Privacy Notice

In force from 3 September 2026.

A. Controller and contact

Pay Desk (paydesk.site) is an independent publication operated from Brazil. For the Lei Geral de Proteção de Dados (Law No. 13.709/2018, the LGPD) and the General Data Protection Regulation (Regulation (EU) 2016/679, the GDPR), its publisher is the controller of the personal data described here. All data matters go to [email protected].

B. What is processed, and why

B.1 Delivery records

Pages are served through a content delivery network, which automatically records IP address, an approximate location derived from it, user agent, requested address, referring address, response status and timestamp. These records exist to deliver pages, to limit abuse and to diagnose faults.

B.2 Audience measurement

Where measurement is in use it records aggregate page views, referring sources, approximate region, device category and interaction events. It is configured not to collect names, email addresses or free text typed by a visitor.

B.3 Advertising measurement

Where this publication is promoted through paid placements, a measurement tag from the advertising platform may be present. It records that a visit occurred and, where applicable, that a page was viewed, and reports that to the advertising platform, which acts as an independent controller for what it receives under its own published policy.

B.4 Correspondence

Messages sent to the address above are processed together with the sender's email address, any name given, the content of the message and any attachment.

B.5 Purchases

Where a paid item is offered, payment runs through a third-party payment processor. That processor collects and holds the payment instrument details; this publisher does not receive, store or have access to full card numbers or bank credentials. What reaches the publisher is the transaction reference, the purchaser's email address, the amount, the date and the status.

No sensitive personal data as defined in Article 5, II of the LGPD or Article 9 of the GDPR is requested, required or knowingly processed by this site.

C. Legal bases

• Legitimate interests — LGPD Art. 7, IX; GDPR Art. 6(1)(f) — delivering pages, maintaining security, preventing abuse, diagnosing faults.
• Consent — LGPD Art. 7, I; GDPR Art. 6(1)(a) — non-essential measurement and advertising tags where consent is required in the visitor's jurisdiction. Consent can be withdrawn at any time, without affecting processing already carried out.
• Performance of a contract — LGPD Art. 7, V; GDPR Art. 6(1)(b) — processing a purchase, delivering a paid item, handling a refund.
• Legal obligation — LGPD Art. 7, II; GDPR Art. 6(1)(c) — retention of transaction records for tax and accounting purposes.

D. Cookies and similar identifiers

This site needs no account and sets no cookie in order to be read. Cookies or equivalent identifiers may be set by the delivery network for security, by the measurement provider, and by an advertising measurement tag where one is present. Browser controls can block or delete all of them, and blocking them restricts access to nothing on this site.

E. How long things are kept

• Delivery records: up to 90 days, then deleted or aggregated.
• Aggregate measurement data: up to 26 months.
• Correspondence: up to 24 months after the last message in an exchange, or longer where a dispute is open.
• Transaction records: the period required by Brazilian tax and commercial law, currently five years from the transaction.

F. Who else sees it

Personal data is shared only with the processors needed to run the publication: the hosting and delivery provider, the email provider, the measurement provider, the advertising platform where a tag is present, and the payment processor where a purchase occurs. It is not sold, rented or traded. Disclosure to a public authority happens only under a valid legal instrument.

G. Transfers outside Brazil

Some of those providers run infrastructure outside Brazil and outside the European Economic Area, principally in the United States and the European Union. Transfers rest on the bases permitted by Article 33 of the LGPD and Chapter V of the GDPR, including standard contractual clauses and, where applicable, adequacy decisions. A description of the safeguards applied to any specific provider is available on written request.

H. Rights, and how to use them

Under LGPD Article 18 and GDPR Articles 15 to 22, a data subject may ask for confirmation that processing is taking place; access to the data; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed on the basis of consent; information about entities with which data has been shared; information about what refusing consent entails; withdrawal of consent; and objection to processing based on legitimate interests.

Requests go in writing to [email protected] and are answered within 15 days under the LGPD and within one month under the GDPR, extendable where the regulation allows. Identity verification may be requested, limited to what establishes that the requester is the data subject.

I. Complaints

A complaint may be lodged with the Autoridade Nacional de Proteção de Dados (ANPD) in Brazil, or with the competent supervisory authority in the data subject's country of residence in the European Economic Area or the United Kingdom.

J. Security

Pages are served over HTTPS with HTTP Strict Transport Security enabled. Access to correspondence and transaction records is limited to the publisher. No measure is absolute, and nothing here claims absolute security.

K. Age

This site is directed exclusively at people aged 18 or over. It does not knowingly process data relating to children or adolescents, and any such data that arrives is deleted.

L. Changes

Changes appear on this page with a revised date at the top. Material changes affecting the rights of data subjects are described in a dated note kept on the page for at least twelve months.

Questions about this page: [email protected].