Privacy policy

Version of September 11, 2026.

1. Who controls the data

PagusPay Intermediação de Negócios LTDA, CNPJ 68.067.338/0001-02, with registered office at Av. Brigadeiro Faria Lima, 1811, conj. 115, Jardim Paulistano, São Paulo SP, CEP 01452-001, is the controller of the personal data described in this policy. Data protection officer contact: suporte@paguspay.com.

2. What data we process and why

Visitors of this website

This website uses no tracking cookies and no audience analytics. The hosting provider logs IP address, date and page accessed for security and to keep the service running, on the basis of legitimate interest (LGPD, art. 7, IX). Your language choice is stored in your browser, without identification.

People who write to PagusPay

Name, email, company and the content of the message, used to answer the request and, if a contract follows, for onboarding checks and execution of the mandate (LGPD, art. 7, V). Kept for the duration of the relationship and for the retention period of legal obligations.

Principals' representatives and owners

Identification data and documents required by onboarding checks and by the anti-money laundering policies of the institutions PagusPay works with (LGPD, art. 7, II and V).

Payers of the charges

Name, CPF or CNPJ, charge and payment data, received from the principal or from the issuing institution, processed to issue, reconcile and account for the charges in the principal's name (LGPD, art. 7, V and II). The principal is responsible for the commercial relationship with the payer.

3. Who we share it with

  • Institutions authorized by the Central Bank that issue the charges and process the settlements, to the extent needed for each operation.
  • The principal, who receives the statement for the charges made in its name.
  • Hosting and email providers, under contract.
  • Authorities and institutions, when required by law or by a reasoned request.

PagusPay does not sell personal data and does not use it for advertising.

4. International transfers

Principals based outside Brazil receive the statement for their own charges, which may include data of Brazilian payers, on the basis of performance of the mandate agreement (LGPD, art. 33, IX). Infrastructure providers may store data outside Brazil under contractual protection clauses.

5. Your rights

Confirmation of processing, access, correction, anonymization or deletion, portability, information on sharing and withdrawal of consent, under art. 18 of the LGPD. Requests by email to the data protection officer. Reply within 15 days.

6. Security and retention

Role-based access, action logging and encryption in transit. Charge and settlement data is kept for the periods required by applicable tax and regulatory obligations and then deleted or anonymized.

7. Changes

Changes are published on this page with the version date.