Data Deletion Instructions

Leia esta página em português

This document explains, in plain language, how you can request the deletion of your personal data processed by Vexum's system, who will handle that request, how long it takes, and what is actually deleted.

1. FIRST, IDENTIFY WHICH SITUATION APPLIES TO YOU

How your request is handled depends on who you are to the system. There are two possible situations.

Situation A: you work at a law firm that has contracted Vexum's system and you have a login to the dashboard.

Situation B: you received, on your WhatsApp, a payment reminder or account notification sent by a law firm that uses Vexum's system, and you do not have a login to any dashboard. Normally this happens because you are a client of that firm with an outstanding balance.

If you are in Situation A, follow section 2. If you are in Situation B, follow section 3. If you are not sure, follow section 3, which is the safest path, and we will guide you.

2. IF YOU ARE A DASHBOARD USER (SITUATION A)

In this case, Vexum is directly accountable (controller) for your data, and the request is handled directly by us.

How to request: send an e-mail to privacidade@vexum.tech, with the subject "Data deletion", stating your full name and the e-mail registered in the dashboard.

What happens next: we will confirm your identity, check whether any legal obligation requires part of the data to be retained for longer, and delete the remaining data.

Response time: up to 15 (fifteen) days from receipt of the request, pursuant to article 18 of the General Personal Data Protection Law (LGPD).

3. IF YOU RECEIVED A PAYMENT REMINDER OR ACCOUNT NOTIFICATION (SITUATION B)

This is the most important point in this document, please read it carefully.

Your data (name, phone number, outstanding amount, due date and the content of the messages exchanged) does not belong to Vexum and is not controlled by Vexum. Vexum merely operates the technical system that sends and receives the messages, following instructions from the law firm that contracted the service. The party that decides about that data, and that must handle your deletion request, is the law firm that sent you the message.

For that reason, the correct path is:

Step 1. Identify, in the message you received, which law firm sent it. The firm's name usually appears at the start of the conversation or in the contact display name on your WhatsApp.

Step 2. Contact that firm directly, through the channels it provides (telephone, e-mail, or the WhatsApp conversation itself), and request the deletion of your data. The firm has a legal duty to handle that request under article 18 of the LGPD, within up to 15 days.

Step 3. If you cannot identify the firm, or cannot reach it, you may write to us at privacidade@vexum.tech. We will: (i) identify, in our technical records, which contracting firm sent the message; (ii) forward your request directly to that firm, informing it of the applicable statutory deadline; and (iii) reply to you confirming that the forwarding was done and to which firm.

What Vexum cannot do on its own: as a processor, Vexum cannot decide, on its own initiative, to delete your data without instruction from the controlling firm, because doing so could interfere with a contractual relationship or an engagement that does not belong to Vexum. That is why the request must go through the firm. This does not mean your request goes unanswered: it means the party responsible for deciding and executing is the firm, and Vexum has a duty to assist that process and to make sure your request is not lost along the way.

What Vexum undertakes to do: upon receiving your request, Vexum confirms receipt to you within 5 (five) business days and forwards the request, within the same period, to the controlling law firm, formally requesting the deletion instruction. Once that instruction is received, Vexum carries out the deletion in its own systems within 15 (fifteen) days. Should the firm fail to respond within 15 (fifteen) days from the forwarding, Vexum reiterates the request and informs you in writing of the lack of response, identifying the controlling firm and advising you of your right to petition it directly and to file a complaint with the Brazilian National Data Protection Authority (ANPD), pursuant to article 18, paragraph 1, of the LGPD. In any scenario, your request is not filed away without a response.

Estimated timeline when you go through Vexum: we forward your request to the firm within 5 (five) business days of receipt, and we follow up so that the firm replies within the statutory period of up to 15 days from its receipt of the request.

4. CONTACT CHANNEL FOR DELETION REQUESTS

E-mail: privacidade@vexum.tech

Telephone: +55 81 99881-2909

Address: Rua Capitão José da Luz, 137, room 0203, Edifício Cervantes Cais 202, Coelhos, Recife, PE, ZIP 50070-540, Brazil

When contacting us, please state: your full name, the phone number that received the message (if applicable), and, if you know it, the name of the law firm involved. This speeds up locating your request.

5. WHAT IS ACTUALLY DELETED

Once deletion is confirmed and the absence of any legal retention ground has been verified (section 6), the following data is effectively erased from the system's active databases: your name, your phone number associated with the service, the amounts and dates related to the specific payment, and the content of the messages exchanged through the system. Backup copies existing as of the deletion date are overwritten within Vexum's normal backup rotation cycle of up to 30 (thirty) days, and cease to be accessed or used for any purpose from the confirmation of the request onward.

6. WHAT MAY BE RETAINED, EVEN AFTER THE REQUEST, AND WHY

Even after a deletion request is accepted, a limited portion of the data may be retained, restricted exclusively to the following legal purposes, pursuant to articles 15 and 16 of the LGPD:

• compliance with a legal or regulatory obligation, for example, tax documents that the law requires to be kept for a set period;
• regular exercise of rights in judicial, administrative or arbitral proceedings, for example, if there is an ongoing dispute or a concrete risk of dispute over the communication performed, in which case the record of the communication may be necessary to prove that the communication was carried out lawfully and not abusively, which protects both the firm and the data subject where the communication was in fact lawful.

Outside those scenarios, data is deleted or anonymized. The general retention periods applied by Vexum, where no early deletion request exists, are described in section 10 of the Privacy Policy, published alongside this document.

Backup copies may take an additional technical period to reflect the deletion, but cease to be used for any purpose once the request has been processed.

7. YOU MAY ALSO CONTACT THE ANPD

If you believe your request was not handled adequately, within the deadline, you may contact the Brazilian National Data Protection Authority (ANPD), the federal government body responsible for enforcing the LGPD, at gov.br/anpd.

8. VERSION HISTORY

Version 1.0, published on August 2, 2026.

Version 2.0, published on August 2, 2026: confirmation of the official contact channel (privacidade@vexum.tech), inclusion of a specific section on what is actually deleted and what may be retained due to a legal obligation, with reference to the periods in the Privacy Policy.

Version 3.0, published on August 3, 2026: terminology review to describe the service as client communication and payment reminders; inclusion, in section 3, of Vexum's affirmative undertaking regarding forwarding, follow-up and response to the data subject; and clarification, in section 5, that data is effectively erased from active databases, with an indication of the backup rotation cycle.

Legal basis of this document: articles 15, 16, 18 and 39 of Law No. 13.709/2018 (General Personal Data Protection Law).

This English version is provided for accessibility. In the event of any divergence of interpretation, the Portuguese version prevails.