Customer as controller. Painel Pix as processor.
This Agreement supplements the Terms of Use. It does not change the independent roles of banks, Google or Painel Pix regarding account, security and billing data under their own control.
1. Parties and incorporation
This Agreement forms part of the Terms of Use between the customer identified through the account, the Customer, and PAINEL DESENVOLVIMENTO DE SISTEMAS LTDA., trading as Painel Pix, Brazilian CNPJ 62.885.922/0001-80, with its registered address at Passagem São José, 152, Maguari, Ananindeua, Pará, Brazil, Painel Pix.
Where the Customer determines the purpose and essential means of handling payer, consumer, employee or representative data, it acts as controller. Painel Pix acts as processor to the extent it handles such data on the Customer's documented instructions.
2. Subject matter, term and instructions
Processing supports Pix charge creation and retrieval, payment confirmation, statements, receipts, support and security. Documented instructions include lawful settings, commands and requests made through interfaces and APIs, the Terms of Use and this Agreement.
Processing continues for the account term and as needed for deletion, return, security, legal obligations and legal claims. Additional instructions must be submitted through an official channel and may require technical, legal and commercial review.
3. Data subjects, data and operations
| Element | Scope |
|---|---|
| Data subjects | Payers, customers and representatives of the Customer; authorized users; and other individuals whose data is lawfully retrieved by the Customer. |
| Data | Name, CPF or CNPJ relating to a natural person, Pix key, bank, TXID, amount, date, time, status, description and other information returned by a bank API. |
| Operations | Receipt, transmission, retrieval, organization, display, technical logging, statement or receipt generation, support, protection and deletion. |
| Sensitive data | Not required for normal use. The Customer must not enter sensitive personal data into notes, descriptions or free-text fields. |
4. Customer obligations
- Have a lawful purpose and legal basis for processing and charges.
- Give data subjects required notices and handle their rights as controller.
- Limit users, permissions and queries to what is necessary.
- Not use payer data for sale, unrelated enrichment, harassment, discrimination or incompatible purposes.
- Not place sensitive data, secrets or excessive information in free-text fields.
- Maintain valid bank credentials and promptly report unlawful instructions, incidents or misuse.
5. Painel Pix obligations
- Process data under documented instructions and applicable law.
- Notify the Customer if an instruction appears unlawful and suspend it pending clarification where appropriate.
- Require confidentiality and access based on need.
- Use technical and organizational measures proportionate to risk.
- Provide reasonable assistance with rights, incidents and compliance information.
- Delete or return data at termination, subject to legally justified retention and protected rotating backups.
6. Security
As applicable to each component, measures include TLS transmission, authentication and authorization, logical user separation, anti-forgery controls, encryption of credentials and certificates stored by the backend, restricted permissions, security logging, component updates and protected continuity backups.
The Customer must also protect devices, Google accounts, passwords, bank credentials, certificates and employee access. No system eliminates all security risks.
7. Subprocessors and third parties
Painel Pix may use hosting, database, authentication, monitoring, communications and support providers. Google/Firebase acts as processor for certain services and as independent controller for others. Financial institutions receive data through Customer action and process transactions under their regulation and banking relationship.
Painel Pix will require compatible protection obligations from subprocessors under its control. Material changes to subprocessor categories may be announced through the Privacy Policy or another suitable channel.
8. International transfers
Global services, especially Google/Firebase, may involve processing outside Brazil. Where an operation is an international transfer under Painel Pix responsibility, a mechanism permitted by the LGPD and ANPD will be used, including ANPD-approved standard contractual clauses incorporated into provider terms where applicable.
9. Data subject rights
The Customer receives, evaluates and responds to requests involving its payer data. If Painel Pix receives such a request, it may refer it to the Customer unless direct response is legally required. Painel Pix will provide technically reasonable assistance according to the nature of processing and available information.
10. Security incidents
After confirming an incident involving processor data, Painel Pix will notify the Customer without undue delay with available information on nature, data, data subjects, risks and measures. The Customer as controller decides and performs required notices to ANPD and data subjects with Painel Pix cooperation. Where Painel Pix is also controller for the affected operation, it will directly meet its legal obligations.
11. Audit and evidence
Upon a reasonable and proportionate request, Painel Pix will provide information required to demonstrate compliance. On-site audits require justification, confidentiality, scheduling, protection of other customers and reimbursement of extraordinary costs, without limiting competent authorities.
12. Liability
Each party is responsible for its acts and omissions according to role, contribution to harm and law. The Customer is responsible for lawful purposes, charges, instructions and granted access. Painel Pix remains responsible for its processor or controller obligations without excluding mandatory data subject and consumer rights.
13. Termination, priority and law
This Agreement applies while Painel Pix processes data for the Customer. For data protection conflicts, this Agreement prevails; the Terms of Use prevail otherwise. Brazilian law and the legally competent forum apply, preserving any mandatory consumer forum.