Privacy notice

1. Who we are

olaMac Security & Logistics, CNPJ (not yet published), with registered office at (not yet published), is the controller of the personal data described in this notice, under the General Data Protection Law (LGPD, Law 13.709/2018).

For data protection matters, contact us at (not yet published).

2. What we collect

• Identification and contact data: name, CPF, date of birth, nationality, address, email and telephone number, and identity document details (RG, CNH, passport or RNE/CRNM).
• Documents you upload to verify your identity and address and, for legal entities, CNPJ and corporate documents identifying directors and beneficial owners.
• Account and custody data: your metal holdings, deposits, withdrawals, transfers of ownership, delivery addresses, documents you request, invoices and payment references. If you transfer metal to another client, or receive it, the other party sees your name and account number.
• Communications: secure mailbox messages, chat transcripts and support tickets.
• Security data: sign-in times, IP addresses, device information and an audit record of actions taken on your account.

We do not collect or store payment card numbers.

3. Why we use it and our legal bases (LGPD, article 7)

• To perform our contract with you: custody, storage, verification, transport and billing (article 7, V).
• To comply with legal and regulatory obligations, including anti-money-laundering duties under Law 9.613/1998, tax and record-keeping obligations (article 7, II).
• To exercise rights in legal, administrative or arbitral proceedings (article 7, VI).
• For our legitimate interests in securing your account and our premises and preventing fraud, always respecting your fundamental rights (article 7, IX).
• With your consent, for optional notifications such as SMS alerts, which you can withdraw at any time in your profile (article 7, I).

4. Who we share it with

We share personal data only with: carriers and insurers needed to transport and protect your metal; banks and payment institutions that process your payments; auditors, legal advisers and technology providers bound by confidentiality; and public authorities where the law requires, such as the Financial Activities Control Council (COAF), tax authorities and courts. We do not sell personal data.

5. International transfers

Where personal data is transferred outside Brazil, we do so only in the cases permitted by article 33 of the LGPD, such as standard contractual clauses or to countries with an adequate level of protection.

6. How we protect it

Identity documents and records are encrypted and kept in write-once storage with integrity checks. Access is restricted to authorised staff for their duties, and every access is logged. Sessions expire automatically and can be revoked from your profile.

7. How long we keep it

We keep personal data for as long as your account is active and afterwards for the periods required by law, including at least 5 (five) years after the end of the relationship for records required under Law 9.613/1998, and up to 10 years for signed documents and certificates. Security logs are kept for at least 6 months as required by the Civil Rights Framework for the Internet (Law 12.965/2014).

8. Your rights (LGPD, article 18)

You may, at any time and free of charge, request: confirmation that we process your data; access to it; correction of incomplete, inaccurate or out-of-date data; anonymisation, blocking or deletion of unnecessary or excessive data; portability; information about the entities we share data with; information about the possibility of refusing consent and its consequences; and withdrawal of consent. To exercise these rights, contact our Data Protection Officer at (not yet published). You may also petition the National Data Protection Authority (ANPD).

9. Cookies

We use only the cookies needed to keep you signed in and secure. See our Cookie notice.

10. Changes

We will publish any update to this notice on this page and, for material changes, notify you through the portal.