Privacy

Personal Data Subject: This is the natural person to whom Personal Data relates.
Personal Data: Any information relating to an identified or identifiable natural person. Name, identity number such as RG, CPF, address and date of birth are some examples. Information relating to a legal entity is not Personal Data, but information relating to the contact person or representative of a legal entity is considered Personal Data.
Sensitive Personal Data:Personal Data concerning racial or ethnic origin, religious conviction, political opinion, membership in a trade union or organization of a religious, philosophical or political nature, data relating to health or sex life, genetic or biometric data, when linked to a natural person. The law sets forth additional requirements and imposes certain restrictions on the Processing of sensitive data.
Processing: Any operation carried out with Personal Data — from collection to disposal — including collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination or extraction.

Rabobank Brasil Processes Personal Data if it has, intends to have or has had a business relationship with you, or if there has been contact with you and/or your representatives. The Personal Data Subjects whose Personal Data we Process include, but are not necessarily limited to:

a) People who show interest in Rabobank or our products and services;
b) People who are otherwise connected to a company or organization with which we have, want to have or have had a business relationship, for example, employees, executive directors or representatives of any company, ultimate beneficial owners, among others; and
c) Security providers and guarantors.

If your company or organization transfers any Personal Data of employees, directors, Ultimate Beneficial Owners or stakeholders to Rabobank Brasil, we assume that your company or organization informs the individuals concerned. We may also collect Personal Data from employees or directors that is not provided directly by your company or organization, but in any case, you may make this Statement available to them so that they can understand how Rabobank Brasil Processes Personal Data.

Personal Data may be shared within the Rabobank Group, which includes Rabobank Brasil and global affiliates, to the extent permitted by law. When sharing data within the Rabobank Group, we comply with the internal rules agreed upon, including the Rabobank Group Privacy Code, in addition to national and international rules, such as the General Data Protection Law – Law No. 13,709/2018 (LGPD) and, also as applicable and non conflicting, the European General Data Protection Regulation – (EU) 2016/679 (GDPR).

The collection or receipt of your Personal Data occurs in several situations in which you, as the Data Subject, provide it to us, for example, when you enter into an agreement with us, when you enter data on our website, send us an email so that we can contact you and/or when data is collected as a result of the services we provide.

In addition, we may, for example, receive your Personal Data from:

a) Business units within Rabobank Brazil, for example:
I. In the context of fraud prevention, prevention of money laundering or combating terrorist financing;
II. Internal Administrative Business Processes;
III. To create and run risk models;
IV. To improve our services;and
V. In the context of our duty of care.

b) Other parties, for example in the context of fraud prevention, prevention of money laundering or combating terrorist financing, such as:
I. Suppliers or other parties with whom we work;
II. Public sources such as newspapers, public records, websites and open sources from social media; and
III. Fraud data sharing systems, as required and provided for by regulation of the National Financial System, notably CMN/BCB Joint Resolution No. 06/2023.

We may collect information online, for example, through:

c) Cookies. Our web server may store a “cookie” on your hard drive. On our website, we use only cookies classified as “essential” for the maintenance and/or operation of the Site

We can only provide the best service when we know you and your business well. For this reason, we collect and Process Personal Data only when necessary for a purpose and in accordance with applicable regulation. To help you better understand how this works, we highlight below the legal bases and purposes commonly used for the collection and Processing of your Personal Data.

8.1. Legal Bases for the Processing of your Personal Data

We can only Process your Personal Data if there is a legal basis for doing so. Normally, we Process your data because this is necessary for entering into or performing the contract we have with you or because we are legally required to do so. In other cases, we may have a legitimate interest in the Processing of Personal Data.

8.1.1 Legitimate Interest

We use the “Legitimate Interest” legal basis to Process your Personal Data. In this case, we weigh Rabobank’s or third parties’ interests against the interference with your right to privacy. For example, our interests include:

Protecting our financial position, for example, by assessing whether you can repay your loan, or whether we want to sell your loan or other obligations. We combat fraud to protect ourselves, but also to protect the financial sector, ensuring your safety and ours, and preventing harm.

Improving our internal processes, taking business management measures and carrying out checks in our internal processes.

Transferring loans, merging or acquiring companies to keep Rabobank Brasil financially healthy.

Looking after the financial well-being of our customers. We take measures to help you by trying to identify payment arrears at an early stage. Keeping our administration and services organized by recording data in our core systems, so that different applications within the bank use the same data.

Conducting statistical research, carried out, for example, by our research department, such as measuring the development of the economy. We do this based on legitimate interest.

Creating models and calculating risk scores to assess whether you can repay your credit and what level of capital reserves Rabobank Brasil must maintain.

We weigh our interests or those of third parties against your interests and your right to privacy. For example, we check whether we can achieve the same objective in another way and whether we really need all the data. If we want to use confidential data, your right to privacy will prevail, and we will not use such data based on legitimate interest.

Sometimes it is not clear from laws and regulations which legal basis we may use to Process your data. It may be that the obligation is not set forth in law or that the law does not apply directly to us, but a supervisory authority requires the Processing of certain data. In such cases, we use your data based on legitimate interest, after weighing the interests. One example is the obligation to create risk models. We have an interest in keeping the financial sector healthy, so we use this data based on legitimate interest. For example, we may make image and sound recordings during telephone calls to combat fraud and improve the quality of our services. This helps us train, guide and evaluate our employees. In addition, these recordings may serve as evidence, if necessary.

8.2 Purposes for the Processing of your Personal Data

8.2.1 To establish a business relationship with you and/or your company

For example, we need to perform an analysis to assess whether we can accept your company and/or you as a customer. Depending on the assessment of your risk profile, we are required to ask additional and more detailed questions to build a proper customer record. When your company and/or you become customers, we need to confirm your identity for virtually all our products and comply with our legal obligations. As part of this, we may make a copy of your identity document.

If you wish and to the extent technically possible, we may also use biometric data, such as a facial scan, to establish and verify your identity. We use the copy of your document only for identification and verification purposes.

If your company and/or you wish to become customers, or already are our customers, we consult Rabobank Brasil’s incident records and alert systems (internal reference register) and those of the financial sector (external reference register).

We also check whether your company and/or you are listed on national or international sanctions lists.

We determine whether the requested products or services are suitable for your company and/or for you. For example, we assess whether we can grant credit to your company and/or to you. In this assessment, we also use data obtained from other parties.

We perform analyses to assess whether we can grant credit or other products to your company and/or to you. In some cases, we are required to do so due to the applicable regulation in Brazil.

If necessary, we calculate your company’s creditworthiness and/or yours. To do this, we use information provided by your company and/or by you. We may also analyze the use of your loan or other financial product. The credit analysis is then used by authorized employees to decide whether your company and/or you will receive credit.

When your company and/or you request, for example, a financial product, Rabobank Brasil may use a profile of your company and/or you to verify whether the product is suitable. We study the characteristics of defaulting customers of other parties and may develop a model based on that research. We may use this model if your company and/or you request a financial product or during the term of the product. If this model indicates that your company and/or you have a high risk, we may decide not to provide a particular financial product.

Making image and sound recordings during telephone calls to combat fraud and improve the quality of our services. This helps us train, guide and evaluate our employees. In addition, these recordings may serve as evidence, if necessary.

8.2.2 To fulfill agreements and execute requests

When your company and/or you become customers, we want to serve you. We execute the requests we receive and fulfill the agreements entered into. To do this, we Process Personal Data.

If you contact us by telephone or other electronic means, we may ask additional questions to identify you. These questions may relate to the Personal Data we hold about you. In this way, we reduce the chance that you will become a victim of fraud.

We may record and document telephone calls, email messages, camera images, online chat and video sessions. The purpose is, among other things, to prove that you gave a particular investment order. We may also do this if required by law, to provide evidence, monitor quality, investigate fraud and other matters, and train, guide and evaluate employees.

Your company and/or you may always request that your Personal Data be forwarded to an external party. In that case, we transfer your Personal Data to that party.

8.2.3 To ensure your security and integrity, as well as the security and integrity of Rabobank Brasil and the financial sector

We Process your Personal Data to ensure your security, ours and that of the financial sector. We also do this to prevent fraud, money laundering and terrorist financing.

Customer Due Diligence: Not only when we establish a business relationship with your company and/or with you, but also during that business relationship, we may monitor you, your representatives and Ultimate Beneficial Owners to determine whether we can still accept them as customers. For example, your financial situation may be a reason to perform an additional check, as may the people with whom your company and/or you do business.

Incident Register and alert systems: If you become our customer, or even if you are already a customer, we consult internal and external alert systems. Public authorities send us lists, such as sanctions lists, of people whom we must include in our alert records. These are people with whom financial institutions must not do business or to whom the financial sector must pay special attention. We may consult incident records and alert systems, and we may also include your Personal Data in these records.

Consultation of public sources: We consult publicly available sources, such as public records, newspapers, the internet and public profiles on social media, with the aim of combating fraud and protecting Rabobank Brasil.

Fraud, terrorist financing and money laundering: We may perform analyses with the aim of preventing fraud, terrorist financing and money laundering, as well as protecting you and Rabobank Brasil. In the context of combating cybercrime and digital attacks, we may pass information about you to entities that act in combating cybercrime. We do this when we identify that your security or the security of the financial sector is at risk. We only do this if we have an agreement with those entities on the careful use of your data.

8.2.4 To comply with legal obligations

In accordance with various national and international laws and regulations, we are required to analyze a large amount of data relating to you. Sometimes we need to transfer this information to Brazilian and foreign public authorities. We must comply with these laws and regulations in order to offer financial products and services to your company and/or to you. We also Process Personal Data to comply with our duty of care.

In addition, we must comply with laws and regulations designed to combat fraud, crime and terrorism, such as Law No. 9,613/1998, Law No. 12,846/2013 and CVM Resolution No. 50/2021. For example, we are required to carefully investigate customers and identify the Ultimate Beneficial Owner of a company or organization with which we have a business relationship. It is possible that we work together with other banks.

We may receive data requests from Brazilian tax authorities, the police and the Public Prosecutor’s Office, as well as from organizations such as intelligence services. In that case, we are legally required to cooperate with the investigation and transfer the data relating to you. As partners, we may collaborate, for example, with the police or the Public Prosecutor’s Office to prevent large-scale fraud, money laundering and terrorist financing.

We also Process your Personal Data to carry out internal and external checks and investigations, or when we seek assistance from third parties, for example, to investigate how well new rules have been implemented. We also use Personal Data to analyze and improve our internal processes, so that we can better serve your company and/or you, make our processes more efficient and prepare management reports. We validate our models before using them. Whenever possible, we first pseudonymize (de-personalize) your data as much as possible.

8.2.5 For archiving, scientific or historical research, or statistical purposes

In addition, Rabobank Brasil may Process Personal Data to generate indexes or rankings about its relationship with its customers. These rankings may be shared with customers, but we emphasize that in these situations customers will only receive information containing their own Personal Data, so that third-party Personal Data, including the ranking, will be anonymized.

We do not keep your Personal Data for longer than necessary to fulfill the purposes for which it was collected or reused. We adopt a Record Keeping Policy that specifies how long your Personal Data will be retained, in accordance with applicable laws and regulations. In addition, we may keep your Personal Data for longer than provided for in our policies in specific situations, such as in the event of court requests, receipt of complaints or ongoing legal proceedings. When we no longer have a legal basis to keep your data, it will be deleted or anonymized.

Sensitive Personal Data is defined in section 2 of this Statement, in accordance with the LGPD. We participate in incident records and alert systems for the financial sector and may Process information that may contain Sensitive Personal Data. The purpose of these incident records and alert systems is to protect our interests, the interests of our customers and to adopt protection and safeguarding mechanisms for the financial system, for example, by detecting and recording cases of fraud.

In addition, we Process Sensitive Personal Data only when strictly necessary and in the ways permitted by law, such as when authorized by you, for example.

If you have given consent to Process Sensitive Personal Data, as with any other consent, you may withdraw it at any time. To do so, please contact your own Rabobank Brasil Relationship Manager or directly the Data Protection Officer (DPO), see section 17. However, please be aware that by revoking or withdrawing your consent, you may compromise or make it impossible for Rabobank Brasil to provide a particular service or product to you.

Automated individual decisions are decisions that are made in relation to your company and/or in relation to you by computers, and not by people.

If such a decision produces legal effects for you or has a similar effect, we cannot rely exclusively on automated decision-making, unless it is necessary to conclude or perform a contract, it is permitted by law, or you give us explicit permission to do so. In that case, you have the right to human intervention, to present your position and to contest the decision.

We may use automated decision-making that may affect you when we calculate your credit score. We are required to use these credit scores in the credit approval and granting process. The decision to provide you with credit is not fully automated. Although credit decisions may assess an individual’s financial condition and aspects, Rabobank Brasil’s assessment, credit modeling, risk appetite profile and analysis, for example, are confidential business information and therefore are not subject to disclosure, whether in the public or private sphere.

Within Rabobank Brasil, your Personal Data may only be accessed by employees who have a legitimate need for access to perform their duties, in accordance with the need-to-know principle. All such employees are bound by confidentiality obligations.

If we wish to use Personal Data for any purpose other than the purpose for which the information was obtained, we may do so provided that the two purposes are closely related.

If there is no legal basis to support the new purpose, we will ask you to provide your consent to legitimize the Processing of your Personal Data for the new purpose.

The international transfer of Personal Data may be necessary as described below, observing the requirements of the LGPD, ANPD Resolution CD/ANPD No. 19/2024, which regulates the international transfer of Personal Data, as well as the guidelines provided for in the GDPR and in our internal regulations, prepared in accordance with current national and international rules, ensuring the highest degree of protection for the Data Subject.

a. Within the Rabobank Group

Your Personal Data may be shared within the Rabobank Group, of which Rabobank Brasil is part, for example, because you have asked us to do so or because you have also acquired a product from another division of the Rabobank Group. Information that was used to establish your identity may also be used by another division of Rabobank Brasil with which you wish to do business. We may also, for example, share your data to combat fraud, prevent money laundering, for internal administration, to improve services for you, to carry out risk management and to comply with the duty of care and diligence in the Processing of your Personal Data.

Rabobank Group entities may be located outside Brazil and may have different requirements for the Processing of Personal Data. In this case, we will ensure that we observe the applicable legal requirements for sharing, in order to guarantee adequate protection of your Data, such as by establishing corporate rules that determine how the Processing of Personal Data must occur.

As defined by the LGPD and ANPD Resolution No. 19/2024, when international transfers occur within the Rabobank Group, Global Corporate Rules, also known as binding corporate rules (“BCRs”), constitute a valid mechanism for carrying out international data transfers. In this context, the Rabobank Brasil Privacy Code must be observed.

b. Outside Rabobank Brasil

We may disclose the information we collect to third parties that are not members of the Rabobank Group, but that act on our behalf or as required or permitted by law. These third parties may include:
(i) Support service providers to help us administer your financial relationship.
(ii) Companies that work with us under agreements to provide you with financial services that we do not offer, but that we believe may be of interest to you. In such cases, we may share information collected by us as described above, but only as necessary to offer these services to you. These companies are contractually and legally required to maintain the confidentiality of the information we provide to them and may not use this information for any purpose other than those agreed upon, and may be held liable for the misuse of your Personal Data;
(iii) Service providers engaged for the purpose of complying with legal or regulatory obligations, such as those related to the sharing of evidence of fraud, within the scope of CMN/BCB Joint Resolution No. 06/2023;
(iv) Other parties, to the extent permitted or required by applicable law, for example, government agencies in response to subpoenas and other legal proceedings, or those with whom you have authorized us to share information.

If we provide you with credit or a loan, we must also transfer data to third parties; for example, regarding the credit level or loan amount, or if you do not make a payment on time.

Your Personal Data is also transferred to other parties outside Rabobank Brasil in compliance with legal and regulatory obligations, if we are required to do so by law or by determination of an authority with jurisdiction over Rabobank Brasil, when we enter into an agreement with you or because we have engaged another service provider. International data transfers may only be carried out to meet legitimate, specific and explicit purposes informed to you, as Data Subject, with no possibility of further Processing in a manner incompatible with those purposes, and provided that they are supported by a legal basis defined by the LGPD and by one of the valid mechanisms presented by ANPD Resolution No. 19/2024.

Examples of such third parties include national and European supervisors/regulators and other banks that are subject to supervision by their local regulators. This may mean that your data may be transferred to other parties in countries that have a different level of Personal Data protection than Brazil and the European Union, in which case mechanisms will be used to ensure that your Data will be secure and Processed in accordance with the law.

When carrying out an international data transfer, Rabobank Brasil will limit itself to the minimum necessary to achieve its purposes, covering data that is relevant, proportionate and not excessive in relation to the purposes of the Data Processing.

You have the right to obtain from Rabobank Brasil, in relation to your Processed Personal Data, upon request to the DPO (see section 18):
I. Confirmation of the existence of Processing;
II. Access to data;
V. Correction of incomplete, inaccurate, or outdated data;
VI. Anonymization, blocking or deletion of data that is unnecessary, excessive, or processed not in accordance with applicable law;
VII. Portability of data to another service or product provider, upon express request, in accordance with the rules of the national authority, observing commercial and industrial secrets and technological restrictions;
VIII. Deletion of Personal Data processed with the consent of the data subject, except in the cases specified by Law;
IX. Information from public and private entities with which the controller has shared data;
X. Information on the possibility of not providing consent and on the consequences of refusal;
XI. Revocation of consent to the processing of Personal Data previously granted.

a. Right to information
This Privacy Statement describes what Rabobank Brasil does with your Personal Data. In certain cases, we may provide you with additional or different information. We may do this by letter, by leaving a message in your registered email inbox or in another manner to be determined by us.

b. Right of access and rectification of Personal Data
You can ask us whether we Process Personal Data relating to you and what such data relates to. In this case, we may provide you with access to the data Processed by us that relates to you. If you believe that your Personal Data has been Processed incorrectly or incompletely, you may request that we amend or supplement the data (rectification).

c. Right to erasure ('right to be forgotten')
You may request that we discard data about you that we have recorded, for example, if you object to the Processing of your Personal Data. However, please be aware that we do not always have to do this or sometimes cannot do it either. For example, if we still have to store your data due to legal obligations.
d. Right to restriction of Processing
You may request that we temporarily restrict the Personal Data relating to you that we Process. This means that we will temporarily Process less Personal Data relating to you within the limits necessary to comply with our regulatory obligations, that is, due to the need to comply with regulatory obligations, the right to restriction of Processing may be limited.

e. Right to data portability
You have the right to request that we provide you with the Personal Data previously shared by you with Rabobank Brasil, whether in the context of a contract entered into with us or obtained through your consent, in a structured, machine-readable format, or to request that we transfer such Personal Data to another party. If you ask us to transfer Personal Data directly to another party, we will do so if technically and operationally possible and legally permitted.

f. Right to object to Processing
We Process your Personal Data because we have a legitimate interest in doing so. If you understand that certain Processing of your Personal Data is not in compliance, you may object to it. In this case, we will reassess whether it is indeed the case that your data can no longer be used for that purpose. We will stop Processing your data if your interest outweighs our interest. We will inform you of our decision, stating the reason.

g. Right to object to direct marketing
You have the right to request that we stop Processing your Personal Data for direct marketing purposes. It may be the case that your objection relates only to a specific channel, for example, if you no longer wish to be contacted by email, we will take measures to ensure that you are no longer contacted through the indicated channel.

If you have made a request to us involving a question about the origin of the data, the non-existence of records, the criteria used and the purpose, we will initially respond within 15 days after receiving the request.

We may ask you to further specify your request. For example, if you ask us to have access to call recordings. We may ask for search keys, such as the time and the telephone number from which the call was made. In highly specific cases, we may extend the period in which we will respond. In the meantime, we will keep you informed of the progress of your request.

We may ask you to identify yourself when you make a request with us. We want to make sure that we provide your information to the right person, to maintain the security and confidentiality of your information.

We may not comply with your request. For example, because the rights of others would be violated, or because this is not permitted by law or by another public authority, or because we have weighed the relevant interests and determined that the interests of Rabobank Brasil or others in the Processing of the data take precedence. In that case, we will inform you accordingly.

In Brazil, the Data Protection Officer (DPO) is designated to be the communication channel between Rabobank Brasil (Controller), the Personal Data Subject and the National Data Protection Authority (ANPD), and may be contacted by email: EncarregadoLGPD-DPO@rabobank.com.

Let us know what your question or complaint is and let us look for a solution together. For general questions or if you are still unsure whether it is a request directly related to the Processing of your Personal Data, you may contact your Relationship Manager directly or through the support link Contact Us – Rabobank: https://www.rabobank.com.br/suporte/fale-conosco.

In addition, these are our address details:
Name: Banco Rabobank International Brasil S/A
Address: Av. Doutor Chucri Zaidan, No. 1240, 15th Floor, Edifício Morumbi Corporate – Diamond Tower, Vila São Francisco, São Paulo, SP, Brazil
Zip Code: 04711130

Do you have any request regarding the Processing of your Personal Data?

If you are dissatisfied or have any questions regarding the Processing of your Personal Data, you may contact Rabobank Brasil’s Data Protection Officer (Lea Zanata), from 9 a.m. to 6 p.m., Brasília local time, by email at EncarregadoLGPD-DPO@rabobank.com. If you are not satisfied with the response provided by Rabobank Brasil, you may exercise your right by filing a petition directly with the ANPD (ANPD Electronic Petitioning — National Data Protection Authority: https://www.gov.br/anpd/pt-br/canais_atendimento/peticionamento-eletronico anpd).

Yes, our Privacy Statement may change from time to time. This is possible if there are new activities involving the Processing of Personal Data and these changes are important to you. You can always find the most current version of our Privacy Statement on this page.