Privacy Policy

Effective date: August 10, 2026 Version: 1.1.0

The Brazilian Portuguese (pt-BR) version is the authoritative legal text. This English translation is provided for convenience; in the event of any conflict, the Portuguese version prevails.

nottepass respects your privacy and is committed to protecting your personal data. This Privacy Policy describes, transparently, how we collect, use, store, share, and protect your information when you use the platform, in compliance with Law No. 13.709/2018 (General Data Protection Law — LGPD), the Brazilian Internet Civil Framework (Law No. 12.965/2014), and the Consumer Protection Code (Law No. 8.078/1990).

By registering or using our services, you declare that you have read and understood this Policy. We recommend reading it carefully before providing any data.

1. Who we are (Controller)

The platform is operated by nottepass Tecnologia Ltda., enrolled under CNPJ No. 51.890.784/0001-01 ("nottepass," "we").

nottepass is a technological intermediation platform that allows Organizers to create, advertise, and sell Tickets and Products for Events, and Buyers to acquire them. We act as an intermediary between Buyer and Organizer, and as a facilitator of payment processing through a partner gateway.

For the purposes of the LGPD:

• nottepass is the controller of the personal data processed in the operation of the platform (registration, account, purchases, payments, security, and compliance with legal obligations);
• The Organizer is an autonomous controller of the data it receives to manage its own Event (for example, access validation at the gate and communication about the Event), being independently responsible for the use it makes of such data;
• Infrastructure and payment providers act as processors, processing data on our behalf and under contract.

Data Protection Officer (DPO): privacidade@nottepass.com.br

2. What data we collect

We collect only the data necessary to operate the platform securely and to comply with our legal obligations. The data varies according to your usage profile (Buyer, Organizer, or team member).

2.1 Data you provide directly

Registration and account (all users):

• Full name, email, phone number, date of birth, and gender;
• Identification document: CPF (Brazilian taxpayer ID) or, for foreign nationals without a CPF, a passport number together with the nationality. The document uniquely identifies you on the platform and is what allows the Tickets and Products that belong to you to be linked to you;
• Password, stored exclusively as a cryptographic hash (bcrypt) — we never have access to your password in readable form;
• Theme and language preferences.

Purchase (Buyers):

• Name, email, phone number, and identification document (CPF, CNPJ, or passport) of the buyer associated with the order;
• Residential address, where necessary for payment processing;
• Payment data, processed directly by the gateway. We do not store the full card number or the CVV. We keep only non-sensitive references returned by the gateway, such as the last four digits and the card brand, and the transaction identifier, for support, reconciliation, and fraud prevention;
• If you choose to save a card for future purchases, it is tokenized and stored by the payment gateway (Pagar.me), not on our servers. We keep only the token identifier and the non-sensitive data above.

Manual issuance by the Organizer (complimentary tickets, barters, and sales outside the platform):

The Organizer may issue Tickets and Products directly through the Panel, without the transaction passing through nottepass's financial system. In such cases, it is the Organizer who provides us with your data, not you: the name, email, phone number, and identification document (CPF or passport) of the person who will receive the Ticket.

The document is necessary for a specific reason: without it, the issued Ticket remains registered solely in the name of whoever issued it and never reaches your account, even if you register later. With the document, the Ticket is automatically linked to you the moment you create your account — including if you register with an email address different from the one provided by the Organizer. Until that happens, the Ticket remains valid and the QR Code sent by email works normally at the gate.

On the screens of the Ticket it issued, the Organizer sees the document partially (masked) — only a few characters, enough to identify the correct Ticket when issuing, correcting, or cancelling it, where more than one recipient shares the same name. The full value is never displayed to the Organizer, on any screen, report, or export.

Because every Ticket must be assigned to a person, the document is indispensable for the Ticket to exist in your name. The Ticket belongs to the holder of the document provided: if the document given to the Organizer belongs to another person, it is that person — not you — who will receive it upon creating an account. If you do not agree to our keeping your document, the Ticket cannot subsist: contact us through the channel in section 14 and it will be cancelled, with the QR Code invalidated, at no cost to you.

Organizer and receipt of funds (Organizers):

• Organization data: name/corporate name, trade name, type of person (individual or legal entity), CPF or CNPJ, and address;
• Commercial contact data (organizer email and phone) and logo;
• Banking data for transfer and withdrawal: bank, branch, account, account type, name, and document (CPF/CNPJ) of the holder. This data is used to set up the recipient with the payment gateway.

Identity verification (KYC — where applicable):

To enable withdrawals and prevent fraud and money laundering, we may request from those who will receive funds (Organizers) an identity verification, which includes:

• Type and images of an official document (driver's license or ID card — front and back);
• A selfie to confirm ownership.

These files are treated as sensitive data and receive enhanced protection (see section 7). We do not request images of identity documents from the ordinary Buyer for the simple purchase of Tickets or Products — only the CPF or passport number, as described above.

Content generated by you:

• Messages, attachments, and contact information in Support Center tickets;
• Other information you choose to send us.

2.2 Data collected automatically

• IP address and connection data;
• Device type, operating system, and browser (user agent);
• Security and audit event records (for example, the time and context of policy acceptance, login events, account blocks), which include date, time, IP, and user agent, retained for evidentiary and security purposes;
• Aggregate access metrics for public Event pages (visit counts), without individually identifying the visitor;
• For affiliate links, we record the click in an anonymized manner, storing the IP only as a (non-reversible) hash, along with a session identifier and origin (referrer), for commission attribution and fraud prevention;
• Cookies and similar technologies (see Cookie Policy).

2.3 Data received from third parties

• Payment confirmation, status, and non-sensitive transaction data provided by the payment gateway;
• If you choose to log in with a third-party account (for example, social login), we receive from the provider the account identifier and the associated email, exclusively for authentication;
• Data provided by Organizers about you: when an Organizer manually issues a Ticket or Product in your name, it provides us with your name, email, phone number, and identification document, as described in section 2.1. The Organizer declares to us that it has a legal basis to provide such data and is responsible for informing you accordingly;
• Other information provided by Organizers in the context of Events you have purchased.

3. Why we use your data and on what legal basis

Where processing is based on legitimate interest, we limit ourselves to what is strictly necessary and respect your reasonable expectations and fundamental rights. You may object to such processing as described in section 6.

The processing of the document in manually issued Tickets deserves a specific note: a person who receives a Ticket issued in this way does not enter into a contract with nottepass (the transaction takes place between that person and the Organizer, outside the platform), which is why the legal basis here is legitimate interest rather than performance of a contract. The data is used exclusively for the ownership link and for fraud prevention — never for marketing.

4. With whom we share your data

We share data only when necessary to provide the service, comply with the law, or protect rights. The recipients and purposes are:

• Event Organizers: for Events you have purchased, the Organizer receives the Buyer's name, email, and phone number (the phone number only when provided), for access validation at the gate and communication about the Event (for example, changes or cancellation). As to the identification document, the rule is twofold: in the buyer lists and exports available in the Panel it does not appear in any form, not even masked; on the screens of the Ticket manually issued by the Organizer itself it appears masked, exclusively so that the correct Ticket can be identified when issuing, correcting, or cancelling it. The full value is never shared. The Organizer is an autonomous controller of the data it receives, may use it only for the purposes above, and is responsible for the use it makes of it;
• Payment gateway (Pagar.me): data necessary to process payments, set up recipients, and carry out transfers/withdrawals;
• Infrastructure and communication providers (for example, hosting, database, and email-sending services): they process data on our behalf, as processors, under contract and with a confidentiality obligation;
• Public authorities and regulators: upon a court order, a legitimate administrative request, or to comply with a legal obligation;
• Successors: in the event of a corporate reorganization, merger, or acquisition, data may be transferred to the successor, with continued compliance with this Policy.

nottepass never sells your personal data. We do not share your data with third parties for their own marketing without your consent.

5. How long we store your data

We keep data for as long as necessary for the purposes for which it was collected and to comply with legal obligations:

• Registration and account data: while the account is active and for up to 5 years after deactivation, for tax obligations and the limitation period of the Consumer Protection Code;
• Transaction, payment, and tax data: at least 5 years, in accordance with tax and accounting legislation;
• Document provided in manual issuance: for as long as the Ticket is valid and, thereafter, for the applicable limitation period, for the defense of rights and fraud prevention. Because this transaction does not pass through nottepass's financial system, this data is not retained under a tax obligation;
• Identity verification documents (KYC): for the period required by fraud-prevention and anti-money-laundering regulations and for as long as necessary to defend rights, being deleted or anonymized thereafter;
• Access records and security logs: at least 6 months (Internet Civil Framework, Art. 15), and may be kept longer when necessary for security and the defense of rights;
• Records of policy acceptance: kept for evidentiary purposes for as long as any liability arising from the relationship subsists; they may be anonymized upon request but not deleted, as they constitute proof of the expression of will.

Once the periods and purposes have ended, the data is securely deleted or anonymized, except for cases of mandatory retention provided for by law.

6. Your rights as a data subject

Under the LGPD (Art. 18), you may, at any time:

• Confirm the existence of processing of your data;
• Access the data we hold about you;
• Correct incomplete, inaccurate, or outdated data;
• Anonymize, block, or delete unnecessary, excessive, or unlawfully processed data;
• Port your data to another provider, upon express request;
• Delete data processed on the basis of your consent;
• Obtain information about the entities with which we share your data;
• Revoke consent at any time;
• Object to processing based on legitimate interest, in the cases provided for by law — including the retention of the document provided by an Organizer in a manual issuance. In that specific case, because the document is indispensable for assigning the Ticket to a person, the objection entails the cancellation of the Ticket and the invalidation of the QR Code, as set out in section 2.1.

To exercise these rights, write to privacidade@nottepass.com.br. We may request additional information to confirm your identity before fulfilling the request, as a security measure. We will respond within the legal period.

Some rights may be limited where there is a legal duty of retention (for example, tax data or fraud-prevention records). In such cases, we will explain the reason for the refusal.

7. Data security

We adopt technical and organizational measures to protect your data against unauthorized access, loss, alteration, and improper disclosure:

• Encryption in transit (HTTPS/TLS);
• Encryption of the identification document at rest: CPF and passport are stored encrypted, and searches by document use a non-reversible index — so that the value is not readable in the database or in backups;
• Passwords protected by bcrypt hashing and short-lived session tokens;
• Role-based access control (RBAC), with least-privilege grants;
• Enhanced handling of identity verification documents (KYC): storage in a private, dedicated repository, with no public access and segregated access keys; access by our team occurs only through short-lived temporary links and is recorded in an audit trail;
• Masking of personal data (such as the identification document and phone number) in internal interfaces and removal of sensitive fields from log records;
• Monitoring of suspicious access and incident alerts.

No system is absolutely immune to risk. Should a security incident occur that may result in relevant risk or harm to data subjects, we will notify the National Data Protection Authority (ANPD) and the affected subjects, within the time and manner prescribed by law.

8. Cookies and similar technologies

We use essential cookies for the operation and security of the platform (such as authenticated session, CSRF protection, and recording of consent) and optional analytics and marketing cookies, the latter only with your consent. Details, purposes, and durations are in the Cookie Policy, where you can also manage your preferences.

9. Children and adolescents

Our services are intended for persons over 18 years of age. We do not intentionally collect data from minors. If we identify data from minors collected without proper legal basis, we will proceed with its deletion. If you are responsible for a minor who used the platform, please contact us for data removal.

10. International data transfer

Some infrastructure, payment, and communication providers may process data on servers located outside Brazil. In such cases, we ensure that the transfer complies with the requirements of the LGPD (Art. 33 et seq.), through appropriate contractual clauses and the requirement of protection standards compatible with Brazilian law.

11. Automated decisions

We may use automated rules to prevent fraud, validate payments, and protect the platform (for example, refusal of transactions with indications of fraud, or a purchase limit per document set by the Organizer). You may request the review of automated decisions that affect your interests, pursuant to Art. 20 of the LGPD, through the channel indicated in this Policy.

12. Changes to this Policy

We may update this Policy periodically to reflect legal, technical, or operational changes. Material changes will be communicated at least 30 days in advance.

Exceptionally, changes required by law or by order of an authority, necessary for the security of the platform, or intended to describe more accurately a practice already in place — without expanding the processing of data — take effect immediately, and are communicated at your next access.

Where the change requires a new expression of will, you will need to accept the new version to continue using the platform. The version history is available upon request.

13. Jurisdiction and applicable law

This Policy is governed by Brazilian law. The courts of the district of Presidente Prudente, State of São Paulo, are elected to settle disputes, save for the consumer's right to choose the courts of their domicile (Article 101, I, of the Consumer Protection Code).

14. Contact

Questions, requests, or the exercise of rights related to this Policy may be sent to the Data Protection Officer:

Email: privacidade@nottepass.com.br

---

Last updated: August 10, 2026