Last updated: September 24, 2026. This policy describes how Dectus processes your personal data.
1. Who we are
Dectus is a brand and retail loyalty platform operated by GRAFITES SULAMERICANA LTDA., Brazilian company ID (CNPJ) 04.840.862/0001-83. It provides the Dectus Pass, the customer's single registration and the Dectus Point reader used at partner retailers. For registration and Dectus Pass data, GRAFITES SULAMERICANA LTDA. acts as the controller under Brazil's General Data Protection Law (Law 13,709/2018, LGPD). Each partner retailer is an independent controller of the data it receives with your consent and of the rules of its own discount or points program.
2. What data we process
- Registration data: full name, CPF, date of birth, e-mail, phone and address, provided by you only once when creating the pass. The CPF stays in the registration only: it does not go into the pass and is never asked at checkout.
- Pass data: the loyalty identifier, a unique code generated by Dectus and stored in the pass. It contains no CPF or personal data.
- Usage data: each time the pass is used, we record the pass identifier, the store, the checkout, the time and the data shared according to your authorization. You can view this history at any time. Stores receive only aggregate numbers from this log.
- Consent preferences: what you authorized to share with each store and when you authorized it.
- Technical data: wallet type (Apple Wallet or Google Wallet), device model and logs required for the operation and security of the service.
We do not collect payment data. Payment is made directly between you and the store, through the means it offers.
3. Why we use it and on what legal basis
- Issue and maintain your pass and identify you at checkout — performance of the contract entered into with you when accepting the Terms of Use.
- Share with each store only what you authorized — consent, given store by store and recorded in your registration.
- Prevent fraud, ensure security and improve the service — legitimate interest, always respecting your rights and expectations.
- Comply with legal and regulatory obligations — legal obligation.
4. Per-store consent and sharing
In the single registration you choose, for each partner retailer, which data it can see: name, CPF, e-mail, phone, birthday, address and the history of purchases made at that store. The pass identifier is always read at checkout, because it is what identifies you in the loyalty program. Other data is only made available to the retailer if you authorize it.
- One store does not receive what you shared with another.
- You can change or withdraw consent for any store at any time, through your registration or the channels listed in this policy. Withdrawal applies from then on and does not affect processing that took place before.
- Dectus does not sell personal data and does not use your data for third-party advertising.
- We may use processors, such as cloud and messaging providers, which process data only under our instructions and under contract.
5. Digital wallets
The pass is stored in Apple Wallet or Google Wallet. How these wallets work and the data processing carried out by Apple and Google follow each company's privacy policies.
6. Your rights
Under article 18 of the LGPD, you may request: confirmation that processing exists; access to your data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary data or data processed in breach of the law; portability; information about whom we share your data with; and withdrawal of consent. You may also ask for your registration and pass to be deleted.
To exercise your rights, write to contato@dectus.com.br. We will reply within the deadlines set by law.
7. How long we keep it
We keep registration and pass data while the pass is active. After the registration is deleted, we erase or anonymize the data, except for records the law requires us to keep or that are needed for the regular exercise of rights.
8. Security
We adopt technical and administrative measures to protect data, such as access control, encryption in transit and audit logs. Reading the pass at checkout uses the Apple VAS and Google Smart Tap protocols, which only work with readers authorized by Dectus.
9. Minors
The Dectus Pass is intended for people aged 18 or over. If we identify a minor's registration without the required legal authorization, it will be deleted.
10. Changes
This policy may be updated. When there is a relevant change, we will notify you by the registered e-mail or through the pass itself, and the date on this page will be updated.
11. Data Protection Officer and contact
Data Protection Officer (DPO): GRAFITES SULAMERICANA LTDA. Contact: contato@dectus.com.br. Support: suporte@dectus.com.br. WhatsApp: +55 11 4664-1373.