Privacy Policy

This English text is a convenience translation. In case of any divergence, the Portuguese version prevails.

This Policy explains how Tranzio Intermediacoes e Agenciamentos Ltda processes personal data in the store. Processing is limited to what is necessary to operate the account, sell, deliver, support and meet legal obligations.

1. Controller and LGPD Channel

The controller is Tranzio Intermediacoes e Agenciamentos Ltda, CNPJ 66.666.656/0001-56, with address at Rua Aparecido Sanches Massano, 86, Centro, Mamborê/PR, CEP 87340-000. For privacy matters and rights under the LGPD, contact Tranzio through the data subject request form or by e-mail at support@tranzioagenciamento.com.

For privacy matters and exercise of rights, use the LGPD Channel: through the data subject request form or by e-mail at support@tranzioagenciamento.com. This channel does not require sign-in. For general support, use through the form on the Contact page or by e-mail at support@tranzioagenciamento.com.

2. Data, purposes and legal bases

Personal data	Purpose and necessity	Main legal basis
Account name, e-mail, password hash and language	Create, authenticate and maintain the account and support the data subject	Contract performance and preliminary procedures (LGPD, art. 7, V)
Date of birth and statement of being 18 or older	Apply the account and purchase rule for adults	Contract performance and preliminary procedures (LGPD, art. 7, V)
Products, SKU, quantity, price, order, payment and refund	Record and perform purchase, delivery, cancellation and refund	Contract performance (LGPD, art. 7, V)
CPF and Pix payer data	Create the Pix charge, prevent fraud and keep legal and tax records	Contract performance and legal or regulatory obligation (LGPD, art. 7, V and II)
Tranzio Key and issuer code, where applicable	Make the purchased product available, redeem it and protect it; keys are stored encrypted	Contract performance (LGPD, art. 7, V)
Player ID and, when needed, server or zone	Process a top-up or make the product available after redemption	Contract performance (LGPD, art. 7, V)
Necessary account, order, payment and security records	Prevent fraud, protect the store and investigate misuse	Legitimate interest, with necessity and proportionality (LGPD, art. 7, IX)
Tax, consumer, order, payment and refund records	Meet legal, regulatory and consumer-protection obligations	Legal or regulatory obligation (LGPD, art. 7, II)
Support messages and LGPD requests	Answer questions, complaints and requests, and exercise or defend rights	Contract performance, legal obligation and regular exercise of rights (LGPD, art. 7, V, II and VI)
Category, description, reference and optional e-mail in the Report Channel	Receive, assess and respond to reports, including child or adolescent risk	Legal obligation and regular exercise of rights (LGPD, art. 7, II and VI)
Customer ID, IP, user agent, date and time of sign-in, sign-out and checkout	Keep application access records and protect their security	Legal obligation (Marco Civil, art. 15; LGPD, art. 7, II)
Necessary cookies and device storage described in the Cookie Policy	Maintain session, security, cookie notice and checkout on the device	Contract performance and legitimate interest for security and operation (LGPD, art. 7, V and IX)

We do not use data for behavioural advertising, targeted ads or browsing analytics. No analytics, advertising or third-party trackers are in use.

3. Sharing and recipients

We share only the data necessary for the corresponding purpose:

• with Luxtak, the payment institution, for Pix charges and returns. It receives name, CPF, e-mail, amount and order ID;
• with hosting, database and CDN providers that operate store infrastructure;
• with game publishers and suppliers, only the player ID and server needed to fulfil the top-up or redemption; and
• with authorities, where there is a legal obligation.

Tranzio remains responsible for its obligations as controller. We do not sell personal data.

4. International transfers

Hosting-provider servers may be located outside Brazil. Where an international transfer occurs, it will follow LGPD art. 33 and ANPD Board Resolution No. 19/2024. Information on applicable countries and safeguards may be requested through the LGPD Channel.

5. Retention and deletion

We keep data for the time necessary for the purpose and legal obligations. The periods below are operational and do not prevent longer retention where there is a court order, legal duty or need to preserve rights.

Record	Retention period
Expired session	up to 30 days
Application access records: customer ID, IP, user agent, event and date/time	6 months, under confidentiality, under Marco Civil art. 15
Orders, payments, refunds, tax documents and consumer records	5 years
Contact messages	12 months
Privacy, withdrawal and complaint requests	5 years
Security incident records	5 years
Account data	while the account is active; then deletion or anonymisation, except data subject to legal retention

At the end of the applicable period, we delete or anonymise data as appropriate.

6. Security

We use the following verified measures: keys stored with encryption, passwords stored as hashes, HTTPS connections and a staff panel with role-restricted access. No system is risk-free.

7. Your LGPD rights

Under LGPD art. 18, you may request:

• confirmation that processing exists;
• access to data;
• correction of incomplete, inaccurate or out-of-date data;
• anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed data;
• portability, subject to applicable rules;
• information about public and private entities with which we share data;
• information about the possibility of not providing consent and its consequences, where consent is requested;
• withdrawal of consent, where applicable; and
• deletion of data processed with consent, where applicable and subject to legal retention grounds.

You may also petition the ANPD about processing of your data. If a decision based solely on automated processing affects your interests, you may request review under LGPD art. 20.

Make a request through the LGPD Channel: through the data subject request form or by e-mail at support@tranzioagenciamento.com. We provide simplified confirmation immediately when possible and a complete declaration within 15 days (LGPD, art. 19). We may request identity verification proportionate to the request to protect data.

8. Children and adolescents

The store accepts accounts and purchases only from people aged 18 or older. We do not offer child or teen accounts or linked profiles. A legal guardian may purchase through their own account for a minor's use and must supervise that use.

If redemption requires a minor's player ID, we process only the non-secret data needed for delivery. We do not create commercial profiles, behavioural advertising or targeted ads using child or adolescent data. See Child and Adolescent Safety.

9. Application access records

For sign-in, sign-out and checkout events, we keep customer ID, IP address, user agent and date and time. These records are confidential, kept in a controlled environment for 6 months and deleted by an automatic routine, unless a legal or court order requires preservation. Disclosure occurs only by court order (Marco Civil, arts. 10 and 15).

These access records are separate from order, payment and support records.

10. Security incidents

We assess security incidents. Where there is relevant risk or harm to data subjects, we will notify the ANPD and affected data subjects within 3 business days, under the applicable provisions of ANPD Board Resolution No. 15/2024. We keep incident records for 5 years.

11. Cookies and device storage

The Cookie Policy describes the necessary device technologies in use, their purposes and how to clear browser storage. We do not use analytics, advertising or third-party trackers.

12. Updates to this Policy

If this Policy changes, the new version will be published on this page before taking effect for future processing. An update does not authorise use incompatible with the stated purpose or with law.

Version history

2.0 — 21 October 2026: compliance review (Decree 7.962/2013, CDC, LGPD, Marco Civil and Decree 8.771/2016, Law 15.211/2025, LBI); replaces version 1.2.