LEGAL

Biometrics and KYC Policy.

Wibx · Last updated: September 24, 2026

This policy complements Wibx’s Privacy Policy and describes how sensitive and biometric data may be processed in identification, authentication and platform-security procedures.

WIBX · LGPD/KYC

01

Purpose

This Biometrics and KYC Policy complements Wibx’s Privacy Policy and describes how data related to identification, authentication and platform-security procedures is processed.

02

Data processed

During authentication and registration validation processes, Wibx may process data required to verify identity, protect accounts and maintain operational security.

For teenagers between 14 and 18, verification is done with the legal guardian, who assists and authorizes the registration (art. 14 of the LGPD).

  • Facial image.
  • Liveness check and authentication video.
  • Audio of the authentication video: only the spoken declaration of ownership, recorded with the video. It is not used as voice biometrics nor processed outside the video.
  • Official documents.
  • Document photograph.
  • CPF or equivalent identification number.
  • Registration information.
  • Data required for identity validation.

03

Purpose of processing

Data may be used to ensure that the person is who they claim to be, reduce operational risk and preserve platform integrity.

  • Identity validation.
  • Fraud prevention.
  • User account protection.
  • Operational security.
  • Compliance with legal obligations.
  • Prevention of money laundering.
  • Audit and traceability.
  • Protection of the platform and third parties.

04

Legal basis

Facial image and liveness check are sensitive data and are only processed in the cases of art. 11 of the LGPD. Wibx does not rely on legitimate interest or credit protection as a basis for sensitive data, because art. 11 does not allow them.

  • Facial image, liveness check and authentication video: art. 11, II, "g" (fraud prevention and security of the data subject in identification and authentication of registration).
  • Retention of the KYC file after account closure: art. 11, II, "a" (compliance with a legal or regulatory obligation) and "d" (regular exercise of rights in proceedings).
  • Identity document and non-sensitive registration data: performance of contract and compliance with a legal obligation (art. 7, V and II).

05

Data sharing

Wibx may share information when necessary for operation, security, legal compliance or cooperation with competent authorities.

  • Technology providers.
  • Compliance partners.
  • Anti-fraud service providers.
  • Competent authorities.
  • Sharing required by legal obligation or valid determination.
  • Whenever possible, sharing will observe necessity, proportionality and data minimization.

06

Storage and security

Collected data may be stored in secure environments, using appropriate technical and administrative measures to reduce risks.

  • Unauthorized access.
  • Alteration.
  • Destruction.
  • Leakage.
  • Unauthorized use.

07

Data retention

The KYC file (document, facial image, liveness check and authentication video with its audio) is kept for 5 (five) years from account closure, the period set by art. 10 of Law 9,613/1998 for identification records. Once that period ends, it is deleted, unless an authority order or ongoing proceeding requires longer retention.

  • Compliance with legal obligations.
  • Audits.
  • Fraud prevention.
  • Regular exercise of rights.
  • Platform protection.
  • Regulatory cooperation.

08

Data subject rights

Under applicable law, the data subject may request measures related to the processing of their data, through the support center () or the DPO ().

  • Confirmation of processing.
  • Access to data.
  • Correction of information.
  • Anonymization when applicable.
  • Deletion of data when legally possible.
  • Information about sharing.
  • Review of an automated identity validation decision (art. 20 of the LGPD).

09

Updates

This policy may be updated periodically to reflect regulatory changes, technological evolution and operational improvements.

  • Regulatory changes.
  • Technological evolution.
  • Operational improvements.
  • Enhancement of security mechanisms.

10

Integration with other policies

This policy must be interpreted together with Wibx’s other legal and operational documents.

  • Privacy Policy.
  • Terms of Use.
  • Cookies Policy.
  • Wibx KYC, AML/CFT and Compliance Policy.

If you have questions, contact Wibx through its official channels.