This document is available in Portuguese as per the legal requirements of the company's jurisdiction. A translated version may be provided in the future.
Effective date: April 02, 2026
Data Controller: Montres Global Ltda. – "MON 3"
Contact: contato@mon3.co
This policy establishes information security guidelines for the protection of the company's data and systems. All data is protected with encryption in transit and at rest, multi-factor authentication, and periodic backups. All our incidents are recorded and reported to the DPO and, when applicable, to ANPD.
At MON 3, we are committed to protecting your privacy and ensuring that your personal information is handled securely and responsibly. This Privacy and Data Protection Policy explains how we collect, use, share, and protect your personal information when you use our services, in accordance with the provisions of the General Data Protection Regulation (GDPR). This policy has been designed to align with both the LGPD (Brazil) and, when applicable, the GDPR (European Union), reflecting the fact that our services may be accessed internationally.
MON 3 is a technology service provider (software provider/technical intermediary), and is neither a financial institution nor a virtual asset service provider. We are a technology provider that has a connectivity platform with infrastructure from duly licensed and regulated third-party partners to operate in all jurisdictions where we operate. We do not provide financial services directly; we act exclusively as technological intermediaries and systems integrators. All regulated activity — including custody, settlement, transfer of funds, and identity verification (KYC/KYB/AML/CFT) — is performed by licensed partner institutions in their respective jurisdictions. MON 3 technically integrates this infrastructure and does not perform its own custody or direct movement of funds.
Data Protection Officer (DPO): Pedro Motta — pedro.motta@mon3.co
Any information relating to an identified or identifiable natural person, such as names, addresses, email addresses, identification numbers, and IP addresses.
The user to whom the data refers.
The entity that determines the purposes and means of processing personal data. In this case, it is MON 3 and our licensed partners.
The entity that processes personal data on behalf of the data controller. These are the suppliers and licensed partners that process your data as determined by MON 3.
We collect and process, together with our licensed partners, the following categories of personal data:
Full name, CPF (Brazilian tax ID), date of birth, sex, gender, nationality, identity document, facial photo and proof of residence, driver's license, passport number.
Email address, phone number, residential/mailing address, emergency contact information.
Bank account numbers, credit card information, income details, tax identification number, financial transaction history.
Device model, browser type, operating system, IP address, geolocation, Wi-Fi identifiers, location history, session logs, cookies, and usage data (clickstream, session duration).
Transaction history, amounts, on-chain activity, PIX transactions, amounts, timestamps, payment behavior and payment method, billing addresses.
Website or app usage patterns, session duration, pages visited, clickstream data, error logs, and crash reports.
Usernames and account identifiers, profile photos and avatars, user-generated content (profile descriptions, bios), user preferences and settings.
Customer service communications, support tickets, chat logs.
Job title, employer, income, workplace location, account verification data, and employment-related identifiers (when necessary for payment eligibility as per licensed partner requirements).
Data collected through our licensed partners, including biometric facial matching and digitized documents.
Preferences, referral source, behavior on our website or app.
If you contact us directly, we may request additional information, such as your name, email address, residential address, phone number, and other relevant personal data.
Our services, through the use of infrastructure by licensed partner financial institutions, allow users to make international payments. We use duly regulated third-party financial institutions to process payments in fiat currency and stablecoins.
We may obtain personal data from third-party partners and suppliers to provide complete and integrated services. These third parties may include:
Our collection, use, and sharing of data are based on various legal bases, depending on the context. These include:
We use your data for various purposes, including:
Service and application provision and maintenance: to ensure the functionality and availability of our services.
Payment processing and order execution: to process payments and complete orders in compliance with transparency and competitiveness rules.
Fraud prevention: to detect and prevent fund losses, including those resulting from fraud and misuse of our services and applications.
Compliance with laws and regulations: to ensure compliance with relevant laws and regulations, such as anti-money laundering and counter-terrorism financing.
User communication and support: to communicate directly with you or through our partners for customer support, notifications about service changes and updates, important service-related information, marketing, and promotions.
Service improvement: to continuously improve the quality, performance, and features of our services.
Research and development: to conduct research and development activities related to our services, including the development of new app features and functionalities.
Measurement and analytics: to understand how users interact with our services, analyze user behavior, and identify preferences.
Security: to promote the security and integrity of your funds, our services, and data through continuous protection measures and monitoring.
User account management: to manage user accounts, including setup, recovery, and account closure.
Personalization: to tailor user experiences based on preferences and behaviors, providing personalized content and recommendations.
We may share your information with various third parties to support and enhance our business operations, including:
We share your data with partners and processors under data protection agreements and standard contractual clauses (SCCs):
Licensed partners responsible for identity and document verification, biometric data matching, in compliance with KYC/KYB and applicable regulations.
Licensed partner financial institutions responsible for executing payments in fiat currency and stablecoins, including PIX, ACH, Wire, SWIFT, and other available payment networks. These partners may independently collect additional data for AML, fraud prevention, and payment eligibility.
Cloud hosting, security, analytics tools, CRM platforms, and observability.
As necessary for compliance with applicable financial regulations, court orders, AML/CFT rules, or government institutions.
When you use payment features, the following applies:
All information processed by us may be transferred, processed, and stored anywhere in the world, including but not limited to the USA, the UAE, the EU, or other countries, which may have data protection laws different from those of your country of residence. We strive to safeguard your information in accordance with the requirements of applicable legislation.
Your data may be processed and stored in:
All transfers are protected by encryption, SCCs, and compliance with Article 33 of the LGPD.
When applicable local laws require data to be stored in specific territories, we maintain the necessary infrastructure to ensure compliance with these data localization requirements while providing a seamless global service.
We are committed to maintaining the highest standards of data protection, regardless of where your data is processed or stored. If you have questions about how your data is handled in a specific country or region, please contact our Data Protection team.
We implement security measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include:
Access controls: restricting access to your personal information to authorized personnel for legitimate business purposes.
Employee training: training our staff on data security best practices.
Data backups: performing regular data backups to prevent data loss.
Incident response: establishing incident response procedures to promptly address and mitigate any security incidents.
End-to-end encryption for sensitive data.
Role-based access control and MFA.
Secure cloud storage and physical infrastructure.
Biometric verification through secure licensed partners.
Regular audits, backup systems, and incident response plans.
While we strive to protect your information, no security system is impenetrable. We continuously evaluate and enhance our security practices to better protect your data.
We will not sell, rent, or lease your information to third parties. However, we may share your information with trusted third parties to help us perform statistical analysis, send you email or postal mail, provide customer support, or arrange deliveries. All such entities will be prohibited from using your personal information for any purpose other than what we have respectively requested, and they will be required to maintain full confidentiality in handling this information. We will not use or disclose sensitive personal information, such as race, religion, or political affiliations, without your explicit consent.
Our website may, from time to time, contain links to and from the websites of our partner networks. If you follow a link to any of these websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before submitting any personal data to these websites.
We will retain your personal information for as long as you are a customer of MON 3 services. We may retain your personal information for a maximum period of 5 years after you cease to be a customer. The reasons we may do so are:
We will retain your personal information only for the period necessary to fulfill the specific purposes for which it was collected. We may also retain your data for more than 5 years if certain laws do not allow us to delete them for legal, regulatory, or technical reasons.
• For the time necessary to provide the services;
• Compliance required by AML and regulatory law (minimum of 5 to 7 years for transactions);
• Until deletion of the user's account (with limitations due to legal obligations or partner retention requirements).
As a user of our services and application, you have certain rights regarding the personal data we collect and use:
Note: MON 3 is a technology service provider and not a financial institution. As our licensed partners are regulated financial service providers, they are subject to certain regulatory obligations that may limit our ability to delete some of your data, including AML compliance, financial record-keeping (5 to 7 years), and fraud prevention.
To exercise your rights, send an email to: contato@mon3.co
Consent (e.g., marketing or optional features);
Legal or regulatory obligation (e.g., AML requirements);
Contract performance (e.g., transaction execution);
Legitimate interest (e.g., fraud prevention, platform analytics);
We process personal data for the following purposes, with verification conducted by licensed partners:
MON 3 is a technology service provider (software provider/technical intermediary), and is neither a financial institution nor a virtual asset service provider. We are a technology provider that has a connectivity platform with infrastructure from duly licensed and regulated partners.
We use:
You can disable cookies in your browser. Some features may not function properly if disabled. Visit our Cookie Policy for more information.
Our services are not intended for individuals under 18 years of age. We do not intentionally collect personal information from minors. If we become aware that we have inadvertently collected personal data from a person under 18 years of age, we will take appropriate steps to delete such information from our records. If you believe we may have information from or about a child under 18, please contact us immediately at contato@mon3.co.
We may periodically update this Privacy Policy to reflect changes in our data processing practices and legal requirements or to improve transparency and clarity. Any substantial changes to this Privacy Policy will be incorporated directly into the Policy and will be available for review on the website and app.
Changes will be published at www.mon3.co, and major updates will be communicated via email and in-app notice. We recommend that you review this Policy periodically to stay informed about how we handle your data.
The Company reserves the right to modify the Privacy Policy at any time, at its sole discretion. If the user does not agree with the amended version, they must immediately discontinue their access to the website and stop using all services. If you continue to use the services, the amended Privacy Policy will have legal effect and your actions will constitute acceptance of the changes.
Email: contato@mon3.co
Data Protection Officer (DPO): Pedro Motta — pedro.motta@mon3.co
Website: www.mon3.co
Last updated: April 02, 2026
