Privacy Policy

Policy updated on May 27th, 2025.

Inter Privacy Policy

At Inter, we aim to provide the best possible experience to ensure you enjoy our products and services to the fullest. To achieve this, your privacy and the security of your Personal Data are and will always be very important to us.

We understand that ensuring privacy goes beyond complying with legislation. It means respecting Data Subjects and honoring our pillars of transparency, partnership, security, simplicity, and a positive user experience.

Thus, the Inter Privacy Policy (“Policy”) aims to:

(i) reinforce our commitment to privacy and security in the Processing of information collected from our clients and other Data Subjects.

(ii) demonstrate, in a transparent and simple manner, which Personal Data (as defined below) is processed by Inter, the reasons for and the methods we use to collect, store, process, transfer, and access such Personal Data.

(iii) present how we protect your Personal Data. And

(iv) define when and how you can control your privacy preferences, such as updating, requesting, and managing your information through our mobile application (“App”) and other communication channels.

The Inter Privacy Policy applies to all banking and non-banking products and services offered by Inter that use Personal Data (as defined below).

1. Who Are We?

The Controller of your Personal Data — that is, the company responsible for making decisions regarding the Processing of your Personal Data — is Banco Inter S.A., registered under CNPJ No. 00.416.968/0001-01, headquartered at Av. Barbacena, 1219 – Santo Agostinho, Belo Horizonte, MG, Brazil – ZIP Code 30190-131, as well as the other companies within the Inter Group, including affiliated, subsidiary, and related companies, as well as companies directly or indirectly controlled by Banco Inter (“Inter”).

The Inter Group is composed of the companies listed below. You should consult the specific documents or terms and conditions of the products or services you access, use, or contract to verify the responsible company.

• Banco Inter S.A., registered under CNPJ No. 00.416.968/0001-01
• Inter Distribuidora de Títulos e Valores Mobiliários Ltda, registered under CNPJ No. 18.945.670/0001-46
• Inter Asset Gestão de Recursos Ltda, registered under CNPJ No. 05.585.083/0001-41
• Inter Corretora de Seguros Ltda, registered under CNPJ No. 06.354.814/0002-91
• Inter Marketplace Intermediação de Negócios e Serviços Ltda, registered under CNPJ No. 35.502.377/0001-23
• Inter Food Ltda, registered under CNPJ No. 41.985.090/0001-02
• Inter Pag Instituição de Pagamento AS, registered under CNPJ No. 22.177.858/0001-69

2. Definitions

Anonymization: The use of reasonable and available technical means at the time of Processing, through which data loses the possibility of being associated, directly or indirectly, with an individual.

Controller: A natural or legal person responsible for decisions regarding the Processing of Personal Data.

Cookies: Files installed on a user's Device that allow the collection of certain information, including Personal Data in some cases, for various purposes.

Data Protection Officer (DPO): The person appointed by the Controller and Processor to act as a communication channel between the Controller, the Data Subjects, and the ANPD.

Data Subject: Any identified or identifiable natural person to whom the Processed Personal Data refers. This includes, for example, our clients, potential clients (prospects/leads), former clients, third parties who have conducted transactions with us or with our clients, representatives, attorneys-in-fact, guardians, curators, employees or partners of a client or a company with which Inter has a relationship, service providers, collaborators, contractors, job applicants, among others.

Device: A device that can be used to access the services offered by Inter, such as computers, tablets, and smartphones.

General Data Protection Law (“LGPD”): Federal Law No. 13.709, published on August 14, 2018, which regulates Processing activities, including through digital means, by natural persons or legal entities under public or private law, with the aim of protecting the fundamental rights of freedom and privacy and the free development of the personality of the natural person.

Geolocation: A feature that, when enabled by the Data Subject, allows the approximate position of a Device to be determined, thus providing estimated information about its location and the time it was accessed.

IP Address: The number assigned to each Device connected to the internet, known as the Internet Protocol address (IP). These numbers are generally assigned in geographic blocks. An IP address can be used to identify, for example, the location from which a Device is connecting to the internet.

National Data Protection Authority (“ANPD”): The federal public administration body responsible for overseeing, implementing, and ensuring compliance with the LGPD throughout the national territory.

Personal Data/Information: Defined by the LGPD as information related to an identified or identifiable natural person, such as name, address, CPF (Individual Taxpayer Registry), RG (General Registry), identification documents in general, phone number, among others.

Processing: Any operation performed with Personal Data, whether automated or not. This includes collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, storage, archiving, deletion, evaluation or control of information, modification, communication, transfer, dissemination, or extraction.

Processing Agents: The Controller and the Processor.

Processor: The person or company that carries out Processing on behalf of the Controller, following its instructions.

Sensitive Personal Data/Information: Defined by the LGPD as Personal Data concerning racial or ethnic origin, religious beliefs, political opinions, union membership or membership in religious, philosophical, or political organizations, data concerning health or sex life, genetic or biometric data when linked to a natural person.

3. How We Collect Your Personal Data

Different types of information are collected when you use our products and services, and they fall into three categories:

Data provided by the Data Subject: These are the details you provide directly, including but not limited to the following situations:

• when you interact and contact us through our customer service channels.
• when you request, contract, or use any products or services provided or intermediated by Inter.
• when you fill out forms and registrations made available by Inter.
• when you register as a Forum user and make posts.
• when you request quotes or other information about our products and services.
• when you participate in surveys or promotions conducted by Inter.

Data indirectly collected from the Data Subject: We may collect data indirectly in the following cases:

• when you send us information about third parties – these are Personal Data related to third parties necessary for the provision of services by Inter to you, such as, but not limited to, guarantors or beneficiaries. These are Personal Data you provide so we can perform the contracted services, in line with common practices in the banking sector.
• automatically, such as Personal Data collected during your use of our services via the App or website (browsing) – this includes information collected by Inter when you browse and/or use Inter’s services, including through Cookies and when you post or interact with Forum content.

Data provided by third parties: These are the details collected by Inter through its internal systems, credit information systems, as well as from third-party partners, suppliers, service providers, public entities, affiliated agencies, and information made publicly available or disclosed by you, always respecting the purposes outlined in this Policy. These companies may vary depending on the services offered by Inter and the information collected.

Inter will use the Personal Data for the purposes described in this Privacy Policy, including for marketing purposes, such as sending advertisements and promotional content via email or any other communication channel, in accordance with this Policy and the LGPD.

4. What Personal Data is Processed by Inter?

Below, we provide examples of the main categories of Personal Data that we may collect and process:

• Registration and identification data – full name, CPF (Individual Taxpayer Registry), RG (General Registry), driver’s license (CNH), profession, marital status, image/photo of your official ID documents, photo, date of birth, nationality, place of birth, parentage, gender, education level, username registered in the Forum (user @handle), among others.
• Contact information – phone number, mobile number, address (street, neighborhood, number, city, state, country, ZIP code), email.
• Financial and credit history information – banking details (branch number, account number, and bank), Pix key, financial transactions, income, transaction history, card data, information on financial restrictions, credit scores generated by credit bureaus, credit operation data.
• Sensitive personal data – facial biometrics (facial recognition technology that verifies individuals based on facial features) or fingerprint, among other Sensitive Personal Data.
• Browsing data – information we collect about your interactions with the App or website, such as search history, browsing history, access dates and times, features used, how you use the products and services, Forum interactions, App issues, and other system activities.
• Device data – information about the Device you use to access the App and website, such as brand, operating system, IP address, MAC address, type of network connection (Wi-Fi, 3G, LTE, Bluetooth, or others), network and Device performance, browser type, version, language, and App version.
• Geolocation – Inter may collect approximate location data via GPS or IP address. You can enable or disable location tracking by accessing the privacy/settings option on your Device. Disabling is applicable only for non-essential purposes.
• Third-party data – identification data of dependents, minors, spouses, legal representatives, guarantors or beneficiaries, and information from your contact list (if you voluntarily enable this feature in your app).

5. Why Does Inter Process Personal Data?

The Personal Data collected under this Policy is used for the following purposes:

• to fulfill our contractual obligations, especially the execution of the terms of your contract(s) with Inter.
• to comply with applicable legal and/or regulatory requirements.
• to provide and deliver our products, services, and features to you.
• to create a user account in the Super App Forum for posting and interacting with other users.
• to offer benefits and/or rewards to Forum users who meet established criteria.
• to enable sending and receiving payments via Pix within the Forum.
• to validate and authenticate the Personal Data of parents or legal guardians, necessary for confirming account opening for minors and providing related services and products.
• to authenticate financial transactions.
• to create an investor profile for tailoring financial services.
• to improve the performance of features available on the website and App, and ensure compatibility with your Device, thereby enhancing your experience.
• to serve Inter’s or third parties’ legitimate interests, for example, by generating monitoring reports to support and promote Inter’s activities, in accordance with the LGPD.
• to strengthen our security and protection procedures, aiming to provide a safer and more effective service.
• to proactively and automatically monitor operations performed while using our products and services, in order to detect and prevent fraud, financial crimes, and ensure the security of clients and the national financial system.
• to prevent money laundering and combat the financing of terrorism.
• to carry out internal operations, including customer and Data Subject support, troubleshooting, data analysis, testing, research, and statistics.
• to improve, enhance, and personalize our services, products, and features, ensuring they are presented to you in the most effective and tailored way.
• to inform our clients and prospects about new products, services, and features through general or targeted campaigns or mailing, and to send information about content, promotions, news, and other relevant events promoted and/or provided by Inter.
• to assess and/or understand the effectiveness of our advertising, aiming to deliver relevant, accurate, and personalized ads to you.
• to allow you to participate in interactive features of our services when you choose to do so.
• to manage our service delivery and/or product and service provision.
• to allow your participation in sweepstakes, promotions, campaigns, and prize/gift distributions.
• to notify you about any changes to our products and services.
• to produce evidence and assist in legal, administrative, or arbitration proceedings, as well as to help meet other legal requirements.
• to make decisions supported by systems, software, and technologies regarding the use of our services.
• to carry out credit protection activities, such as collections, credit assignment, financial risk analysis, and credit information checks.
• to offer pre-approved credit.
• to perform Processing activities permitted by you in specific situations, through your free, informed, specific, and highlighted consent. and
• to analyze your résumé, verify your qualifications and background, and assess whether you meet the specific requirements of the job you applied for.

Additionally, we clarify that:

• selfies/facial biometrics/images may be used by Inter to ensure the authenticity of your identity when opening an account and during the use of certain App features, such as password reset or registering the account on a new Device, to prevent fraud and ensure your security.
• the verification and confirmation of Personal Data may, at Inter’s discretion, be carried out by third-party partner companies (Processors), which will adhere to the same security and privacy standards outlined in this Policy.
• the location information we collect is approximate and allows us to: (i) enhance the security of your transactions based on geographic location points (anti-fraud). (ii) improve your App experience by showing, for example, products, services, establishments, and the nearest banking terminals. (iii) identify the origin of a call received through our customer service channels. and (iv) assist in identifying and confirming client locations for managing and addressing security and credit risk activities.

In addition to the purposes listed above, the table below provides, by way of example and not exhaustively: (i) the purpose, (ii) the description, (iii) some of the Personal Data we process, and (iv) the legal basis for Processing.

We emphasize that you will be the solely responsible for the quality and veracity of the Personal Data provided when registering, quoting and/or contracting any products or services.

Inter has no responsibility for the veracity of the Personal Data provided, as well as for any damages resulting from the inaccuracy and/or outdated nature of said information.

5.1. Collection and Processing of Personal Data of Children and Adolescents

Inter may process Personal Data of children and/or adolescents when requested to open a digital account owned by a child and/or adolescent.

To ensure greater security for the Personal Data of children and/or adolescents, Inter may request additional validations and approvals from at least one of the parents or legal guardian of said Data Subject, in the use of the account and the products and services available therein, and may also restrict such use.

Inter has internal procedures and technologies to assist in verifying the powers of the legal guardian.

The collection and Processing of Personal Data of children and/or adolescents are carried out following their best interests, observing the detailed rules in this Policy and the LGPD, without prejudice to specific terms and conditions of the products and services used.

6. Cookies

Cookies are small files that contain a sequence of characters, created and sent, which can be stored on your electronic devices or browser.

They are important tools for the proper functioning of our services, and also help remember your preferences and customize your access, making your browsing safer, faster, and more enjoyable.

You should be aware that if you choose to refuse or remove Cookies, the availability and functionality of Inter's services may be affected. For more information, please refer to our Cookies Policy.

7. Sharing of Personal Data

When necessary, we may share your information with the third parties listed below:

• among companies of the Inter Group.
• with business partners, service providers, suppliers and subcontractors for the perfect and correct execution of contracts entered into with them or with you, for example, to provide insurance intermediation services.
• with authorities and regulatory bodies, in compliance with applicable legislation.
• with advertising and marketing companies, to select and display relevant advertisements for you, as authorized.
• with law firms for acting in legal proceedings. and
• with search engine and analytics providers, to assist in improvements and optimizations of our App and website.

The purposes already presented in this Policy may justify the sharing of Personal Data, but we may also share your personal information with third parties:

• in case of transactions and corporate changes involving any Inter company, in which case the transfer of Personal Data will be necessary for the continuity of the services currently offered.
• in compliance with contracts or other agreements with our Data Subjects.
• to ensure greater security in your transactions and contracting, preventing fraud attempts, money laundering and other crimes, reducing credit risk and protecting your rights and properties, as well as those of Inter and other Data Subjects. For this purpose, Inter may validate your information, identity, qualification and, when applicable, of your representatives or related third parties, aiming to verify and confirm the authenticity of the information provided, including by confronting this information with that available in public or private databases, held by companies providing services to Inter.
• for the protection of Inter's interests in cases of demands and conflicts, including in judicial, administrative and arbitral proceedings.
• by court order or by request of competent administrative authorities that have legal competence for such requisition.
• to assist in identifying and confirming the location of clients so we can exercise activities related to security risk management and credit risk treatment.
• to assess financial risks. and
• collect from insolvent clients and Data Subjects and/or recover debts.

Don't worry, as any information sharing is done strictly to the extent necessary and following strict security and confidentiality standards, as well as banking secrecy rules and other laws and privacy protection regulations, always respecting and ensuring that third parties respect the confidentiality of your information.

Third parties that process Personal Data shared by Inter expressly commit to comply with the processing purposes, legal hypotheses for processing, good practices and internal standards established by Inter.

However, Inter will not be held responsible if third parties process Personal Data shared by Inter for purposes other than those described above, established contractually, by force of legal or regulatory obligation, among other legitimate and lawful processing hypotheses. Therefore, if third parties that received Personal Data from Inter use such data in non-compliance with legislation or with the purposes established between the parties, they assume the position of Controllers and become responsible for the protection and security of your Personal Data to the exact extent of the new Processing activities, including for purposes of exercising your rights as a Data Subject.

8. International Transfer of Personal Data

Inter may share your Personal Data with Group companies, business partners, service providers, suppliers and subcontractors located in other countries for the purposes described in this Policy, such as:

• to conduct internal operations, including support to our Data Subjects.
• to solve problems.
• to store and analyze data.
• for testing.
• for research and statistical analysis.
• for marketing operations and campaigns, as authorized. And
• to comply with our contractual obligations, especially the execution of the terms of your contract with Inter and the provision of our products and services.

We will only share data with third parties that are in countries that provide the degree of data protection provided for in the LGPD.

Inter will ensure that the transmission of your Personal Data is carried out in accordance with applicable privacy laws and, in particular, that adequate contractual, technical and organizational measures are observed, ensuring greater security for your Personal Data.

9. Duration of Personal Data Processing

The term for Processing your Personal Data by Inter will vary according to:

• the types of products and services contracted/provided/supplied.
• the purposes of Processing.
• the contractual and legal provisions in question.

For example: Personal Data used during account opening are subject to Central Bank regulations that require minimum retention of 10 (ten) years after contract termination.

Furthermore, in case of refusal of your proposal to contract any product or in cases where you start but decide not to proceed with your registration at Inter, we will maintain your Personal Data for the period necessary to comply with the purposes provided for by law and in this Policy.

Inter will maintain information that allows:

• compliance with applicable legislation and regulations (for example: rules related to prevention of money laundering and terrorism financing. account opening, maintenance and closure).
• maintaining records of any person who does not want to receive advertising and marketing from Inter.
• responding to eventual complaints and future legal demands about the services we provide.
• fraud monitoring.

10. Your Personal Information Security

We care for the security and privacy of the data you actively provide to us or that we collect, observing and complying, for Processing, not only with the standards, principles and guidelines for data protection, but also with the banking secrecy rules in force.

We adopt technical, administrative and preventive measures in relation to the products and services offered, protecting information and information technology assets against unauthorized access and Processing, complying with the laws and standards that regulate our market of operation, determining cybernetic risk management mechanisms, in addition to implementing information security policies.

We reinforce the importance of not sharing Personal Data and access passwords with third parties, in order to avoid fraud and improper access to your account. Furthermore, we suggest that you use a strong password that is exclusive and always exit the Inter application after accessing and using your account.

Inter has a specific page about privacy and Personal Data protection, where the Data Subject can consult and clarify doubts about security, how to exercise their rights provided for in the LGPD, important definitions, answers to frequently asked questions about Personal Data Processing, among other doubts.

Do you want to know more? Access our Privacy Page.

11. Your Rights as the Subject of Personal Information

The LGPD grants a series of rights to Data Subjects. Therefore, you, as a Data Subject, may make requests to Inter as detailed in the table below:

To exercise any of your rights established above, as well as determine your preferences in the Processing and use of some of your Personal Data by Inter, you can access at any time and free of charge the Privacy Center in the Super App, and/or contact our Data Protection Officer, Camila Wendling, through the email "privacidade@inter.co ". You will receive a response within a maximum of 15 (fifteen) days from the date of your request.

If you are not satisfied with the solution presented, contact the Ombudsman by phone 0800 940 7772 available Monday to Friday, from 9am to 6pm (except holidays). and to report any suspicious attitude and/or communicate conduct considered unethical, that violates Inter's Code of Conduct and Ethics and/or current legislation by our employees, partners and clients, you can use the channel https://canaldedenuncia.bancointer.com.br/ or call 0800 887 0077, available 24 hours, 365 days a year.

For security reasons, we can only fulfill your request if we are certain of your identity. Therefore, we may request additional data or information to confirm the identity and authenticity of the requester.

12. Updates and Questions

Your information will always be processed in compliance with the LGPD and in accordance with this Policy, which may be modified at any time, due to legislative changes or in the products or services we provide, as a result of updating technological tools or, when necessary, at our discretion.

When we make relevant changes, Data Subjects will be notified through notice in our App, website, email or by any other available means of communication, at Inter's discretion. Make sure to carefully read any notice of this nature.

Any clause or condition of this Policy that, for any reason, comes to be deemed null or ineffective by any court or tribunal, will not affect the validity of the other provisions of this Policy, which will remain fully valid and binding, generating effects to their maximum extent.

Inter's failure to demand any rights or provisions of this Policy will not constitute a waiver, and it may regularly exercise its right within legal deadlines.

Any questions about this Policy can be addressed with our Data Protection Officer, and for additional information, we invite you to check our Privacy Page.

13. Applicable Law and Conflict Resolution

Any and all controversies arising from the terms set forth in this Privacy Policy will be resolved in accordance with Brazilian law.

The use of services and/or orders executed outside Brazilian territory, as applicable, or those resulting from operations initiated abroad may also be subject to the legislation and jurisdiction of the authorities of the countries where they are executed or initiated.