simplic.com.br — 45/100 (High privacy risk)
Last analyzed
Simplic (LH1010 SERVIÇOS DE CORRESPONDENTE BANCÁRIO LTDA. and LH1003 SERVIÇOS DE DADOS LTDA.) · simplic.com.br
Report details
High privacy riskSimplic’s privacy policy is highly invasive for EU users, collecting excessive personal and financial data, sharing it broadly with third parties (including outside Brazil), and lacking GDPR-specific safeguards or opt-outs for AI/model training.
Simplic, a Brazilian financial services platform acting as a banking correspondent, collects extensive personal, financial, and professional data (e.g., CPF, RG, bank details, income, social media data, document copies) for credit intermediation, marketing, and fraud prevention. Data is shared widely with financial partners, credit bureaus (e.g., Serasa, Boa Vista), payment operators, insurers, and even investors or potential buyers, including cross-border transfers. The policy is governed by Brazil’s LGPD, not GDPR, and lacks explicit EU-specific protections (e.g., Standard Contractual Clauses, adequacy decisions) for international transfers. User rights under LGPD are listed, but GDPR rights (e.g., right to object, data portability) are not explicitly addressed for EU users. There is no mention of AI/model training opt-outs, and data retention is vague beyond ‘necessary for purposes.’ The policy is transparent about data uses but fails to meet EU privacy standards for non-Brazilian users.
Category Assessment
Breakdown of the policy across key compliance areas. Good = strong, fair = mixed, poor = concerning.
Collects excessive data (e.g., CPF, RG, bank details, social media data, document copies) far beyond what is necessary for basic services, with no clear justification for all categories under GDPR principles.
The policy is detailed about data categories and purposes but is Brazil-centric (LGPD) and lacks clarity on GDPR-specific rights, safeguards, or EU user protections.
Data is shared with a vast array of third parties (financial partners, credit bureaus, insurers, investors, payment operators, etc.), including cross-border transfers, with no granular controls or opt-outs for users.
Acknowledges potential transfers outside Brazil but provides no GDPR-compliant mechanisms (e.g., SCCs) or details on safeguards for EU users.
No explicit mention of AI/model training, but data is used for profiling (credit scoring) and marketing. No opt-out mechanism is provided for such uses.
Lists LGPD rights (access, correction, deletion, etc.) but does not explicitly address GDPR rights (e.g., right to object, data portability) or how EU users can exercise them.
Key Findings
Notable clauses, issues, or positive practices discovered (critical first)
Excessive Data Collection Without Clear Necessity
The policy lists extensive data categories collected, including CPF, RG, bank details, income, social media data, and document copies (Section 3). For EU users, this likely violates GDPR’s data minimization principle (Article 5(1)(c)), as much of this data (e.g., social media content, document copies) is not strictly necessary for credit intermediation.
Broad Third-Party Sharing Without User Control
Data is shared with financial partners, credit bureaus (Serasa, Boa Vista), payment operators, insurers, investors, and ‘any other third parties’ for vague purposes like ‘enrichment of information’ (Section 5). This lacks granularity and user control, violating GDPR’s principles of purpose limitation and transparency (Articles 5(1)(b), 13-14).
International Transfers Lack GDPR Safeguards
The policy states data ‘may be transferred and stored outside Brazil’ (Section 6) but provides no details on GDPR-compliant mechanisms (e.g., Standard Contractual Clauses, adequacy decisions). This is a critical gap for EU users, as transfers to non-adequate countries require explicit safeguards (GDPR Chapter V).
No Explicit Opt-Out for Profiling or AI Training
Data is used for credit scoring, fraud prevention, and marketing (Sections 4, 5), which may involve automated profiling. The policy does not mention opt-outs for such processing, violating GDPR’s Article 22 (right to object to automated decisions) and lack of transparency.
LGPD-Centric Policy Ignores GDPR for EU Users
The policy is framed under Brazil’s LGPD, with no explicit mention of GDPR compliance for EU users. This includes missing lawful bases for processing (e.g., consent, contract), DPIAs for high-risk processing, or special category data protections (e.g., biometric data if collected).
Consumer Takeaway
Avoid using Simplic if you are an EU resident: your data will likely be transferred outside the EU/EEA without clear GDPR-compliant safeguards, shared with numerous third parties, and used for purposes like credit scoring and marketing without explicit opt-outs for AI training or profiling.
Compliance Posture
Non-compliant with GDPR for EU users. The policy is framed under Brazil’s LGPD, with no evidence of GDPR alignment (e.g., lawful bases for EU users, DPIAs, or international transfer mechanisms). Cross-border data transfers are acknowledged but lack specificity on safeguards.
EU Transfers
High risk. Data may be transferred outside Brazil (and thus likely outside the EU/EEA) with no mention of GDPR-approved mechanisms (e.g., SCCs, adequacy decisions, or Binding Corporate Rules). The policy states measures will be taken to protect data but provides no details.
Detected Signals
Specific data points and practices identified in the text
Evidence Snippets
Direct quotes from the policy supporting these findings
Podemos eventualmente compartilhar os seus Dados Pessoais com Instituições Financeiras Parceiras, bem como com os terceiros identificados abaixo para nos apoiar na execução das finalidades indicadas
Os seus Dados Pessoais poderão ser transferidos e armazenados em um destino fora do Brasil, na medida permitida por lei. Se os seus Dados Pessoais forem transferidos para outro país, nós adotaremos as medidas exigidas por lei para assegurar que eles continuem protegidos.
Análise de crédito e verificação de autenticidade das informações e documentos fornecidos, inclusive mediante tratamento e verificação cruzada. Verificação antifraude
A Simplic não tem qualquer responsabilidade ou ingerência sobre os critérios adotados pelas agências para fins de atribuição de credit scoring.
Missing or Unclear
- No GDPR-specific lawful bases for processing EU user data
- No mention of Standard Contractual Clauses (SCCs) or other GDPR transfer mechanisms
- No opt-out for AI/model training or profiling
- No explicit GDPR rights (e.g., right to object, data portability) for EU users
- No Data Protection Impact Assessment (DPIA) references for high-risk processing
- No details on data retention periods for EU users
- No mention of special category data (e.g., biometric) protections
- No clarity on whether data is used for AI training
Questions to Ask
- What GDPR-compliant mechanisms (e.g., SCCs, adequacy decisions) are in place for international data transfers outside the EU/EEA?
- Does Simplic process EU user data under GDPR lawful bases (e.g., consent, contract), and if so, which ones apply to each processing purpose?
- Is user data used for AI or machine learning model training, and if so, how can EU users opt out?
- Are Data Protection Impact Assessments (DPIAs) conducted for high-risk processing activities like credit scoring or fraud prevention?
- How long is EU user data retained, and what are the specific criteria for deletion under GDPR?
- How can EU users exercise their GDPR rights (e.g., access, rectification, erasure, objection) if they are not covered by LGPD?
- Are there any third parties outside Brazil that receive EU user data, and what safeguards are in place to protect it?
- Does Simplic use biometric or other special category data, and if so, what protections are in place under GDPR Article 9?
Share this analysis
Anyone with this link can view the result above.
Built by DentroChat
100% European AI chat for everyone
Chat with AI, work with files, generate images, and search the web. Data stays in Europe.
Other analysed privacy policies
View allwhatsapp.com
45/100
High privacy riskWhatsApp collects extensive metadata on your usage and device and shares it widely across Meta's family of companies, making it a concerning privacy choice despite its end-to-end encrypted messaging.
View report →european-alternatives.eu
45/100
High privacy riskEuropean Alternatives collects minimal data and uses privacy-friendly tools, but its privacy policy is an unfinished template with placeholder text for critical sections like data storage, retention, and deletion — making it non-compliant as-is.
View report →hotels.com
48/100
High privacy riskHotels.com (Expedia Group) collects an unusually broad range of personal data — including sensitive data, voice recordings, and co-traveler info — shares it widely with advertisers and Expedia Group brands, and uses it for extensive AI purposes with no opt-out, making this a data-hungry policy despite decent transfer safeguards.
View report →policies.tinder.com
48/100
High privacy riskTinder collects a massive amount of highly sensitive personal data—including sexual orientation, biometric face data, and precise location—and shares it widely across Match Group companies and advertising partners, making it a concerning privacy choice despite offering standard EU rights.
View report →