Privacy Notice / South Africa

Last Update: December 2025 Previous version

PRIVACY NOTICE

THIS IS THE PRIVACY NOTICE OF DLOCAL AND ITS SOUTH AFRICAN SUBSIDIARIES 

Your privacy is very important to us. We are committed to the protection of your personal information, and the purpose of this Privacy Notice is to inform you about the way we process your personal information, including references to which information we process, how, why, and for how long, together with information about your rights as a Data Subject.

This Privacy Notice (together with our Terms and Conditions available HERE, and any other documents referred to in it) sets out the basis on which any personal information we collect from you, or that you provide to us, will be processed by us. This Privacy Notice also sets out how you can instruct us if you prefer to limit the use of that personal information, as well as the procedures that we have in place to safeguard your privacy.  

It is important that you read this Privacy Notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal information about you so that you are fully aware of how and why we are using your personal information. This Privacy Notice supplements the other notices and is not intended to override them.

1. IMPORTANT INFORMATION

dLocal and its subsidiaries in South Africa, which are collectively referred to as “dLocal”, “we” or “our” or “us”, may act as a data controller and/or processor, however, under this Privacy Notice, we are describing the data processing activities where they act as controllers, The reference to “controller/processor” means the same as “responsible party” and/or “operator” in terms of the Protection of Personal Information Act, 2013 (“POPIA”).  For the avoidance of doubt, data controller means responsible party, and data processor means operator, as defined in the POPIA. 

The responsible party for processing described in this Privacy Notice is dLocal, and its South African subsidiary, Depansum (Pty) Ltd, Unit G05, Century Gate Office Park, Century City, Milnerton. 

Our Information Officer in South Africa is Agustin Cerisola, contact: [email protected], P O Box 1712, Milnerton, Western Cape, 7435. Our Promotion of Access to Information Act Manual (“PAIA Manual”) is available here and explains how to make an access request.

Individuals from which we collect Personal Information (the “Data Subjects”)

In this Privacy Notice, “you” or “your” means an individual who is the subject of personal information we process as a data controller, which would typically be: (i) the visitors of our website at www.dlocal.com (our “Website”); (ii) the representatives of merchants and other payment providers (our “Customers”) who interact with us and access our Merchant Dashboard to receive our payment processing services; (iii) representatives of third party service providers who interact with us to fulfil their contractual obligations with us.

In addition, we also process, as a data controller, personal information about buyers or beneficiaries of our Customers (“End-Users”) or business customers of our Customers (“Sub-Merchants”) for limited purposes (as indicated in section 3 of this Privacy Notice). 

Otherwise, as far as End-User and Sub-Merchants’ personal information is concerned, we generally act as a data processor on behalf of our Customers.

For the purpose of this Privacy Notice, “Data Protection Legislation” means the Protection of Personal Information Act (POPIA) 2013 and any other data protection legislation applicable within South Africa.

2. INFORMATION WE MAY COLLECT (OR RECEIVE) ABOUT YOU

How is your personal information collected: 

1. Direct interactions. You may give us your Identity and Contact Data (as defined below) by filling in forms or by corresponding with us through available channels. This includes personal information you provide as a representative of a Customer or a prospective Customer when you:
   1. subscribe to our service or publications.
   2. create a Customer user account on our payment processing service platform (“Merchant Dashboard”) to receive our services; or
   3. interact with us in connection with our services or our relationship with the Customer you represent;
   4. apply for or enquire about our products or services;
2. Website and Merchant Dashboard usage. When you browse on our website or our Merchant Dashboard, we process Technical Data (defined below). We use this information for our legitimate interests of making sure our website and Merchant Dashboard work properly. This includes debugging, DDOS mitigation, improvement of the user experience, and performing statistical analyses for optimising the quality of our website and dashboard. Please see our Cookies Policy HERE for further details.
3. SmartFields, Mobile Checkout, Payment Links, Payout Links and Invoice Collection solutions. When you purchase goods or services or receive payments from and to dLocal’s Customers which have chosen one of the solutions indicated above for payment collection and disbursement, it is most likely you will be providing your personal information directly to dLocal. 
4. Due Diligence. When you apply to become a Customer of dLocal or you operate as a Sub-Merchant under a dLocal Customer, we require that you provide personal information as detailed in this paragraph but not limited to this description. For regulatory reasons, we may request name, postal address, telephone number, and email address to fulfill our financial partner and regulatory requirements. We may also collect financial and personal information about you, such as your ownership interest in the company, your status as a director or officer, your date of birth and government identifiers associated with you and your business (such as your social security number, tax number, Employer Identification Number, or bank account information). We may also perform biometric checks.
5. Third parties or publicly available sources. We may receive personal information about you from various third parties and public sources, when we perform background checks, fraud prevention checks, ID checks and other “Know Your Customer” we need to perform on our Customer’s representatives to comply with applicable financial services standards and requirements and to comply with applicable laws and regulations.

We may collect, use, store and transfer different kinds of information about you which we have grouped together as follows: 

1. Identity Data includes first name, last name, username, ID document number;
2. Contact Data includes, contact details billing address, delivery address, email address and telephone numbers;
3. Technical Data includes your internet protocol (IP) address, your login data, Google Analytics ID, internet browser and device type, time zone setting, location data and your use of our website, including which pages you visited, how you got to our Website, the time and length of your visit and your language preferences;
4. Profile Data includes the username and password of our Customer’s representatives when they log in the Merchant Dashboard; 
5. Marketing and Communications Data includes your name, position and business details and includes your preferences in receiving marketing from us and our third parties and your communication preferences; and
6. Financial Data includes card data, bank account data, fiscal information.

Our services are not directed at children (below 18). We do not intentionally collect children’s personal information. If we become aware that we have collected such information, we will delete it unless processing is permitted under the POPIA with competent person consent or another applicable ground.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal information but is not considered personal information in law as this information will not directly or indirectly reveal your identity. For example, we may aggregate the Technical Data to calculate the percentage of users accessing a specific website or Merchant Dashboard’s feature.

We may process special personal information (including biometric information) as part of due diligence and identity verification, and information relating to criminal behaviour, offences or alleged offences in the context of fraud and security checks.  We only process such information where permitted under the POPIA, including where required or authorised by law (for example, antimoney laundering/knowyourcustomer obligations), or with your explicit consent where applicable, and subject to appropriate safeguards.

3. HOW WE USE PERSONAL INFORMATION

We process personal information only where one or more grounds under POPIA section 11 apply, including with your consent, to conclude or perform a contract with you, to comply with legal obligations, to protect your legitimate interests, or where processing is necessary for pursuing our legitimate interests (balanced against your rights).  For activities such as due diligence, fraud prevention and identity verification, our lawful basis typically includes compliance with applicable law and legitimate interests. 

In accordance with this Privacy Notice, dLocal may use your personal information in order to:

1. provide the services you request from us (Lawful Basis: to comply with our legal obligations and performance of our contract with you);
2. verify your identity or conduct appropriate checks for credit worthiness or fraud (Lawful Basis: to comply with our legal obligations and necessary for our legitimate interests);
3. understand your needs in order to provide you with the products and services you require (Lawful Basis: performance of our contract with you);
4. administer and manage our services, including billing for the services provided and debt collection (Lawful Basis: performance of our contract with you, to comply with our legal obligations and necessary for our legitimate interests);
5. distribute information, newsletters, publications and other communication via various mediums to keep you informed (Lawful Basis: your consent, performance of our contract with you and necessary for our legitimate interests);
6. research and develop new product offerings and services (Lawful Basis: performance of our contract with you and necessary for our legitimate interests);
7. manage and conduct our business and the services we provide to our Customers or end users (Lawful Basis: performance of our contract with you and necessary for our legitimate interests);
8. make sure our website works properly, including debugging, to be able to deliver you its content, for DDOS mitigation on our website, and improving our website and performing statistical analyses (Lawful Basis: necessary for our legitimate interests);
9. provide you with personal offers tailored to your needs and customising what we show you to your preferences, with your prior consent, in accordance with POPIA section 69. We obtain prior consent for unsolicited electronic communications to prospects and provide a free, simple optout in every message.  For existing customers, you may opt out at any time. (Lawful Basis: performance of our contract with you and necessary for our legitimate interests);
10. effectively communicate with third parties (Lawful Basis: your consent, performance of our contract with you and necessary for our legitimate interests); and
11. as required or authorised by applicable law (Lawful Basis: to comply with our legal obligations).

End-Users and Sub-Merchants

Our relationship with End-Users and Sub-Merchants is indirect and we largely only process personal information about them for providing the Services to our Customers and in accordance with our Customers’ instructions. In that context, dLocal would be considered as a data processor acting on behalf of the Customer and relying on the authorisation given to it by the Customer to process End-User and Sub-Merchants personal information. Our processing in those circumstances is also governed by a contract with the Customer. Therefore, if you are an End-User or Sub-Merchant who has a relationship with one of our Customers, you should also refer to its privacy notice, as it is likely to be relevant to you and would contain information on how to contact them if you have queries about their use of your personal information or if you wish to exercise your data protection rights.

Notwithstanding our general role as a data processor for our Customers, there are certain instances where we process End-User and Sub-Merchant personal information as a data controller, which we do for the following limited purposes:

1. to conduct, as needed, fraud and other risk management and prevention, and to comply with any mandatory reporting related to such activities (Lawful Basis: to comply with our legal obligations or necessary for our legitimate interests);
2. to comply with our statutory, regulatory and/or professional obligations, including any record-keeping obligations which we may have at law (Lawful Basis: to comply with our legal obligations); and
3. to ensure the proper provision of the services for which you are either a recipient or beneficiary through our Customer and to exercise, or defend ourselves against, legal claims (Lawful Basis: necessary for our legitimate interests, including as to the reputation of our business or as pertaining to legal claims).

In the context of those limited activities, we act as a data controller and therefore parts of this Privacy Notice would be relevant to you as an End-User or Sub-Merchant. Information on how to contact us for further information, or exercise your legal rights as a data subject, are set out at the end of this Privacy Notice.

Due to changes in the law or to our business, from time to time, we may need to, as a data controller, process your personal information for additional purposes beyond those set out above. In such case, we will either update this Privacy Notice or issue a dedicated privacy notice covering the specific occasion, depending on what is most appropriate to do in the circumstances.

4. WHEN WE MAY DISCLOSE THE PERSONAL INFORMATION

Your information may, for the purposes set out in this Privacy Notice, be disclosed for processing to:

1. our employees, our affiliates and their employees. For instance, dLocal will share your information with other dLocal affiliates for the purpose of the provision of our services or when such affiliates provide support services to dLocal;
2. our third-party consultants, (sub-)contractors, suppliers or other service providers who may access your personal information when providing services to us (including, but not limited, to IT support services). (This includes information technology experts who design and host our Website and Dashboard, and general service companies);
3. auditors or contractors or other advisers auditing, assisting with or advising on any of our business purposes; 
4. analytics and search engine providers that assist us in the improvement and optimisation of our Website and Merchant Dashboard;
5. our successors in title, our prospective sellers or buyers of our business or to our Affiliates when we have a merger or re-organisation; 
6. government bodies, regulators and law enforcement agencies and in response to other legal and regulatory requests, including in response to formal legal notices or subpoenas. Disclosures to public authorities occur only where required or authorised by law, and we keep records of such disclosures as required; 
7. any third-party where such disclosure is required in order to enforce or apply our Website Terms or other relevant agreements; and
8. protect the rights, property, integrity or security of our company, our customers, or others (including, without limitation, you). This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Where we engage operators (service providers) to process personal information on our behalf, they are bound by written agreements to process only on our documented instructions, to implement appropriate technical and organisational security measures, to maintain confidentiality, and to comply with POPIA requirements.

Where your details are provided to any other party in accordance with an express purpose, we will require them to be kept safe and secure your personal information and only use it for the intended purpose.

5. INTERNATIONAL/CROSS BORDER TRANSFERS 

dLocal serves customers globally.  Accordingly, your personal information may be stored and/or transferred outside South Africa, including to countries where we have operations and where certain service providers are located.  We transfer personal information in accordance with section 72 of the POPIA, including by ensuring the recipient is subject to a law, binding corporate rules or binding agreements that provide an adequate level of protection; by obtaining your consent where appropriate; or where the transfer is necessary for the performance of a contract with you or for your benefit.  We use intragroup agreements and operator agreements imposing POPIAequivalent protections.  To protect your personal information when these are transferred and/or stored outside South Africa, we have implemented appropriate safeguards. You may contact us to request further information about the safeguards (subject to confidentiality).

6. WHAT HAPPENS IF YOU DON’T PROVIDE THE REQUESTED PERSONAL INFORMATION

If we are unable to collect personal information from or about you, or if the personal information provided is incomplete or inaccurate, dLocal may not be able to assist you, including providing the products or services you are seeking or provide support or assist you with your queries. 

7. SECURITY OF PERSONAL INFORMATION

The Internet is not a secure medium. However, we have put in place a range of security procedures, as set out in this Privacy Notice.  Where you have been allocated a profile in the Merchant Dashboard, this area is protected by your username and password, which you should never divulge to anyone else.

Please be aware that communications over the Internet, such as emails/webmails, are not secure unless they have been encrypted. Your communications may route through a number of countries before being delivered. This is the nature of the World Wide Web/Internet. We cannot accept responsibility for any unauthorised access or loss of personal information that is beyond our control.  

We will use reasonable endeavours to implement appropriate policies, rules and technical measures to protect the personal information that we have under our control (having regard to the type and amount of that information) from unauthorised access, improper use or disclosure, unauthorised modification, unlawful destruction or accidental loss.  

We will ensure that your information will not be disclosed to government institutions or authorities except if required by law (e.g. when requested by regulatory bodies or law enforcement organisations in accordance with applicable legislation).  

We implement appropriate, reasonable technical and organisational measures to safeguard personal information in our possession or under our control, having regard to generally accepted information security practices and procedures, the nature of the information and the harm that could result.

If we have reasonable grounds to believe that the personal information of any data subject has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, describing the nature of the compromise, the information affected (where known), recommended measures to mitigate possible adverse effects, and our remedial actions.

8. COOKIES

dLocal uses cookies to store and collect information about your use of our Website. Cookies are small text files stored by the browser on your equipment's hard drive. They send information stored on them back to our web server when you access our Website or Merchant Dashboard. These cookies enable us to put in place personal settings and load your personal preferences to improve your experience. We use necessary cookies to make the site work and, with your consent, analytics and marketing cookies.  Our cookie banner provides a genuine choice to accept, reject or manage nonessential cookies. You can change your preferences at any time. You can find out more about cookies at www.allaboutcookies.org, and about the cookies we use in our “Cookies Policy” available on our Website HERE.

9. YOUR RIGHTS

We will take all reasonable steps to ensure that all information we collect, use, or disclose is accurate, complete and up to date. Please contact us if your details change or if you believe the information we have about you is not accurate or complete.

In some instances, you may also have the rights to: 

1. Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the Personal Information we hold about you and to check that we are lawfully processing it.
2. Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected, though we may need to verify the accuracy of the new information you provide to us.
3. Request erasure of your Personal Information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which you will be notified of.
4. Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which do not override your rights and freedoms.
5. Request restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information in the following scenarios: (i) if you want us to establish the information's accuracy; (ii) where our use of the information is unlawful but you do not want us to erase it; (iii) where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims; or (iv) You have objected to our use of your information but we need to verify whether we have overriding legitimate grounds to use it.
6. Request the transfer of your Personal Information to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
7. Withdraw consent at any time where we are relying on consent to process your personal information. However, this will not affect the lawfulness of any processing carried out prior to the withdrawal of your consent or processing on other lawful grounds. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case. 

How to exercise your rights.

Please click on this LINK and fill out the form to submit your request. This is the preferred channel to submit a request and exercise your rights. Requests submitted through other channels may require you to provide additional information to enable us to deal with the request.

What we may require from you.

We may need to request specific information from you to help us confirm your identity before starting to work on your request. We may also contact you to ask for further information in relation to your request.

Time limit to respond.

We try to respond to all legitimate requests within one month from the date your identity is deemed to be confirmed. Occasionally, it may take us longer than that if your request is particularly complex, or you have made several requests. In this case, we will notify you and keep you updated.

No fee usually required.

All communication and all actions taken by dLocal regarding your rights described above are provided free of charge. dLocal reserves the right, in the case of clearly unfounded or unreasonable requests, to either take out a reasonable fee covering the administrative costs of providing the information or taking the requested action or refusing to fulfil the requested action.

10. HOW LONG WE KEEP PERSONAL INFORMATION

We retain personal information only for as long as necessary to achieve the purposes for which it was collected or subsequently processed, in line with POPIA’s retention limitation and minimality principles, including to meet legal, accounting or reporting requirements. We may retain certain records to comply with statutory obligations (for example, anti‑money laundering/financial record‑keeping), after which we will securely delete or de‑identify the information. 

We will take reasonable steps to destroy or permanently de-identify personal information that is no longer needed for any purpose that is permitted by Data Protection Legislations.

For instance, by law, we have to keep basic information about our customers (including contact, identity, financial and transaction data). To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of Your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements. 

11. Contact Details

If you have any questions about this Privacy Notice or data privacy related, please contact us by the email at [email protected]. 

You have the right to make a complaint at any time to the applicable supervisory authority for data protection issues, which is the Information Regulator.

We would, however, appreciate the chance to deal with your concerns before you approach the Information Regulator so please contact us in the first instance.  

12. CHANGES

We reserve the right to amend or edit this Privacy Notice from time to time to reflect changes in dLocal’s business or practices, and we encourage you to review this Privacy Notice periodically. We may change the Privacy Notice at any time by posting the changed Privacy Notice on the dLocal website. If the changes are material, we will include a notice on the dLocal website homepage indicating that a change has been made.