Privacy Policy — Posto Xando

1. Introduction

Posto Xando LTDA ("we", "our", or "us"), registered under CNPJ 02.577.006/0001-51, with its principal place of business at R. Barão do Rio Branco, 1515, Centro, Patos de Minas - MG, 38700-170, is committed to protecting your privacy and personal data.

This Privacy Policy describes how we collect, use, store, and share your personal information in compliance with Brazil's General Data Protection Law (Lei Geral de Proteção de Dados — LGPD, Law No. 13.709/2018) and other applicable regulations.

2. Data We Collect

Identification data: full name, CPF/CNPJ
Contact data: email address, phone number
Vehicle data: license plate number for fleet card transactions and car wash service records
Fleet card data: company name, fleet card numbers, authorized vehicles, and consumption records for corporate fleet clients
Loyalty program data: enrollment information, point balances, and redemption history (when applicable)
CCTV data: video surveillance recordings from station cameras for security and safety purposes
Payment data: billing information processed through secure payment terminals at the pump and in-store
Fiscal data: information required for NFC-e and tax compliance
Navigation data: IP address, browser type, cookies, access logs

3. How We Use Your Data

Processing fuel sales, lubricant purchases, and convenience store transactions
Managing fleet card accounts and generating consumption reports for corporate clients
Administering loyalty programs and reward redemptions (when applicable)
Maintaining security through CCTV surveillance of the station premises
Processing payments and issuing fiscal receipts (NFC-e)
Complying with ANP (Agência Nacional do Petróleo) fuel quality and sales regulations, INMETRO pump calibration requirements, environmental licensing obligations, and consumer protection law

4. Legal Basis for Processing

Performance of a contract or preliminary procedures related to a contract
Consent provided by the data subject
Compliance with legal or regulatory obligations
Legitimate interests of the controller, including station security and fraud prevention

CCTV recordings capture images of customers, vehicles, and station personnel for security purposes. These recordings are maintained strictly for crime prevention, incident investigation, and safety compliance. They are not used for commercial profiling or marketing. Fleet card consumption data is reported exclusively to the respective corporate client and is never shared with competitors or unauthorized third parties.

5. Data Sharing

Fuel distributors for supply chain and quality compliance
ANP (Agência Nacional do Petróleo) for fuel quality reporting and regulatory compliance
Fleet card operators for corporate account management
Police authorities for security incident investigation when required
Payment processors for secure transaction handling
Tax authorities as required by fiscal regulations
Environmental authorities for licensing and compliance when required

We do not sell, rent, or trade your personal data to third parties for marketing purposes. CCTV footage is released to authorities only when required by law or judicial order. All data sharing is conducted in compliance with the LGPD.

6. Data Retention

Personal data will be retained only for as long as necessary to fulfill the purposes described in this policy, or as required by applicable law. CCTV recordings are retained for a minimum of 30 days and deleted automatically unless flagged for incident investigation. Fleet card consumption records are retained for the duration of the corporate account plus the applicable statutory period. Loyalty program data is retained while the customer maintains an active account. Transaction and fiscal data are retained as required by tax regulations. Upon expiration, data will be securely deleted or anonymized.

7. Your Rights

Under the LGPD, you have the following rights:

Confirmation of the existence of data processing
Access to your personal data
Correction of incomplete, inaccurate, or outdated data
Anonymization, blocking, or deletion of unnecessary or excessive data
Portability of data to another service provider
Deletion of data processed with your consent
Information about entities with which your data has been shared
Information about the possibility of denying consent and its consequences
Revocation of consent

To exercise any of these rights, please contact us using the information in Section 10.

8. Cookies

Our website may use cookies and similar technologies to enhance your browsing experience. You may configure your browser to refuse cookies; however, some features may not function properly without them.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Payment processing at the pump and in-store is handled through PCI-compliant terminals. CCTV recordings are stored on secured systems with restricted access. Despite our efforts, no method of electronic transmission or storage is completely secure.

10. Contact Information

Posto Xando
Posto Xando LTDA
CNPJ: 02.577.006/0001-51
R. Barão do Rio Branco, 1515, Centro
Patos de Minas - MG, 38700-170
Brazil

11. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. Any changes will be posted on this page with a revised "Last updated" date.