Privacy Policy

O-Bainc Tecnologia Grupo (Brasil) LTDA. is responsible for the processing of personal data in the contexts where it acts as controller.

In credit processes, participating financial institutions act under their own responsibilities and policies with respect to the data they receive for the authorised purpose.

For privacy and data protection matters, the contact channel is enquiries@o-bainc.com.

On this website

This website is informational. Where technically necessary to display the pages and keep the service secure, technical information may be processed, such as browser and device information, network information and IP address, and essential security and stability logs.

This website does not request financial information, documents or credentials. If you write to us by email, we will process the information you choose to include in your message.

In the Verdaji app

In the Verdaji product, processing takes place based on the user's express authorisations for a stated purpose. Depending on the purpose and on what has been authorised, the information may include categories such as:

• identification and contact information;
• income information;
• transactional information;
• employment or professional activity information;
• other financial information necessary for the defined purpose.

This list describes possible categories depending on the feature used. It does not mean that every category is collected, nor that it is collected in every case.

Processing purposes may include:

• making Verdaji available, operating it and keeping it secure;
• carrying out features requested by the user;
• enabling credit-related processes when authorised by the user;
• preventing fraud and protecting the security of the service and of people;
• complying with legal and regulatory obligations;
• keeping records of consents, authorisations and permissions;
• responding to requests relating to privacy and data subject rights.

Processing takes place under the applicable legal bases set out in the LGPD (Brazilian General Data Protection Law), depending on the context of each activity. This means the legal basis varies according to the purpose — consent is not the legal basis for every activity.

Depending on the case, the bases may include:

• the data subject's consent;
• performance of a contract or preliminary procedures related to a contract;
• compliance with a legal or regulatory obligation;
• legitimate interest, where legally appropriate and duly assessed;
• credit protection, in the legally applicable circumstances.

Information is not shared indiscriminately.

When you choose to use Verdaji in a credit process, the intention is that only the information necessary and authorised for that purpose is processed and shared with the participating entities appropriate to that process.

We may also rely on service providers necessary to operate, host and protect the service, who process data according to instructions and with appropriate contractual and security safeguards.

Sharing may also occur to comply with a legal or regulatory obligation or a determination by a competent authority.

Security and encryption are part of the Verdaji architecture.

We adopt technical and organisational controls appropriate to the context of use, including restricting access according to legitimate operational need. No digital service can promise absolute security, and that is why we maintain processes to monitor and respond to security events.

You can read about our approach in Security.

Data is kept only for the period necessary to fulfil the applicable purposes, meet legal or regulatory obligations, resolve disputes and protect rights.

Where applicable, you may request:

• confirmation of the existence of processing;
• access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion, where applicable;
• portability, in accordance with applicable regulation;
• information about the entities with which data has been shared;
• revocation of consent, where that is the legal basis for processing;
• information about the consequences of not giving consent;
• review or challenge in the cases provided for by applicable legislation.

Requests can be sent to enquiries@o-bainc.com. To protect the data subject, we may need to confirm your identity before acting on a request.

A plain-language explanation of each right is set out in LGPD and your rights.

This Policy may be updated to reflect changes in the service, technology, or legal and regulatory requirements. The current version and the update date are always shown on this page.

Last updated: 3 September 2026.