Privacy Policy & LGPD

1. Personal Data Collected

We collect the following personal data when you use our services: identification data (full name, email, phone/WhatsApp, company name), billing and payment data processed by your payment service provider (PSP), location and configuration data from charging stations connected to the platform, and usage and browsing data (logs, device, IP address).

Data is collected directly from you, generated automatically during platform usage, or received from partners such as payment processors.

2. Purpose and Legal Basis for Processing

We use your personal data for the following purposes, with respective legal bases under the LGPD: contract performance (Art. 7°, V) — to provide, maintain, and operate the CPMS platform; consent (Art. 7°, I) — for marketing communications; legitimate interest (Art. 7°, IX) — for service improvement, usage analytics, and fraud prevention; legal obligation (Art. 7°, II) — to meet fiscal and regulatory requirements.

We do not use your data for automated decisions that produce significant legal effects without your knowledge.

3. Data Sharing

Your personal data may be shared with: payment processors (Stripe and other PSPs selected by you) to facilitate transactions; cloud infrastructure providers (AWS) for secure hosting; and competent authorities when required by law or court order.

We do not sell, rent, or trade your personal data with third parties for marketing purposes.

4. Storage and Security

Your data is stored on servers in the South America region (sa-east-1) of Amazon Web Services (AWS), with encryption in transit (TLS) and at rest. We implement access controls, monitoring, and security practices aligned with industry standards.

No system is 100% secure. Should we identify any security incident that may pose relevant risk to data subjects, we will notify the National Data Protection Authority (ANPD) and affected data subjects within legal timeframes.

5. Data Retention

Your personal data is retained for as long as necessary to fulfill the purposes for which it was collected, or for the period required by law (e.g., tax documents for 5 years).

Upon account closure, your data will be deleted or anonymized within 30 days, except when retention is required by legal or regulatory obligation.

6. Your Rights as a Data Subject (LGPD Art. 18)

Under the LGPD, you have the right to: confirmation of data processing; access to your personal data; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary or excessive data; data portability to another service provider; deletion of data processed based on your consent; information about data sharing with third parties; information about the possibility of not providing consent and its consequences; and revocation of consent.

To exercise any of these rights, contact us at privacidade@xingu-charging.com or via WhatsApp. We will respond within 15 business days as required by the LGPD.

7. Account and Data Deletion

You may request account and personal data deletion at any time through the Xingu Console (account settings) or via email. Upon account closure, we will permanently delete: profile information, charging station data, session history, and other personal data.

This action is irreversible. We recommend exporting your data before requesting deletion. Data required for legal compliance will be securely retained for the required period.

8. International Data Transfer

Your data may be processed outside Brazil by essential service providers (e.g., email services, analytics). When international transfer occurs, we ensure the recipient provides a level of data protection compatible with the LGPD, as per Art. 33 of the law.

By using our services, you consent to data transfer under the conditions described.

9. Cookies and Tracking Technologies

We use essential cookies for platform functionality and analytics cookies to improve user experience. You can manage your cookie preferences through your browser settings.

Essential cookies cannot be disabled as they are necessary for basic platform functionality.

10. Data Protection Officer (DPO)

The data protection officer for Xingu Ltda can be reached at: privacidade@xingu-charging.com.

11. Changes to This Policy

This Privacy Policy may be updated periodically. We will notify you of relevant changes via email or platform notice. The "Last updated" date will always be current.

Continued use of services after changes constitutes acceptance of the updated policy. If you disagree, you may close your account at any time.