Last Updated: October 4, 2024

At SURFCARONA LTDA, a company duly registered under CNPJ n. 49.800.572/0001-44, headquartered at Rua Apa, n. 8, Lagoa da Conceição neighborhood, ZIP code 88062-135, in Florianópolis, Santa Catarina, Brazil, we are committed to protecting the privacy and data of our users. Below, we present our Privacy Policy to clarify how we process your information and how we may use it to better serve you.

First and foremost, we assure you: your data is yours. We respect your privacy and treat the data entrusted to us as part of our mission to provide quality service.

Providing your voluntary, express, and informed consent to this Privacy Policy is an essential requirement for contracting and/or establishing any type of relationship with SURF CARONA, as per Article 7, I of Law n. 13.709/18.

Here are some key points to help you understand how your data is handled by SURF CARONA:

● The data you provide on our platforms is securely processed, and we limit its use to its intended purposes.

● You can ask questions or request information at any time through the “Contact Us” section of our Platform.

1. Important Definitions

Personal data: Information related to a natural person that allows them to be identified, directly or indirectly. Examples: name, phone number, email address, CPF (taxpayer registration number), etc.

Sensitive personal data: Personal data about racial or ethnic origin, religious beliefs, political opinions, union membership, or affiliation with religious, philosophical, or political organizations, as well as data concerning health, sex life, genetics, or biometrics, all linked to a natural person.

In this Privacy Policy, “personal data” and “sensitive personal data” may be collectively referred to as “data” or “personal data.”

Database: A structured set of personal data, located in one or multiple locations, in electronic or physical form.

Data Subject: The natural person to whom the personal data being processed refers.

Controller: A natural or legal person, public or private, responsible for decisions regarding the processing of personal data. In this case, when you access or use the services we provide, SURF CARONA becomes the Controller of the data you provide.

Processor: A natural or legal person, public or private, who processes personal data on behalf of the Controller.

Processing: Any operation SURF CARONA may perform with your personal data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation, or control of information, modification, communication, transfer, dissemination, or extraction.

LGPD: Refers to the General Data Protection Law (Law n. 13.709/2018), which governs the protection of personal data in Brazil.

User (sometimes referred to as “you”): Any person registered on our platform to use or potentially use our services.

Policy: Refers to this Privacy Policy.

Driver: The partner driver of SURF CARONA who provides private individual paid passenger transportation services using our services.

2. Who Does This Policy Apply To?

This Privacy Policy, also referred to as the “Policy,” applies to anyone who accesses or registers on our Platform (as defined below) and to anyone who uses SURF CARONA’s services in any other way.

Our app and website are collectively referred to as the “Platform” or “Platforms.” When we mention the terms “we” or “our,” we are generally referring to SURF CARONA; similarly, whenever we mention the terms “you” or “your,” we are referring to our users.

3. What Data Is Collected, and For What Purpose?

SURF CARONA collects and processes personal data provided according to how the Data Subject interacts with the platform. Data usage varies for passenger users, driver users, and visitors to the website.

To maintain transparency with our audience, we detail the types of data collected for each type of Data Subject below:

Data for Passenger User Registration:

For this profile, we collect the following data: name, gender, date of birth, email address, phone number (optional), personal image (photo and document photo), real-time geolocation data during platform usage, and payment data.

Purposes of Collected Data:

• Name, gender, date of birth, ID number, and ID photo (e.g., CPF or RG): Necessary for completing registration, authenticating the user, and ensuring service security, aiming to prevent fraud.

• Contact information (phone and email): Used for platform communications, including service notifications and marketing.

• User photos or document photos: Used for facial recognition to enhance security and validate identity during registration and trips.

• Real-time geolocation data: Allows the Driver to locate the user and calculates trip costs based on the user’s current and destination locations.

• Payment data: Enables in-app payment processing (e.g., credit/debit card). SURF CARONA only stores incomplete payment data (e.g., first six and last four digits of the card).

Data for Driver User Registration:

For drivers, we collect: full name, gender, date of birth, email address, residential address, phone number (including WhatsApp communications), driver’s license (CNH) and category, CRLV, RENAVAM, vehicle license plate, criminal record, payment data, bank account details, personal image (profile photo and document photo), and real-time geolocation data during platform use.

Purposes of Collected Data:

• Personal and vehicle information (e.g., CNH, CRLV, RENAVAM): Ensures secure registration, authenticates identity, and prevents fraud.

• Contact information: Facilitates communication about trips and services.

• Bank account details: Used for paying drivers.

• Geolocation data: Helps users locate drivers and assists in trip cost calculations.

Additional Data Generated During Service Use:

• Device Data: Automatically collected information about devices accessing SURF CARONA (e.g., IP address, browser type, operating system, etc.).

• Transactional Data: Data on interactions, including trip details, requests, and usage history.

• Communication Data: Facilitates communication between users and drivers via the platform’s chat or call features.

4. How Do We Use This Data?

• To provide and improve our services.

• For account creation and updates.

• For marketing purposes (with user consent).

• To enhance safety and prevent fraud.

• To generate statistics and analytics for service improvement.

For the full Privacy Policy, including detailed sections on data storage, sharing, and rights under LGPD, please refer to our updated version.