Privacy Policy

01Who we are

This Privacy Policy is maintained by XData Soluções LTDA, a private legal entity registered under Brazilian Corporate Taxpayer Registry (CNPJ) No. 21.242.288/0001-80, headquartered at Avenida E, No. 1470, Suite 610, Jardim Goiás, Goiânia/GO, Brazil, ZIP code 74810-030 (hereinafter "XData", "we", or "Company").

XData develops and operates Zapify, a business communication platform that enables other companies ("Clients") to send and receive messages, manage accounts and message templates, and communicate with their own end customers through the WhatsApp Business Platform (WhatsApp Business Platform / Cloud API), provided by Meta Platforms.

This Policy applies to the processing of personal data carried out within this platform and related services.

02Definitions

For the purposes of this Policy, the definitions of the LGPD apply:

• Personal data: information relating to an identified or identifiable natural person.
• Data subject: the natural person to whom the personal data relates.
• Processing: any operation carried out with personal data, such as collection, use, access, storage, transmission, deletion, among others.
• Controller: the party responsible for decisions regarding the processing of personal data.
• Processor: the party that processes personal data on behalf of the controller.
• Data Protection Officer (DPO): the person appointed to act as the communication channel between the controller, data subjects, and the ANPD.
• ANPD: the Brazilian National Data Protection Authority.

03Our role in data processing

XData acts in two distinct roles, depending on the nature of the data:

As Processor

When processing messages and communication data on behalf of its Clients, XData acts as a processor. In this context, the Client is the controller of its own consumers' data and is responsible for defining the purposes, obtaining the applicable legal bases, and responding to requests from end data subjects. XData processes such data strictly in accordance with the Client's documented instructions and the agreed contractual terms.

As Controller

With respect to the registration, contact, billing, and usage data of the Clients themselves (and of their representatives), XData acts as a controller, defining the purposes and means of such processing as described in this Policy.

04Data we process

4.1 Client data (XData as controller)

4.2 Data processed on behalf of Clients (XData as processor)

XData does not request or encourage the transmission of sensitive personal data through the platform. Should the Client transmit such data, it remains responsible, as controller, for the applicable legal bases and safeguards.

05Purposes of processing

We process personal data to:

• Provide, operate, and maintain the contracted messaging services;
• Route messages between Clients, their recipients, and the WhatsApp Business Platform;
• Manage accounts, phone numbers, and message templates on behalf of Clients;
• Perform charging, billing, and usage control;
• Ensure security, prevent fraud and abuse, and comply with Meta's policies;
• Comply with legal and regulatory obligations;
• Provide technical support and respond to requests.

06Legal bases

The data processing carried out by XData is based on the following legal bases of the LGPD, according to the purpose:

• Performance of a contract (Art. 7, V) — for the provision of the contracted services;
• Compliance with a legal or regulatory obligation (Art. 7, II);
• Legitimate interest (Art. 7, IX) — for security, fraud prevention, and service improvement, respecting the rights of the data subject;
• Consent (Art. 7, I) — where applicable and not covered by another legal basis.

When XData acts as a processor, the legal basis for processing the end consumers' data is defined by the Client, in its capacity as controller.

07Data sharing

XData does not sell personal data. Sharing occurs only in the following cases:

• Meta Platforms — Messages and associated data are transmitted to Meta Platforms Ireland Ltd. and/or Meta Platforms, Inc. for the operation of the WhatsApp Business Platform (Cloud API), as an indispensable part of providing the service. Processing by Meta is governed by Meta's own policies.
• Infrastructure providers and subprocessors — Cloud and technical service providers (for example, cloud computing providers) acting under contract, exclusively in accordance with our instructions and with security and confidentiality obligations.
• Public authorities — When required by law, court order, or request from a competent authority.
• Corporate transactions — In the event of a merger, acquisition, or reorganization, while maintaining the protections set out herein.

08International data transfers

The operation of the services may involve the transfer of personal data outside Brazil — in particular to Meta Platforms and infrastructure providers located in the United States, the European Union, or other jurisdictions. Such transfers comply with Article 33 of the LGPD, through the adoption of appropriate safeguards, such as contractual clauses and compatible security measures.

09Data retention

Personal data is retained only for the period necessary to fulfill the purposes for which it was collected, subject to applicable legal and regulatory periods.

When XData acts as a processor, the data processed on behalf of the Client is retained in accordance with the contract and the Client's instructions, and deleted or anonymized upon termination of the contractual relationship, when it is no longer necessary, or upon a valid request, except where retention is required by law.

10Information security

We adopt technical and administrative measures suitable to protect personal data against unauthorized access and accidental or unlawful destruction, loss, alteration, communication, or dissemination. Such measures include encryption in transit, access controls, environment segregation, and monitoring. We require our subprocessors to maintain a level of protection compatible with the one we uphold.

In the event of a security incident that may result in significant risk or harm to data subjects, we will notify the affected individuals and the ANPD as required by law.

11Data subject rights

Pursuant to Article 18 of the LGPD, the data subject may, at any time, request:

• Confirmation of the existence of processing;
• Access to the data;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance with the law;
• Data portability;
• Deletion of data processed on the basis of consent;
• Information about sharing with third parties;
• Withdrawal of consent.

To exercise these rights, the data subject may contact us at privacy@xdatasolucoes.com.br. We will respond to requests within the legal timeframe, generally up to 15 (fifteen) days from the request.

The data subject also has the right to file a complaint with the ANPD (Brazilian National Data Protection Authority) if they believe their rights have not been adequately addressed.

When processing is carried out by XData in its capacity as a processor, requests from end data subjects should, as a rule, be directed to the Client (controller). We will forward or assist with the request in accordance with the contract and the law.

12Data deletion

13Cookies

The Zapify web dashboard uses cookies and similar technologies, organized into the following categories:

• Necessary — essential for authentication, session maintenance, and security. They are always active, since the platform does not function without them. They are based on the performance of the contract and on legitimate interest.
• Analytics — help us understand how the platform is used in order to improve it. Used only with your consent.
• Marketing — related to communication and outreach. Used only with your consent.

On first access, we display a cookie notice that lets you accept or reject the optional categories (analytics and marketing). You may review or withdraw your consent at any time through the cookie preferences, as well as manage cookies in your browser settings; disabling necessary cookies may impair platform functionality.

14Data Protection Officer (DPO)

The communication channel with XData's Data Protection Officer is the email privacy@xdatasolucoes.com.br.

Officer in charge: Marcelo Nicolau.

15Children's and adolescents' data

The platform is intended for business (B2B) use and is not directed at children or adolescents, nor does it intentionally collect their personal data. When XData acts as a processor, any minors' data transmitted by the Client is the Client's responsibility, in its capacity as controller, including with respect to the specific and prominent consent required by Article 14 of the LGPD. Should we become aware of the inadvertent collection of minors' data without proper legal grounds, we will take measures to delete it.

16Changes to this Policy

This Policy may be updated at any time to reflect legal, regulatory, or operational changes. The current version will always be available on this page, along with its update date. Significant changes may be communicated through the usual contact channels.

17Governing law and jurisdiction

This Policy is governed by the laws of the Federative Republic of Brazil. The courts of the District of Goiânia/GO are elected to settle any disputes, with waiver of any other, however privileged it may be.