PRIVACY AND COOKIE POLICY

PRIVACY AND COOKIE POLICY

The protection of privacy and the processing of personal information in a transparent, ethical, safe and responsible manner are essential values for us.

This Privacy and Cookie Policy (“Policy”) clarifies how Itaú Unibanco and other companies of the Itaú Unibanco Conglomerate, as Personal Data Controllers, collect, use, share and/or process information and the Personal Information of individuals, including clients and third parties, to perform our activities, including on our Websites and Apps.

Here you will also find information on how you can exercise the rights assured by the General Data Protection Law (LGPD), or Law No. 13,709/18, and other applicable legislations.

We also underscore Itaú Unibanco's commitment to ethical and responsible data processing. We value practices and measures aimed to respect people's rights, their integrity and security in connection with the use of data and algorithms, including the use of Artificial Intelligence (AI), as well as other technological innovations.

ÍCONTENTS

Privacy

1. What Personal Information do we use and how do we collect it?

2. For which purpose do we use your Personal Information?

3. Can Personal Information be shared?

4. International Transfer of Personal Data

5. How long do we keep your Personal Information?

6. Personal Data Security

7. Your rights

8. Data Protection Officer (DPO)

Cookies

9. Cookies, pixels and similar technologies

10. What are cookies?

11. How can I disable cookies and other forms of data collection?

12. Where is the information collected by cookies processed?

General Provisions

13. Policy Update

14. Glossary

PRIVACY

1. WHAT PERSONAL INFORNMATION DO WE USE AND HOW DO WE COLLECT IT?

We process the Personal Information of our clients and other people with whom we have or intend to have a relationship. We may process the personal information of minors in situations where our products and services are intended for such data subjects and in cases where they are dependents or beneficiaries, as well as to fulfill the purposes stated in this Policy. The Processing of a minor’s personal information will factor in the best interests of the child or adolescent in question and the cases set forth in the law, as provided for in legislation.

The information processed within the scope of our activities varies according to the purpose of the use and may include different Personal Data, as indicated below.

. Registration data: name, date of birth, gender, identity card (RG), individual taxpayer’s registry (CPF) and/or other identification documents, such as driver's license, photo, address, contact phone numbers, email, profession, occupation, marital status, nationality, place of birth, and politically exposed person (PEP) information, among others;

. Sensitive Personal Data: biometric or other sensitive Personal Information, in accordance with applicable legislation.

. Financial and transactional data: information about banking, financial and payment operations and transactions in connection with financial, banking, credit, financing, foreign exchange, investment, insurance, pension plans, capitalization, consortium, credit card and payment products and services, among others, offered by us or other financial institutions;

. Third party data: parents’ names, representatives, represented parties, guarantors, counterparties, attorneys-in-fact, employees, partners or beneficiaries of products and services;

. Information about your devices: information about your device (such as Advertising ID and technical and usage information such as operating system or screen size), connection (such as date, time and IP address and network used), device identification, geolocation.

. Social media and platform data: interactions you may have with our social networks, such as Facebook, Twitter, Instagram, LinkedIn and YouTube, if we are mentioned or engaged on these platforms;

. Financial position data: we may access data about your financial or credit position, such as income, assets, negative entries on credit reports, data on positive credit register, including detailed data on positive credit register or data from the Central Bank of Brazil's Credit Information System, in accordance with applicable legislation;

. Other information: to enable certain functionalities of our Websites and Apps, evaluate browsing habits or ensure the security of your browsing, we may collect other information from your personal devices, such as photos and contact detail, number of hits, pages and apps originating access to our Websites and App, and information from apps installed on your device.

Data may be provided directly by you, be collected as a result of the provision of services or supply of products, including during purchases, simulations and receipt of proposals, be provided by other Itaú Unibanco Conglomerate companies or legitimate external sources, such as strategic partners, brokers, suppliers, service providers, other institutions of the financial system, credit bureaus, government bodies, correspondent banks and companies or bodies with which Itaú Unibanco or you have a connection or some direct or indirect relationship.

We may also obtain Personal Data and other information from public and/or publicly accessible sources, such as the Internet, media outlets, social media, public records and other sources as permitted by applicable law.

Please see some examples of these situations below. 

· Data may be provided by you, for example, when you fill out registration files, forms, proposals, simulations, subscriptions, contracts, access, searches or when you express interest in products and services; 

  Data we generate about you arising from your relationship with Itaú Unibanco, such as information about your purchasing and using products and services or when you interact with us through our Websites, Apps, channels, establishments, call centers and client service centers; 

· Data received from third parties refers to data provided by third parties about you, even if you are not an Itaú Unibanco client, whether by companies or organizations with which Itaú Unibanco or you have a relationship or suppliers, partners and other financial institutions. Some examples of these situations include: 

· Someone carries out a financial transaction with you, such as a bank transfer or the payment of a slip; 

· When you are the beneficiary or user of a product purchased by a third party, such as a card, insurance policy or pension plan; 

· The company or organization where you work provides us with information about you so that we can supply products and services to you, such as the payment of your salary by Itaú Unibanco, granting or assigning credit lines or pension plans; 

· When we make payments of benefits originating from government bodies;

· A client, counterparty, partner or service provider appoints you as their partner, representative, employee, attorney-in-fact or contact;

· A partner or service provider provides us with information about you for the purpose of offering or purchasing products and services;

· A partner shares information about your consumption habits for credit analysis to facilitate the offer and/or purchase of products and services;

· When we seek information about you or to confirm information you provide to us for our activities, such as completing or improving your registration file and experience, preventing fraud and complying with other legal obligations;

· When you authorize us to access and use your information from other institutions through Open Finance, such as registration, financial, insurance and pension plan data.

· When we receive biometric validation information from third parties who provide authentication and identity validation services, for fraud prevention and security purposes.

2. FOR WHICH PURPOSE DO WE USE YOUR PERSONAL INFORMATION?

Itaú Unibanco processes Personal Information in accordance with the legal framework provided for the General Data Protection Law (LGPD) for, among other purposes, compliance with legal and regulatory obligations, performance of contracts, credit protection, fulfilling the legitimate interests of Itaú Unibanco, our clients and third parties, protection of the life or physical safety of the Data Subject or third parties, in situations where the consent of the Personal Data Subject is collected and for the regular exercise of rights.

We may process Personal Data and other information for a number of purposes in connection with the performance of the activities of the Itaú Unibanco Conglomerate, as follows:

· To carry out our activities, provide our services and supply our products in our relationship with you:

· Complete and keep your data registration up to date, verify your identity and other information;

· Comply with and perform actions for the performance of a contract, including during its term or in stages prior to or after its termination. Activities such as assessment of contract proposals, providing client service through our channels and operational processes to ensure the best client experience and service;

· Serve our current and potential clients and third parties, including by addressing questions, complaints, claims, requests and providing support through our service channels, enabling you to contact us whenever required;

· Send communications about products and services purchased by you, necessary for the performance of the contract;

· Carry out assessments and the regular exercise of rights required for the performance of contracts, such as your health information required for the purchase of certain products, such as insurance policies, or for the assessment of related claims;

· Suggest points of service or branches near you;

· Select and hire Itaú Unibanco employees.

· To understand our clients and offer products that best suit their needs and profile:

· Evaluate the profile, identify opportunities and offer and purchase products and services, initiatives and benefits from the Itaú Unibanco Conglomerate and/or strategic partners most suited to the profile, interests and needs for current and potential clients and third parties, including through email marketing or other communications. You can manage your preferred channels to receive our offers or choose to no longer receive them through our service channels;

· Assess data on User’s demographics and interests through analytics tools, such as Google Analytics and Facebook Ads, in order to understand the target audience of advertising campaigns;

· Evaluate browsing behaviors and the profile of Users and clients, among others, to understand whether the User reached the Websites and Apps through direct access, links or first-party or third-party cookies;

· Carry out marketing campaigns and use information technologies and online advertising solutions;

· Carry out surveys with the general public to improve our products, services and initiatives;

· Carry out strategic analysis of products and services purchased by you from other financial institutions to improve our own products and services and to offer products and services that are better suited to your profile.

· Security and risk assessment:

· Identify, prevent and manage any security, both physical and cyber, risks to you, Itaú Unibanco or third parties;

· Prevent fraud and ensure the security, including by using your biometric data and geolocation, in any products, services, Websites and Apps of Itaú Unibanco, for identification and/or authentication processes in Itaú’s or third parties’ electronic systems;

· Analyze the profile, identify, manage and address potential risks, such as credit, operational, reputational and market risks, in the offer and purchase of products and/or services and in other activities of Itaú Unibanco. By monitoring these risks we are also taking care of our clients’ security;

· credit protection-related activities, such as credit risk assessment and management, assessment of the financial position, collection, credit assignment, reporting and checking with credit bureaus and positive credit registers.

· Compliance with legal and regulatory obligations:

· comply with legal, regulatory and self-regulatory obligations, such as: internal audit and compliance activities, prevention of money laundering and terrorism financing crimes and other wrongdoing, Know Your Client – KYC and other risk management activities, reporting to the Federal Revenue Service, fraud prevention measures, reporting information to the Central Bank of Brazil and other proper entities in Brazil and abroad, for compliance with rules, reporting of suspicious operations to the Financial Activities Control Council (COAF), proof of life of the National Social Security Institute’s (INSS) beneficiaries, evaluation of companies’ legal representatives and partners;

· comply with court orders and administrative and arbitration decisions.

· To protect your rights and those of Itaú Unibanco and third parties:

· for the regular exercise of rights, including in connection with contracts and lawsuits, and in extrajudicial, administrative or arbitration proceedings.

· Improve our activities:

· Analyze, create, and improve our products, services, activities, whether internal or external, initiatives, projects, features and functionalities of our platforms, Websites and Apps;

· measure and understand the interaction of Users and clients with us, including in social networks and our channels, as well as the use of our products, services, activities, initiatives, Websites and Apps and the satisfaction of Users and clients;

· Itaú Unibanco may process your data in AI systems to better our services, offer personalized and simplified experiences to our clients and other individuals, among other purposes. We are committed to processing personal data by prioritizing ethics and transparency, in accordance with applicable legislation and best security practices.

· Other situations involving data Processing based on legitimate purposes, such as supporting and promoting Itaú Unibanco activities, promoting and holding events and sponsorships, or providing services that benefit our clients.

3. CAN PERSONAL INFORMATION BE SHARED?

Itaú Unibanco only shares your information when it is needed or relevant, for the purposes provided for in the contracts with our clients and this Privacy Policy, within strict security standards, ensuring the confidentiality of your information at all times and in accordance with bank secrecy rules and other data protection and privacy rules.

Examples of data sharing situations are as follows:

· between companies and entities of the Itaú Unibanco Conglomerate, including to develop our activities, offer and provide services and supply products, manage risks, comply with legal obligations and for other purposes provided for in this Policy;

· With strategic partners, including to offer, purchase and use their products and services or products and services jointly developed that may benefit you;

· with service providers, suppliers, brokers and correspondent banks hired by Itaú Unibanco to develop our activities;

· with regulatory bodies, other public entities, institutions of the financial system and third parties, including service providers and suppliers, to comply with and carry out legal, regulatory and contractual obligations and for the protection of and the regular exercise of rights;

· with judicial, administrative, arbitral or other proper authorities, for compliance with requisitions, requests and decisions;

· situations in which data sharing is significant or required for the creation, offer, maintenance, operation and improvement of our Websites and Apps, as well as the activities, initiatives and products and services of the Itaú Unibanco Conglomerate and strategic partners;

· With credit bureaus, in accordance with the provisions of applicable legislation, such as for compliance with the legislation concerning positive credit register in the case of negative entries on credit reports;

· with other financial institutions, for processing any transaction or other activities in connection with the performance of the contract;

· With companies of the Itaú Unibanco conglomerate and/or third-party institutions, such as other institutions of the financial system and regulatory bodies, in compliance with the rules requiring the sharing of information in connection with actual or attempted fraud and/or fraud indicator, in order to prevent fraud and ensure the security of operations.

· Sharing anonymized, grouped or other information that do not allow the personal identification of the Data Subjects;

· in the cases of merger, acquisition or other corporate restructuring processes;

. Sharing data with collection and credit recovery providers, so that they can act, independently and by using their own strategies, on the credit recovery portfolios of the Itaú Unibanco Conglomerate, including the repossession of vehicles in default;

· situations in which your consent may be required and will be requested in due course. 

4. INTERNATIONAL TRANSFER OF PERSONAL DATA

Your Personal Information may be transferred to and processed in other countries, in accordance with the provisions set forth by the LGPD and other applicable legislation, for the purposes provided for in this Privacy Policy.

For example, the data may be transferred overseas if needed for the performance of a contract (such as credit card transactions carried out abroad or transactions with foreign cards carried out in Brazil, foreign exchange or other banking, financial, insurance and investment transactions with other Itaú Unibanco Conglomerate companies abroad or other financial institutions); for compliance with Itaú Unibanco’s legal and regulatory obligations; for the regular exercise of rights in administrative, judicial or arbitration proceedings or for the investigation of crimes and other illicit acts. The International data transfer may also take place for the development of Itaú Unibanco’s activities, provided Personal Data protection measures are adopted.

5. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

Itaú Unibanco will keep your Personal Information only for as long as necessary to fulfill the purposes for which it is processed, as outlined in this Privacy Policy and our terms and contracts, aimed at the supply of our products and services and the performance of our activities. We will also keep your information to comply with legal and regulatory obligations, to manage risks and for the regular exercise of rights in administrative, judicial and arbitration proceedings, in accordance with the law. Itaú Unibanco adopts mechanisms for evaluating retention periods and, if required, we will act to retain Personal Data for the shortest possible time.

6. PERSONAL DATA SECURITY

The security and protection of your Personal Information is a priority for us. Itaú Unibanco sets out processes and controls to prevent, detect and respond to security incidents and protect your Personal Information from unauthorized access and use, thus ensuring the management of security, including cyber, risks, as well as to build up a robust security framework.

We take care of your Personal Information by following strict security and confidentiality standards to provide our Users and clients with a safe and reliable environment. We use tools and technologies to keep the completeness and confidentiality of information and protect it from unauthorized access.

We also restrict access to data as necessary, with strict confidentiality and secrecy obligations and the adoption of security criteria.

7. YOUR RIGHTS

The LGPD ensures the rights to its Data Subjects. As a Personal Data Subject, you may require from us:

· access to and confirmation of the existence of Personal Data Processing;

· the update and correction of incomplete, inaccurate or outdated data;

· the anonymization, blocking or deletion of unnecessary or excessive data or data processed in non-conformity with the provisions of the LGPD;

data portability, in compliance with applicable and commercial and industrial secrecy rules.

· information on the possibility of withholding consent and the consequences of such refusal;

· withdrawing consent and rejecting the data Processing carried out based on other legal bases. There may be cases where the Processing will be upheld based on applicable rules;

Request for a review of decisions made exclusively based on the automated Processing of Personal Data that affect you;

Request to opt out of receiving targeted offers of products and services of Itaú Unibanco through our channels.

To exercise your rights to your Personal Information, you may use our client service channels. Please click on https://www.itau.com.br/privacidade for the most suitable channel according to your relationship with the bank.

We underline that we may retain some data and/or continue to carry out the data processing, even when you request the deletion, rejection, blocking or anonymization of your information, among other reasons, to comply with legal, contractual and regulatory obligations, safeguard and exercise the rights of Itaú Unibanco, Users and clients, prevent any illicit acts and to use it in judicial, administrative and arbitration proceedings, and in other cases set forth in the law.

8. DATA PROTECTION OFFICER (DPO)

Itaú Unibanco S.A’s Data Protection Officer: Leandro Rocha de Andrade.

For further information on this Policy, how we process your personal information or to exercise your rights thereto, in addition to our service channels and bankline, please contact our DPO by sending an email to encarregado-dados@itau.com.br.