Personal data processing policy

This policy governs collection, use, storage, access, transmission, transfer, correction, and deletion of personal data. We apply lawfulness, purpose limitation, necessity, proportionality, transparency, quality, security, confidentiality, and accountability under applicable law.

Credi Contable controls account, contact, billing, security, and support data used to administer the service. The subscribing business controls its borrower, worker, and lending-operation data; Credi Contable processes it as processor or service provider.

The platform does not authorize unlawful collection. Businesses must notify people, document a lawful basis, limit access, and answer rights requests. The parties may enter a data processing agreement where appropriate.

Categories include identity, contact, address, location, work role, contracts, loans, obligations, payments, arrears, audits, IP, and support.

We do not request health, biometric, religious, sexual orientation, political opinion, or other sensitive categories. Businesses should not upload them. Location and financial information must receive restricted access and be processed only where necessary and lawful.

Where consent is required it must be prior, informed, verifiable, and withdrawable. Other jurisdictions may allow contract, legal obligation, legitimate interests, legal claims, or other recognized bases. Withdrawal does not invalidate prior lawful processing or override retention duties.

Compatible purposes include:

• Managing users, businesses, workers, routes, and permissions.
• Managing loans, schedules, installments, collections, payments, arrears, capital, expenses, and reports.
• Validating contact, preventing duplicates, and supporting route location when enabled by the controller.
• Protecting accounts, auditing actions, detecting abuse, investigating incidents, and backing up data.
• Managing subscriptions, tax, support, operational messages, and legal compliance.
• Creating internal aggregated or de-identified statistics.

Access is restricted by role and business. Workers are assigned to routes and administrators control permissions. Customers must not share credentials or permit unrelated access. Authorized people remain bound by confidentiality after their relationship ends.

We may use providers for infrastructure, databases, email, authentication, support, and payments. Paddle handles payments as Merchant of Record. Applicable terms restrict use and require security.

For cross-border processing, we use mechanisms required by the relevant jurisdiction. Businesses must assess sector-specific or data-localization obligations.

A request should identify the person or representative, describe the right, provide contact details, and include supporting documents when needed. We acknowledge, may verify, and respond within the applicable deadline.

For customer-controlled data, we will route the request or explain how to reach the controller. You may complain to the competent authority.

Businesses are responsible for accurate, relevant, current uploaded data. Credi Contable supports correction, export, and management. Data is retained during the relationship and for legal or defense periods, then reasonably deleted or de-identified.

We maintain access controls, secret encryption, logs, rate limits, isolation, and backups. Customers must configure permissions, secure devices, and report suspicious access. Each party will notify and cooperate on incidents according to its role and legal deadlines.

This policy applies from the stated date and will be reviewed when the service or obligations change. Mandatory law in the person's or controller's country prevails over conflicting terms.