LGPD / DATA PROTECTION

Privacy and Data Security Commitment — Last updated on March 25, 2026

Driver ID deeply values the privacy and security of personal data. This page details our commitment to data protection, in compliance with the Brazilian General Data Protection Law (LGPD) and other applicable regulations. Our goal is to ensure transparency about how we handle information, reinforcing the practices already established in our Privacy Policy and Terms of Use, which can be found in the footer of our website.

1. About This Policy

The purpose of this policy is to inform our clients, partners, and data subjects about the guidelines and practices adopted by Driver ID regarding the processing of personal data. It clearly and objectively describes how we collect, use, store, share, and protect information, reaffirming our commitment to privacy and security across all our operations.

2. Driver ID's Role in Data Processing

Driver ID acts primarily as a Personal Data Operator. This means that, in most cases, we process personal data on behalf of and under the instructions of our clients, who are the Personal Data Controllers. Our clients are responsible for defining the purposes and means of data processing, while Driver ID ensures that processing occurs securely and in compliance with the instructions received and current legislation. In specific situations, Driver ID may act as a Controller, when it defines the purposes and means of data processing for its own operations.

3. Personal Data Processed

In the context of our identity verification, documentation, and driver and vehicle information services, Driver ID may process the following types of personal data:

  • Identification data: Full name, CPF (tax ID), date of birth, parentage.
  • Documentary data: Images of identification documents (such as driver's license and ID card), registration number, and license category.
  • Vehicle data: License plate, RENAVAM, licensing information.
  • Biometric data: Selfie images for facial recognition and liveness detection, when applicable and requested by the client.
  • Contact data: Email and phone number, when provided during the verification flow or for support communication.

4. Purposes of Data Processing

Personal data is processed by Driver ID exclusively for the following purposes, in accordance with our clients' instructions:

  • Identity verification: Confirm the authenticity and ownership of the provided data.
  • Document analysis: Validate the accuracy and integrity of submitted documents.
  • Fraud prevention: Identify and mitigate risks of fraudulent activities.
  • Operational security: Ensure the integrity and security of processes and the platform.
  • Legal and regulatory compliance: Meet the requirements of regulatory bodies and applicable laws.
  • Support for client operations: Provide verification results so the client can make informed decisions.

5. Legal Bases for Data Processing

The processing of personal data by Driver ID is carried out based on the legal hypotheses set forth in the LGPD, which may vary according to the specific purpose and context. The most common legal bases include:

  • Consent: When the data subject authorizes the processing for a specific purpose.
  • Execution of contract or preliminary procedures: To fulfill contractual obligations or carry out actions prior to entering into a contract.
  • Legitimate interest: To serve the legitimate interests of Driver ID or third parties, provided it does not violate the fundamental rights and freedoms of the data subject.
  • Compliance with legal or regulatory obligation: To meet legal or regulatory requirements imposed on Driver ID or its clients.

6. Data Sharing

Driver ID is committed to not improperly sharing personal data. Sharing occurs strictly in the following situations:

  • With the contracting client: Processed data is shared with the client who contracted Driver ID's services, in accordance with agreed-upon instructions and purposes.
  • With essential suppliers and partners: For the execution of our services, we may share data with sub-processors or technology providers that assist us in our operations, always under strict confidentiality and data protection agreements.
  • With authorities: When required by law, court order, or request from competent government authorities.

7. Information Security

Driver ID adopts robust technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction. Our security practices include:

  • Access controls: Restricted access to data, limited to authorized personnel with a need to know.
  • Encryption: Use of encryption to protect data in transit and at rest, when applicable.
  • Monitoring and logs: Continuous system monitoring and activity logging for incident detection and response.
  • Regular backups: Performance of data backups to ensure data recovery in the event of failures.
  • Internal best practices: Ongoing team training and adoption of internal information security policies.

8. Data Retention and Disposal

Personal data is retained by Driver ID only for as long as necessary to fulfill the purposes for which it was collected, to meet legal or regulatory obligations, or to defend rights in administrative and judicial proceedings. After the retention period ends, data is securely and irreversibly disposed of, ensuring it cannot be recovered or accessed.

9. Data Subjects' Rights

  • Under the LGPD, personal data subjects have the following rights:
  • Access: Obtain confirmation regarding the existence of processing and access to their data.
  • Correction: Request the correction of incomplete, inaccurate, or outdated data.
  • Erasure: Request the deletion of unnecessary, excessive, or data processed in non-compliance with the LGPD.
  • Anonymization or blocking: Request the anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data.
  • Portability: Request the portability of data to another service or product provider, upon express request.
  • Information about sharing: Obtain information about the public and private entities with which Driver ID has engaged in shared use of data.
  • Withdrawal of consent: Withdraw consent at any time, when the processing is based on this legal basis.

10. How to Exercise Your Rights

To exercise any of the rights mentioned above, data subjects may contact Driver ID directly or our Data Protection Officer (DPO) via the email provided below. We will do our best to handle requests quickly and efficiently, always in compliance with applicable legislation.

11. Data Protection Officer (DPO)

Driver ID has a Data Protection Officer (DPO) to serve as a communication channel between the company, data subjects, and the National Data Protection Authority (ANPD).

Name: Alexandre Castro
E-mail: dpo@driverid.com.br

12. Updates to This Page

This LGPD / Data Protection page may be updated periodically to reflect new practices, technologies, or legal requirements. The most recent and current version will always be the one published on our website. We recommend that you review it regularly to stay informed about our commitment to data protection.

Driver ID reiterates its commitment to transparency, security, and respect for the rights of data subjects. We will continue to improve our practices to ensure a safe and trustworthy digital environment for all.