Privacy Policy - cambio.ao

Last updated: 10 de Outubro de 2025

1. Introduction

Exponencial Lda. ("we", "our" or "Exponencial") is committed to protecting the privacy and personal data of users of the cambio.ao website ("Platform"). This Privacy Policy describes how we collect, use, store and protect your information when you use our Platform.

cambio.ao is an information platform that aggregates exchange rates from local banks and provides curated news about the business environment in Angola. We do not conduct financial transactions nor operate as a financial institution.

This policy has been prepared in accordance with Law No. 22/11 of June 17 – Personal Data Protection Law of Angola and other applicable legislation.

2. Personal Data Collected

We may collect the following types of information:

2.1. Data provided voluntarily:

Name
Email address
Phone number
Company or organization (when applicable)
Messages sent through contact forms
User account information (for premium subscriptions, when applicable)
Notification and alert preferences

2.2. Data collected automatically through standard services:

Our Platform uses standard web tools such as Google Analytics, Microsoft Clarity and Cloudflare for its proper functioning. Within the scope of these services, we may automatically collect:

Anonymous information about the browser and device used
Aggregated statistics about pages visited
Date and time of access (without personal identification)
Basic information about interactions with the Platform for service improvement purposes
Essential and analytical cookies for the functioning of the site (as detailed in our Cookie Policy)

This information is mainly used in aggregated form to understand site performance and improve user experience, without direct personal identification.

2.3. Subscription data:

If you choose to subscribe to our newsletter or premium plans:

Email address for sending newsletters and alerts
Content and notification preferences
Payment information (processed by third parties, as described in Section 6)
Subscription history and use of premium services

3. Legal Basis for Data Processing

We process your personal data based on the following legal grounds established in Law No. 22/11:

Consent: When you explicitly give us permission to process your data for specific purposes. Consent is always express, prior and unequivocal, and can be withdrawn at any time.
Contractual Performance: When processing is necessary to comply with our Terms of Service or to provide the services you requested (for example, premium subscriptions or newsletters).
Legitimate Interest: When processing is necessary for our legitimate interests, such as improving the Platform, conducting statistical analyses or preventing fraud, provided that these interests do not override your rights and freedoms.
Legal Obligation: When processing is necessary to comply with a legal obligation to which we are subject under Angolan legislation.

4. Purposes of Data Processing

We use the personal data collected for the following purposes:

Provide, operate and maintain the Platform
Process newsletter and premium plan subscriptions
Send personalized alerts about exchange rates and news (when requested)
Improve and personalize user experience
Understand how users interact with the Platform through statistical analyses
Develop new products, services and features
Communicate with users, including sending technical notifications, updates and editorial content
Respond to requests and provide support
Process payments for premium subscriptions (through third parties)
Prevent fraudulent activities and ensure Platform security
Comply with legal obligations

5. Data Retention Period

We keep your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purpose of satisfying any legal, accounting or reporting requirements.

Account and subscription data: Kept while the account is active or the subscription is in effect, being anonymized or deleted after 2 years of inactivity.
Browsing and analytics data: Kept for up to 12 months in aggregated format.
Communication data (contact and support): Kept for up to 5 years after the last interaction for archiving and dispute resolution purposes.
Newsletter data: Kept until you cancel your subscription, after which they are immediately removed from our distribution lists.

In determining the appropriate retention periods, we consider the amount, nature and sensitivity of personal data, the potential risk of harm from unauthorized use or disclosure, the purposes of processing and whether we can achieve those purposes by other means.

6. Data Sharing and Disclosure

We do not sell, rent or trade your personal data to third parties.

We may share your information only in the following circumstances:

6.1. Service Providers:

We may share data with third parties that assist us in operating the Platform. These providers include:

Google Analytics (EUA): Web traffic analysis tool that helps us understand how users interact with the site. Data is processed in accordance with Google's Privacy Policy.
Microsoft Clarity (EUA): Behavioral analysis tool that helps us improve user experience through heat maps and anonymous session recordings.
Cloudflare (EUA): Content delivery network (CDN) and security services provider that protects the site against attacks and improves performance.
Payment processors: For premium subscriptions, we use third-party payment processors that have their own privacy policies. We do not store complete credit card information on our servers.
Hosting and infrastructure service providers: Who store Platform data securely.

These service providers have access to your personal data only to perform tasks on our behalf and are contractually obligated not to disclose or use the data for any other purpose.

6.2. Legal Requirements:

We may disclose your personal data if reasonably necessary to:

Comply with a legal obligation or court order
Protect and defend Exponencial's rights or property
Prevent or investigate possible irregularities related to the Platform
Protect the personal safety of Platform users or the public
Protect against legal liability

6.3. Business Transfers:

In the event of a merger, acquisition or sale of assets, your personal data may be transferred as part of that process. We will notify users of any change in ownership or use of their personal data through the Platform and by email.

7. International Data Transfers

Some of our service providers are located outside Angola, namely:

Google LLC (Estados Unidos da América) - Google Analytics
Microsoft Corporation (Estados Unidos da América) - Microsoft Clarity
Cloudflare, Inc. (Estados Unidos da América) - Serviços de CDN e segurança

These international transfers are carried out with the following safeguards:

Standard contractual clauses: All international providers are bound by contractual clauses that guarantee adequate protection of your personal data.
Encryption: Data is transmitted and stored with appropriate encryption.
Strict privacy policies: All providers maintain privacy policies that comply with international data protection standards.

You can consult the privacy policies of these providers through the following links:

• Google: https://policies.google.com/privacy
• Microsoft: https://privacy.microsoft.com/
• Cloudflare: https://www.cloudflare.com/privacypolicy/

We implement these safeguards to ensure that your data continues to be protected in accordance with the standards established by Law No. 22/11, even when processed outside Angola.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure or accidental destruction. These measures include:

Technical Measures:

Data encryption in transit (HTTPS/TLS) and at rest
Firewalls and intrusion detection systems
Regular backup and data recovery procedures
Periodic security assessments and vulnerability testing
Secure authentication for access to internal systems

Organizational Measures:

Restricted access to personal data only to employees and providers who need to know them to perform their functions
Professional confidentiality obligations for all collaborators who access personal data
Regular security and data protection training for all employees
Internal data protection policies and procedures
Regular reviews of security practices

Incident Notification:

In the event of a security breach that may compromise your personal data, we will notify affected users and the Data Protection Agency as required by Angolan legislation.

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee its absolute security.

9. Data Subjects' Rights

In accordance with the Personal Data Protection Law of Angola (Law No. 22/11), you have the following rights in relation to your personal data:

9.1. Right of Access

Request a copy of your personal data that we hold, including information about the purpose of processing, data categories and recipients.

9.2. Right of Rectification and Update

Request correction or update of inaccurate, incomplete or outdated data.

9.3. Right to Erasure

Request deletion of your personal data when:

The data is no longer necessary for the purposes for which it was collected
You withdraw consent and there is no other legal basis for processing
The data has been processed unlawfully
Erasure is necessary to comply with a legal obligation

9.4. Right to Restriction of Processing

Request restriction of processing of your data in certain circumstances, such as when you contest the accuracy of the data or oppose erasure.

9.5. Right to Object

Object to processing of your personal data in certain circumstances, including:

Objection to processing for direct marketing purposes (at any time, free of charge)
Objection for reasons related to your particular situation when processing is based on legitimate interest

9.6. Right to Object to Automated Decisions

Not to be subject to decisions based solely on automated data processing that evaluate aspects of your personality, including professional capacity, credit or behavior.

9.7. Right to Withdraw Consent

Withdraw consent at any time when processing is based on your consent, without affecting the lawfulness of processing carried out until withdrawal. To unsubscribe from the newsletter, you can use the "Unsubscribe" link in any email we send.

9.8. Exercise of Rights

To exercise any of these rights, you can:

Send an email to: contact@cambio.ao
Write to: Exponencial Lda., Luanda, Angola

We will respond to your request within a reasonable time and without undue delays or costs. For requests for rectification, update or deletion of data, the law establishes a period of 60 business days.

In certain circumstances provided by law, we may not be able to comply with your request (for example, when we have a legal obligation to keep the data), in which case we will explain the reasons.

10. Cookies and Similar Technologies

Our Platform uses cookies and similar technologies to improve user experience, analyze traffic and personalize content.

For more information on how we use cookies, see our Cookie Policy complete.

11. Newsletter Subscription and Marketing

11.1. Express Consent

Subscribing to our newsletter is completely voluntary and requires your express and prior consent. By providing your email address and clicking "Subscribe", you agree to receive:

Periodic newsletter with news about the business environment in Angola
Information about exchange rates and market analysis
Updates about new Platform features and services

11.2. Unsubscribe

You can unsubscribe at any time, free of charge, through:

"Unsubscribe" link present in all newsletter emails
Direct contact through contact@cambio.ao
Account management area (for registered users)

After cancellation, your email address will be immediately removed from our distribution lists.

11.3. No Data Sharing

We will never share, sell or rent your email list to third parties for marketing purposes. Your contact data is used exclusively for direct communications from cambio.ao.

12. Premium Plans and Paid Subscriptions

12.1. Payment Data

For premium plan subscriptions, payment data is processed by certified third-party providers. We do not store complete credit card information on our servers.

12.2. Subscription Data

We keep records of:

Subscribed plan and subscription status
Payment history and invoices
Premium alert and notification preferences
Usage data of premium services

12.3. Cancellation

You can cancel your premium subscription at any time through the account management area. Your data will be kept as described in Section 5 (Retention Period).

13. Protection of Minors

Our Platform is not intended for minors under 18 years of age. We do not intentionally collect personal data from minors. If we become aware that we have collected data from a minor without verification of parental consent, we will take steps to remove that information from our servers.

If you are a parent or legal guardian and are aware that your child has provided us with personal data, contact us so that we can take the necessary measures.

14. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our data processing practices or for other operational, legal or regulatory reasons. The most recent version will always be available on the Platform, with the "Last updated" date at the top.

Material Change Notifications:

When we make material changes to this policy, we will notify users through:

Prominent notice on the site
Email to registered users and subscribers
Update of the "Last updated" date

We encourage users to regularly review this policy to stay informed about how we protect their information. Continued use of the Platform after the publication of changes constitutes your acceptance of those changes.

15. Contact

If you have any questions, concerns or complaints about this Privacy Policy or our privacy practices, please contact us:

Exponencial Lda.

Email: contact@cambio.ao

Address: Luanda, Angola

15.1. Right to Complaint

You also have the right to file a complaint with the Data Protection Agency (APD) if you believe that the processing of your personal data violates applicable legislation.

Data Protection Agency (APD):

Website: https://apd.ao
Procedure: You can submit complaints through the online form available on the APD website
"APD Responds" Sessions: Wednesdays at 10:00 am via Zoom (see the APD website for access link)

Note: This Privacy Policy applies exclusively to the cambio.ao Platform. Links to third-party websites (banks, news sources, etc.) are subject to their own privacy policies, for which we are not responsible.