Privacy Notice
Bettr

This Privacy Notice applies to individuals registered as users of the Advanced New Technologies (Brazil) Holding e Serviços de Consultoria LTDA. (“Bettr”) application (“Bettr APP”) or Buy Now, Pay Later (“BNPL”) services and who is part of Bettr's operations, in the context of services provided by Bettr ("Services"). This Notice covers any natural person (“Users” or “you”) who makes a purchase using Bettr BNPL services.

Bettr’s Services are intended only for individuals aged 18 years or older. We do not knowingly offer the Services to or collect personal data in connection with Bettr’s Services from individuals under 18 years of age. If you are under 18, you should not register for or use the Services.

Bettr values transparency. Therefore, we created this Privacy Notice to explain how we process your data at Bettr. This document complements Bettr’s Terms and Conditions and QI Tech’s Privacy Notice.

1. WHO IS BETTR?

Bettr offers a BNPL solution that allows you to purchase products and pay for them in installments without using a credit card. The BNPL Services are offered through a partnership between QI Tech Sociedade de Crédito Direto LTDA. (“QI Tech”) and Bettr.

For the processing of personal data in connection with BNPL Services, Bettr and QI Tech act as independent Controllers, each being responsible for the data processing activities, in accordance with the Brazilian Data Protection Law (Law No. 13,709/2018 or “LGPD”).

2. WHAT DATA DO WE PROCESS?

Depending on how you use the Bettr APP and BNPL Services, we may process the following categories of personal data:

• Identification and Registration. This includes your full name, email address, phone number, country and city of registration, CPF, nickname, residential address, proof of address, date of birth, nationality, mother’s name and photographs provided for identity verification purposes (selfie and ID card).
• Financial and Credit Data. This includes approximate income range, bank statements, credit bureau information, banking details, tax regime, credit scores, credit and risk profiles generated from internal or third-party information, information obtained from the Brazilian Central Bank’s Credit Information System (“SCR”) regarding credit operations and financial obligations, transaction and purchase records, payment history and behavior, loan disbursement and repayment records, and information relating to PIX or linked accounts.
• Communication Data. This includes customer service tickets, inquiries, responses and other communications exchanged with you via SMS, instant messaging services (such as WhatsApp), email or telephone, as well as call recordings and other interactions with our customer service teams.
• Biometric Data: This includes biometric identifiers derived from facial scanning or other identity verification processes.
• Technical, Device and Usage Data. This includes information relating to the device you use to access our Services, such as IP address, precise geolocation, device type and model, screen resolution, app version, device language, device identification codes, operating system and other device identifiers. It may also include information about your use of our websites, applications, and communications, such as browsing and navigation data, product interactions, length of visits or usage, page views, searches, referral and exit pages, session information, device logs, crash and error reports, browser and platform information, cookies and similar identifiers.
• Account, Compliance and Risk Data. This includes:
  • access credential, such as login and authentication information;
  • Bettr account information, such as internal identifiers, account status, and registration details;
  • Information relating to compliance checks and risk assessments, including Politically Exposed Person status, internal risk analyses and information relating to applicable restrictions or measures;
  • any other information that you voluntarily provide through your Bettr profile or in connection with your use of the Services.

3. WHY DO WE PROCESS YOUR DATA?

We process the categories of personal data described in Section 2 for one or more of the purposes below, depending on the specific circumstances and only to the extent necessary for the relevant purpose. We may process your personal data to:

• receive and process your application for BNPL Services;
• identify and verify your identity and the authenticity of the information provided, including through official documents, digital onboarding mechanisms and information obtained from authorized credit information sources, where applicable;
• conduct know-your-customer (“KYC”), due diligence and other checks required for regulatory or compliance purposes;
• assess and periodically reassess your financial capacity, creditworthiness, eligibility and available credit limit for the BNPL Services, including through credit, risk and predictive analyses and information obtained from credit bureaus and the SCR;
• prepare and execute agreements and other legal instruments relating to the Services;
• create and maintain your customer records and documentation and administer and monitor our relationship with you;
• process, record and manage payments, transfers, collections and repayment obligations, and provide related notifications and account information;
• provide customer service and technical support;
• handle and resolve inquiries, complaints, requests, disputes and other matters relating to our relationship with you;
• conduct anti-money laundering and other compliance activities and prevent, detect, investigate and mitigate fraud, illicit or unauthorized activities and violations of our agreements or policies;
• protect the security and integrity of our transactions, Services, systems and devices and prevent harm or financial loss to you, Bettr or third parties;
• comply with applicable legal and regulatory obligations and lawful requests or orders from competent authorities;
• improve and optimize our Services, credit and risk assessment models, conduct research, analytics and statistical analyses, and support business planning and business intelligence activities;
• communicate with you about Bettr products, services, features and offers, where permitted by applicable law and in accordance with your communication preferences;
• conduct satisfaction surveys and evaluate and improve our Services and customer experience; and
• evaluate or carry out corporate transactions, such as mergers, acquisitions, reorganizations or transfers of assets or businesses.

QI Tech may also process your personal data for its own purposes, as described in its Privacy Notice.

4. HOW DO WE COLLECT AND PROCESS YOUR DATA?

We may collect your data from different sources, including:

• Directly from you. For example, when you register for or use the Services, complete an application, provide information or documents, submit a selfie for identity verification, contact us, or otherwise interact with Bettr.
• From business partners and service providers. For example: we may receive information from partners and providers that support the provision of the Services, credit and risk assessments, identity verification, anti-money laundering (“AML”) and sanctions screening, fraud prevention, payments, disbursements, repayments and collections.
• From third-party, regulatory and public sources. This may include credit and data bureaus, such as Serasa, fraud and risk databases, public databases and credit information, systems, including the SCR, where applicable and subject to the authorization required by applicable regulation. We may use the information to conduct KYC and compliance checks, assess creditworthiness and determine eligibility for the Services, for example.
• From Bettr affiliates. For example, we may receive transaction, payment or order information from affiliated companies involved in providing services related to your use of Bettr.
• Generated or inferred by us. We may generate or infer information based on other personal data, including credit, risk, fraud, eligibility and behavioral assessments.

Automated processing and AI

We may use tools, including Artificial Intelligence (“AI”) and other automated models, to support activities such as identity verification, fraud prevention, credit and risk assessment and, where applicable, decisions concerning your eligibility for or use of the Services. Where a decision that affects your interests is made solely based on automated processing of your personal data, you may request review of that decision, in accordance with applicable law. You may also request clear and adequate information about the criteria and procedures used in the automated decision-making process, subject to the protection of Bettr’s commercial and industrial secrets.

Cookies and similar technologies

We may use cookies, web beacons and similar technologies on our websites, applications and digital services to enable their operation, remember your preferences, understand our Services are used, improve functionality and user experience, and for other purposes described in this Privacy Notice. Where applicable, you may manage your preferences regarding non-essential cookies and similar technologies through the tools made available by Bettr or your browser or device settings.

5. WHO DO WE SHARE YOUR DATA WITH?

We may share your personal data with third parties where necessary for the purposes described in this Privacy Notice, including:

• QI Tech. We may share personal data with QI Tech to enable the provision and administration of the BNPL Services, including credit-related activities, payments, collections, KYC and other legal and regulatory requirements. QI Tech acts as an independent Controller for the processing activities under its responsibility.
• E-commerce platforms and merchants: Where you access or use the Bettr Services through an e-commerce platforms or merchant, we may share information necessary to enable and manage the relevant transaction, integrate and operate the Services, process payments and repayments, prevent fraud and provide customer support.
• Bettr Group companies. We may share personal data with our parent companies, subsidiaries and affiliates where necessary to provide shared corporate and technological services, operate and improve the Services, conduct identity, compliance, credit, risk and fraud-related activities, administer transactions and contractual relationships, conduct collection and recovery activities, and comply with applicable legal and regulatory requirements.
• Service providers. We may share personal data with third-party providers that support our operations, including providers of payment and fund transfer services, information technology and cloud services, data storage and analytics, information security, identity verification, fraud prevention and risk management, customer service, insurance, collection services, and accounting, legal and other professional advisory services.
• Authorities and other legally authorized recipients. We may disclose personal data to courts, law enforcement authorities, regulators, supervisory authorities and other public authorities where required or permitted by applicable law or pursuant to a lawful request or order;
• Parties involved in claims or disputes. We may share personal data with courts, advisors, counterparties and other people involved in the establishment, exercise of defense of legal claims or the resolution of disputes;
• Financing and credit portfolio partners. We may share personal data with entities that provide financing to Bettr or acquire, manage or otherwise participate in credit portfolios, where necessary for the relevant transaction and related administration, servicing or collection activities.
• Business partners. We may share personal data with business partners in connection with Bettr products, services or commercial activities, where permitted by applicable law and consistent with the purposes described in this Privacy Notice.
• Parties involved in corporate transactions. We may share personal data with potential or actual investors, purchasers, sellers, financing providers, advisors and other parties involved in a merger, acquisition, reorganization, financing, sale of assets or other similar corporate transactions, subject to appropriate confidentiality and data protection safeguards; and
• Other parties at your request or with your authorization. We may share personal data with people or entities where you request or authorize us to do so or where such disclosure is otherwise permitted or required by applicable law.
• Credit bureaus and other authorized credit reporting entities. We may share information with credit bureaus and other authorized entities where necessary for credit assessment, credit reporting and compliance with applicable legal and regulatory requirements.

In all cases, we seek to limit the personal data shared to what is necessary for the relevant purpose and to apply appropriate contractual, organizational and security safeguards. Where the data sharing involves a transfer to another country, the transfer will be carried out in accordance with the requirements of the LGPD and applicable regulations on international data transfers.

6. HOW LONG DO WE PROCESS YOUR DATA?

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Notice.

Retention periods may vary depending on the nature of the personal data, the purpose for which it is processed, and applicable legal and regulatory requirements. In general, we may retain personal data for the duration of our relationship with you and, where necessary, after its termination to comply with legal or regulatory obligations, establish, exercise or defend legal claims, or for other purposes permitted by applicable law. Sensitive data, such as biometric data, will be retained only as long as necessary for the specific purposes for which it is processed and in accordance with applicable laws and regulations.

When personal data is no longer necessary for the relevant purposes and there is no legal basis requiring or permitting its continued retention, we will delete or anonymize it, subject to the applicable legal and technical requirements.

7. DO WE TRANSFER YOUR DATA OUTSIDE OF BRAZIL?

Yes. As part of our operations and the provision of the Services, your personal data may be transferred to, stored in, or accessed from countries outside Brazil, including Singapore, the United States, Malaysia, China, and countries within the European Economic Area (“EEA”).

These international transfers may occur through our global infrastructure or in connection with services provided by Bettr Group companies, business partners and service providers, for the purposes described above in this Privacy Notice, including operating and supporting the Services, processing transactions, conducting credit, risk, fraud and compliance activities, providing technological and shared services, and supporting our business operations. Personal data transferred internationally will be retained only for as long as necessary for the relevant purposes, as described in Section 6.

The controller responsible for these transfers is Bettr. You may contact our Data Protection Officer using the contact information provided in Section 10.

Recipients of personal data outside Brazil may act as controllers or processors depending on the relevant processing activity. We require appropriate measures to protect personal data transferred internationally and allocate responsibilities in accordance with the nature of the relationship and applicable law.

International transfers are carried out in accordance with the LGPD and applicable regulations, using an appropriate transfer mechanism, such as an adequacy decision issued by the Brazilian Data Protection Agency (“ANPD”), the standard contractual clauses (“SCCs”) approved by ANPD, or another mechanism permitted by applicable law.

Where contractual clauses are used as the applicable transfer mechanism, you may request access to the clauses governing the international transfer, subject to the protection of commercial and industrial secrets. We will respond to such requests within the period established by applicable regulation.

You may exercise your rights as described in Section 9 by contacting us through the channel indicated in Section 10.

8. HOW DO WE PROTECT YOUR DATA?

We are committed to protecting your personal data and adopt appropriate technical, administrative and organizational measures designed to protect it against unauthorized access and accidental or unlawful destruction, loss, alteration, disclosure or other improper processing.

We regularly review and improve our security practices considering the nature of the personal data we process, the risks involved and applicable legal and regulatory requirements.

9. WHAT ARE YOUR RIGHTS?

Under the LGPD, you have rights regarding the processing of your personal data, including the right to:

• confirm whether we process your personal data;
• access your data;
• correct incomplete, inaccurate or outdated data;
• request anonymization, blocking or deletion of data that is unnecessary, excessive or processed in violation of the LGPD;
• request portability of your data to another service or product provider, in accordance with applicable regulations;
• request the deletion of data processed based on your consent, subject to the exceptions provided by applicable law;
• obtain information about the public and private entities with which we share your data;
• obtain information about the possibility of refusing consent and the consequences of doing so, where consent is applicable;
• withdraw your consent at any time, where consent is the applicable legal basis;
• object to processing carried out in violation of the LGPD; and
• request the review of decisions made solely based on automated processing of personal data that affects your interests, as provided by applicable law.

If you have any questions or wish to exercise any of these rights, you may contact us using the channels indicated in Section 10 of this Privacy Notice. Please note that certain rights may be subject to limitations or exceptions under applicable law. For example, we may need to retain certain personal data to comply with legal or regulatory obligations or to exercise or defend legal claims. Where we are unable to fulfill your request, we will provide you with the relevant information regarding our decision.

10. HOW TO CONTACT US?

Bettr has appointed Giovanna Milanese as its Data Protection Officer (“DPO”). If you have any questions about how we process your personal data or wish to exercise your rights under the LGPD, you may contact our DPO at BettrPrivacy@bettrfinancing.com.

To process your request, we may ask you to provide information that is reasonably necessary to verify your identity and identify the relevant account or transaction. We will only request additional information where necessary to securely respond to your request.

11. CHANGES TO THIS NOTICE

We may update this Privacy Notice from time to time to reflect changes in our practices, Services or applicable legal and regulatory requirements.

The most current version will always be available on our website or through other channels where this Privacy Notice is made available. Where appropriate, we may also notify you of material changes through our Services or other available communication channels..

Last updated: August 28, 2026