STRUCTURED FINANCEHow First Icon collects, uses, shares and protects personal data, and how you exercise your rights under the LGPD.
Effective October 21, 2026
This policy explains how First Icon Securitizadora S.A. ("First Icon", "we") processes personal data under the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD"), the Brazilian Internet Civil Framework (Marco Civil da Internet, Law No. 12,965/2014), the Consumer Protection Code (Law No. 8,078/1990) and the regulations of the National Data Protection Authority ("ANPD").
It applies to the website, the client portal, the boleto (Brazilian bank slip) payment area, the contact, ombudsman, ethics hotline and careers forms, and to the securitization, custody, escrow and collection operations we carry out.
In most of these activities First Icon acts as controller, because it decides how and for what purpose the data is processed. When we provide collection or custody services on behalf of a client company, without acquiring the credit, we act as processor, following the instructions of that company, which remains the controller; in these cases the data subject may also exercise their rights directly with that company.
We process only the data necessary for each purpose (necessity principle, art. 6, III). Depending on your relationship with First Icon:
| Data subject | Data processed |
|---|---|
| Website visitor | IP address, date and time of access, browser and device, pages visited. |
| Business contact | Name, email, phone, company, CNPJ, job title, subject and content of the message, approximate transaction amount. |
| Partners, officers and representatives of clients | Name, CPF, RG (identity card), date of birth, nationality, address, email, phone, job title, equity interest, powers of representation, politically exposed person status, corporate documents and, where applicable, facial image for identity verification. |
| Debtors and payers | Name, CPF or CNPJ, address, email, phone, details of the underlying security and contract, amounts, due dates, payment history, negotiations, settlements and contact records. |
| Investors | Registration and suitability data required by CVM regulations, bank details for payments, holdings and transactions in the securities. |
| Whistleblowers and complainants | Data provided through the ethics hotline or the ombudsman; the ethics hotline accepts anonymous reports. |
| Job applicants | Name, contact details, résumé, education, experience and professional profile link. |
| Suppliers and partners | Contact and representation data of their personnel. |
Sensitive data. As a rule, we do not process sensitive personal data. Facial images, when used to confirm the identity of representatives during onboarding, are processed exclusively for fraud prevention and the data subject's own security (art. 11, II, "g") and to comply with the legal obligation of identification (art. 11, II, "a").
Data sources. We collect data directly from the data subject, from the client company that assigns or entrusts the credits to us, from public databases (Federal Revenue Service, Commercial Registries, courts and notary offices), from credit bureaus and from restricted-party lists used in anti-money laundering.
All processing has a specific purpose and a legal basis provided for in art. 7 of the LGPD:
| Purpose | Legal basis (LGPD) |
|---|---|
| Respond to inquiries and prepare proposals | Preliminary procedures to a contract at the data subject's request (art. 7, V) |
| Perform assignment, custody, escrow and collection agreements | Performance of a contract (art. 7, V) |
| Collect credits, negotiate and formalize settlements | Credit protection (art. 7, X) and regular exercise of rights (art. 7, VI) |
| Notify the debtor of the assignment of the credit | Compliance with a legal obligation (art. 7, II; Civil Code, art. 290) |
| Notarial protest of securities and listing in delinquent-debtor registries | Credit protection (art. 7, X), in compliance with CDC art. 43 and Law No. 9,492/1997 |
| Client identification, prevention of money laundering and terrorist financing | Legal and regulatory obligation (art. 7, II; Law No. 9,613/1998; CVM Resolution No. 50/2021) |
| Investor registration and suitability, issuance and bookkeeping of securities | Legal and regulatory obligation (art. 7, II; Law No. 14,430/2022; CVM Resolutions No. 30/2021, 60/2021 and 160/2022) |
| Tax, accounting and audit obligations | Legal obligation (art. 7, II) |
| Defense in judicial, administrative and arbitration proceedings | Regular exercise of rights (art. 7, VI) |
| Fraud prevention and security of the website and portal | Legitimate interest (art. 7, IX) and fraud prevention (art. 11, II, "g") |
| Ombudsman and ethics hotline | Legal obligation (art. 7, II; Law No. 12,846/2013 and Decree No. 11,129/2022) and legitimate interest (art. 7, IX) |
| Recruitment processes | Preliminary procedures to a contract (art. 7, V) |
| Sending First Icon content and invitations | Consent (art. 7, I), revocable at any time |
When we rely on legitimate interest, we first assess whether the processing is necessary, whether it respects the data subject's legitimate expectations and whether transparency and data minimization measures are in place (art. 10).
When collection involves consumers, we follow the rules of the Consumer Protection Code and the Over-Indebtedness Law (Law No. 14,181/2021):
We share data only to the extent necessary for each purpose and subject to contractual confidentiality and security obligations:
We do not sell personal data.
Some data may be processed outside Brazil, for example on cloud servers and in operations involving the United States. These transfers comply with art. 33 of the LGPD and the International Data Transfer Regulation (ANPD Resolution CD/ANPD No. 19/2024), through standard contractual clauses approved by the ANPD or another permitted mechanism, and also when necessary to perform a contract with the data subject, to comply with a legal obligation or for the regular exercise of rights in judicial, administrative or arbitration proceedings (art. 33, II, "d"; and IX). In the United States, partners also comply with applicable federal and state law, including the Fair Debt Collection Practices Act.
Data is kept for as long as necessary for its purpose and thereafter for the period required by law or for the defense of rights (art. 16). The main retention periods:
| Data | Period |
|---|---|
| Client and investor registration and transaction records | At least 5 years after the relationship ends (Law No. 9,613/1998, art. 10, § 2; CVM Resolution No. 50/2021) |
| Tax and accounting documents | 5 years from the following fiscal year (National Tax Code, arts. 173 and 174) |
| Contracts, credits and collections | Until the applicable statute of limitations expires: 5 years for liquidated debts set out in an instrument (Civil Code, art. 206, § 5, I) and up to 10 years in other cases (Civil Code, art. 205) |
| Website and portal access logs | 6 months (Marco Civil da Internet, art. 15) |
| Business contacts that did not result in a contract | 2 years after the last contact |
| Applicant résumés | 1 year after the recruitment process |
| Ethics hotline and ombudsman | 5 years after the case is closed |
Once these periods end, the data is deleted or anonymized.
Data subjects may request, at any time and free of charge (art. 18):
We respond to requests for confirmation of processing or access in simplified form immediately and in complete form within 15 days of the request (art. 19). We may ask for information to confirm your identity before responding, to protect your data. Some requests may be denied when retention is required by law or necessary for defense in proceedings, in which case we explain the reason.
Data subjects may also file a petition with the ANPD (art. 18, § 1) and with consumer protection agencies (art. 18, § 8).
We adopt technical and administrative measures to protect data from unauthorized access and from accidental or unlawful situations (art. 46), including: encryption in transit and at rest, role-based and need-to-know access control, strong authentication for staff, access logging, segregation of each transaction's accounts, backups, supplier assessments and periodic training.
If a security incident occurs that may result in relevant risk or harm to data subjects, we notify the ANPD and the affected data subjects within 3 business days, under art. 48 of the LGPD and the Security Incident Reporting Regulation (ANPD Resolution CD/ANPD No. 15/2024).
The website does not use advertising, profiling or cross-site tracking cookies. Fonts are loaded from Google Fonts servers, which receive the visitor's IP address and browser in order to deliver the file. Data entered in forms is sent only when you click send.
The client portal uses only strictly necessary features to maintain the authenticated session and secure access.
First Icon's services are not intended for individuals under 18, and we do not knowingly collect data from children and adolescents. When an assigned credit involves a minor, for example school tuition, we process the data of the financially responsible party and, regarding the minor, only what is essential, in the minor's best interest (art. 14).
First Icon's data protection officer receives complaints and requests from data subjects, provides clarifications and communicates with the ANPD (art. 41 and ANPD Resolution CD/ANPD No. 18/2024).
To exercise your rights or ask questions, use the privacy form below. You will receive a reference number upon submission and the response at the email address provided.
This policy may be updated to reflect legal or regulatory changes or changes to our services. The effective date appears at the top of the page. Material changes are announced on the website and, when we have your contact information, by email. In case of any discrepancy between this version and its translations, the Portuguese version prevails.