. 80), of March 25, 2021: Establishes requirements on the incorporation, operation, governance and transparency of institutions authorized to operate by the Central Bank of Brazil.
7.4. Resolução BCB nº 85 (Central Bank of Brazil Resolution No. 85), of April 8, 2021: Provides for the cybersecurity policy and the requirements for the contracting of data processing and storage and cloud computing services by financial institutions and other institutions authorized to operate by the Central Bank.
7.5. Resolução BCB nº 518 (Central Bank of Brazil Resolution No. 518), of November 3, 2025: Amends Resolução BCB nº 96 (Central Bank of Brazil Resolution No. 96), of May 19, 2021, which provides for the opening, maintenance and closing of payment accounts.
7.6. Resolução CMN nº 4.893 (National Monetary Council Resolution No. 4,893), of October 29, 2021: Establishes guidelines on the information security policy of financial institutions and other institutions authorized to operate by the Central Bank of Brazil.
7.7. COAF and Central Bank of Brazil regulations on Anti-Money Laundering and Counter-Terrorist Financing (PLD/FT): These include operational guidelines and obligations regarding reporting, customer identification and the monitoring of suspicious transactions.