Privacy Notice

Last update:
August 4, 2026

1. Introduction

Welcome to Nu!

Thank you for choosing Nu! This Privacy Notice was created by us to show our commitment to always handling your personal data with security, privacy, and transparency. It describes the personal data we collect, how it is used, stored, and shared, and presents your rights regarding such data.

PERSONAL DATA is any information that directly or indirectly defines a specific natural person, as defined by the applicable law.

This Privacy Notice is applicable when you use any of our Services, which include our app, our website, or any of the financial or other products and services available to you through our app or website, as well as when you interact with us in relation to a contract, communicate with us, or otherwise deal with us (“Services”). For this reason, we recommend that you read it until the end.

The controller of your personal data, that is, the company responsible for deciding how to handle your personal data, is Nu Global AG, Grafenauweg 8, 6300 Zug, Switzerland ("Nu" or “we”, “our”, “us”). We offer our Services through different companies, as listed here, and the company providing you with a Service will be the controller of your personal data. In some cases, certain group companies jointly determine the purposes and means of processing your personal data (for example, when developing new Services); in those cases, those group companies act together as joint controllers.

If you don't agree to this Privacy Notice, or to any changes we subsequently make to this Privacy Notice, you must immediately stop using our Services or otherwise providing any information to us.

If you have any questions about this Privacy Notice or our privacy practices, or if you want to exercise any of your rights as a data subject, our service channels listed in the "Contact us" section are at your disposal.

2. Application

This Privacy Notice is applicable to:

  • Customers (either active or inactive): individuals who effectively contract, use or access one or more of our Services.
  • Prospects: individuals prospected by us as potentially interested in our Services, or who already applied to hire our Services, but who are not our customers.
  • People whose data is otherwise processed in relation to our Services: natural persons that are not necessarily our customers or prospects, but who have their personal data processed by us due to these Services or through relations with customers that are bound by this Privacy Notice (e.g., a person who acts as a representative, guardian, employee, or partner of a customer, or a person who is identifiable in relation to a financial Service without being our customer)

This Privacy Notice is part of our Terms and Conditions, which governs your use of our Services and where such Services may be defined further.

Our Services are not intended for children under the age of 18 years old, and we do not knowingly collect their personal data. If we discover that we have information from a child under the age of 18, we will delete it as quickly as possible, unless data retention is otherwise demanded by legal or regulatory purposes. If you believe that a child under the age of 18 may have provided his or her information to us, please contact us using the service channels listed in the "Contact us" section below.

3. Collection of personal data

To operate effectively, companies offering financial products and services like us need to use customer personal information. In the following section, we indicate the personal data we collect about you, and our reasons for using it.

Types of data

  • Personal data provided by you
    • Personal data that refers to you, such as full name, address, date of birth, email address, phone number, nationality, identification documents’ information, profile picture, among others.
    • Biometric data (e.g., data extracted from selfies provided by you in order to validate/authenticate your identity), always processed according to the applicable legal basis. Note that third-party services may be used to extract biometric data from a selfie provided by you.
    • Account credentials (e.g., PIN, usernames, passwords, and any other security codes).
    • Selfies and photos of your identification document, when you create an account with us.
    • Information accessed when you give us access to your other financial accounts (e.g., through Open Banking).
    • Information you provide when you interact with our support channels, when you voluntarily complete surveys, provide feedback, apply for special offers and promotions, enter into competitions or register to our events.
    • Third-party information, including personal information you provide about people you are transactioning with.
    • Other information you provide to us

If you disclose personal data from third parties (e.g. family members, contact persons), we assume that you are authorized to do so, that the relevant data is accurate, and that you have informed these individuals about this Privacy Notice.

Sharing your personal data with us is optional, but some personal data is essential for us to provide our Services. If you don't provide it, we won't be able to provide our Services to you.

  • Browsing and device data
    • Device features, such as ID, operating system, browser, model, and information linked to interactions in our Services ○ Geolocation data.
    • IP address of the mobile device used to access our Services
    • Usage profile
    • Technical data, such as URL, network connection and provider.
    • Cookies, web beacons, and analytics tools, in accordance with the cookie preferences you set.
    • Data stored on your device (such as categories of apps you have and other metadata about your device, based on your device settings)

  • Personal data generated from the use of our Services
    • Data from the use of our Services (such as data from transactions and financial movements in the app).
    • Information related to the invitation to become our customer.
    • Customer service history (such as chat transcripts, phone call recordings).
    • Preferences (such as your preferences for receiving our marketing communications and privacy choices).
    • Survey results for improvement of our Services, if you participate in a survey.
    • Access to your contact list if you voluntarily activate this feature in our app.
    • For Services that rely on a username or a handle, we may automatically create an unique and recognizable transfer identifier for you using information already associated with your account (such as your name).

  • Personal data collected from third parties
    • Registration data (such as from service providers to verify and supplement your information, data analytics service providers and business partners, advertisers and sponsors).
    • Transaction data (such as details of your bank account and credit card, information associated with your payments and reimbursements, receipt and invoice data).
    • Financial information from financial institutions and intermediaries.
    • Credit reports, credit scores and fraud history information and scores from credit bureaus, security and anti-fraud providers and other third parties.
    • Data on financial restrictions (such as negative entries, amounts owed, due dates, number of inquiries).
    • Information about you from service providers pertaining to customer support or technical issues you may raise during the use of our Services.
    • Information provided by our affiliates (such as in case you have previously used our Services in other jurisdictions).
    • Information on debts due or overdue, co-obligations and guarantees.
    • Information regarding your participation in any Politically Exposed Person (PEP) list or restriction list

When we receive personal data from third parties, we establish contractual requirements demanding that such data is collected legitimately by such third parties, and that they are authorised to provide the relevant data to us so that we can process it in accordance with this Privacy Notice.

  • Publicly available data
    • Publicly available information on you or that has been made public by you (such as information from publicly available sources like online registers or directories).
    • Information on mentions or interactions with us on our social media profiles.
    • Testimonials about us posted on social media profiles and pages, along with your name and image (including profile pictures)

Processing purposes

We are required by applicable data protection laws to have a valid legal justification for using your personal data. For this reason, we will only process your personal data in the following hypotheses:

  • Providing our Services (including for identifying, authenticating, and verifying requirements to hire our Services, and for making transaction).
  • Providing customer support and answering questions.
  • Providing communications to you (including notifications or push notifications from the use of our Services, for marketing purposes, and for other matters related to our Services).
  • Sending you limited reminders to help you complete the account-opening process you have already initiated (with the right to opt out of such communications), based on our overriding private interest in providing the Services you requested.
  • Improving our Services (such as carrying out tests for improving the use and experience in our app).
  • Developing and operationalizing new Services to be offered by our companies, and generating knowledge for innovation or development of new Services.
  • Auditing for the purpose of corporate transactions.
  • Marketing, prospecting, carrying out market research, opinion polls, and promotion of our Services, or those of our partners, including enabling offers and sending information about products, services, news, features, content, updates, and other events relevant to maintaining the relationship with you.
  • Advertising on our app, social media or third-party websites.
  • Promoting our Services on social media, websites, applications, or institutional and advertising materials.
  • Recommending new Services, or application features, including services from partners that may interest you.
  • Periodically reassessing the eligibility to be our customer, making it possible to eventually and proactively invite prospects.
  • Protecting credit, including granting credit and increasing limits.
  • Preventing and solving technical or security issues.
  • Investigating and implementing measures to prevent and combat illicit acts, fraud, financial crimes, and guarantee the security of our customers and the financial system.
  • Guarantee of accessibility means to ensure fair and equitable service to our customers and other data subjects in need.
  • Monitoring of the use and the performance of our Services.
  • Generating statistics, studies, research, and surveys on the activities and behavior related to our Services.
  • Regularly exercising our rights, including presenting documents in judicial and administrative proceedings.
  • Complying with a court order, competent authority, or supervisory body.
  • Complying with legal or regulatory obligations, and any relevant regulations in connection therewith.
  • Protecting the rights, property or safety of you, us or another party.
  • Creating, assigning, and operating a transfer identifier associated with your account that allow you to send or receive transfers more easily, including enabling the identification of the intended recipient, preventing mistakes, and routing domestic or cross-border transfers within our Services.
  • Allowing Nu customers to search the transfer identifier in order to find you as the intended recipient of a transfer.
  • Carrying out other business purposes stated when collecting your personal data or as otherwise set forth in applicable data protection laws.
  • Other reasons provided that we have a legitimate reason to process your data and when this provision is considered reasonable when balanced against your human rights and freedoms.

We may use ARTIFICIAL INTELLIGENCE tools in the processing of your personal data for personalizing and improving our Services, investigating and implementing measures to prevent and combat frauds, among other purposes allowed by the applicable legal and regulatory obligations and in compliance with the commitments made in this Privacy Notice.

4. Personal data sharing

In certain circumstances, we may disclose the personal data listed above to third parties, for the purposes stated below:

Other companies in our group

  • Providing access to and enabling the functioning of Services hired by you.
  • Operationalizing and offering new Services.
  • Marketing, prospecting, carrying out market research, opinion polls, and promoting our Services
  • Providing benefits programs.
  • Enabling database integration and/or migration.
  • Protecting credit, including granting credit and increasing the limit.
  • Preventing and solving technical or security issues.
  • Investigating and implementing measures to prevent and fight illegal activities, fraud, financial crimes, and ensuring the security of our customers and financial system.
  • Making of- and defense against legal claims.
  • Complying with applicable legal or regulatory obligations.

Nu customers

  • Using the transfer handle to identify the Nu customers in a transfer, allowing the sender to verify the recipient and the recipient to see who sent the transfer.

If you have a transfer identifier, you can request its correction, as well as the limitation of visibility of your name or handle to other Nu customers, by contacting us through the channels listed in the “Contact us” section.

Business partners, service providers, and other third parties (such as cloud infrastructure providers", KYC agencies, fraud prevention vendors, law firms, and credit score, debt collection and marketing partners).

  • Helping provide the Services we deliver to you.
  • Improving our Services, and operating new Services.
  • Contacting you.
  • Collecting debt.
  • Checking your identity and eligibility to hire our Services, and periodically reassessing this, enabling possible proactive invitations to prospects.
  • Prospecting, carrying out market research and opinion surveys, and promoting our Services.
  • Marketing our Services, including through social media platforms that provide our marketing materials and/or targeted advertising.
  • Providing benefits programs.
  • Protecting credit, including granting credit and increasing limits.
  • Preventing and solving technical or security issues.
  • Investigating and implementing measures to prevent and fight illegal activities, fraud, financial crimes, and ensuring the security of our customers and financial system. Regularly exercising our rights.
  • Complying with a court order, competent authority or supervisory body.
  • Complying with applicable legal or regulatory obligations.
  • Enabling merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part). Should one of these events occur, we will make reasonable efforts to notify you before your information becomes subject to different privacy and security policies and practices

Authorities and regulatory bodies.

  • Investigating and implementing measures to prevent and fight illegal activities, fraud, financial crimes and ensure the security of our customers and financial system.
  • Regularly exercising our rights, including presenting documents in judicial and administrative proceedings, if necessary.
  • Complying with a court order, meeting a request from a competent authority or supervisory body.
  • Complying with applicable legal or regulatory obligations

When sharing your personal data with third parties, we will require them to use the personal data exclusively for the limited purpose for which we provide it, as well as to maintain reasonable security measures for the protection of such information, and comply with the provisions as outlined in this Privacy Notice and in the applicable data protection laws.

We do not sell, trade, or rent your personal data to third parties.

You have the right to opt-out to the sharing of your data for marketing purposes by contacting us through the channels indicated in the “Contact us” section.

When using our Services, you may be redirected to third-party websites or applications. Once redirected to a third-party website or application, privacy practices will be governed by their privacy notices and terms of use.

5. Lawful data processing

We process your personal data in a lawful, proportionate way, and in good faith, strictly in accordance with the Swiss Federal Act on Data Protection (FADP). To the extent necessary and depending on the respective situation and purpose of the data processing, our grounds for processing your data are primarily an overriding private or public interest or a requirement or authorization by law. For certain types of data processing activities, we may request your explicit consent.

Where our processing of transfer identifier visibility or related disclosures is based on our overriding private interests, you may object to such processing, request restriction or correction of inaccurate information related to your transfer identifier, in accordance with the applicable law, by contacting us through the channels listed in the “Contact us” section.

When we require your explicit consent, you will be informed about the intended instances of personal data processing and your consent must be given voluntarily and explicitly for one or more specific instances of processing, based on appropriate information.

Whenever we process your personal data based on an overriding private interest (such as onboarding reminders and marketing communications), you have the right to object to such processing at any time by contacting us through the service channels listed in the “Contact Us” section.

6. Security measures

We use various types of security measures to ensure the integrity of your personal data, such as information security standards practiced by the industry when collecting and storing personal data.

Personal data may also be stored by means of cloud computing technology and other potential future technologies, always seeking to improve and enhance our services and security.

We have a robust, highly qualified team responsible for ensuring that we adopt the best security practices, including:

  • Multi-factor authentication for information access.
  • Security as code, to enable automations and fast and efficient responses to security events in the technological environment.
  • Encryption for data at rest, in transit, and in use, to ensure information integrity.
  • Continuous environment monitoring.
  • Continuous information security analyses and tests in our systems, performed by internal and external teams.
  • Periodic audits.

We use commercially reasonable safeguards to help protect and secure your personal data. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.

You should also help protect your data. Never share your password with anyone; it is personal and non-transferable, and always be careful when posting your personal data on social networks or any other public environment. Keep your app and operating system updated to ensure maximum security.

If you suspect unauthorized activity with respect to your use of our Services, or you suspect a security incident has occurred, please contact us immediately through the service channels listed in the "Contact us" section.

7. Cross-border transfer of data

Nu is an international company, and for this reason we may need to transfer your personal data to other countries. This includes countries where Nu already operates (such as Brazil, Mexico, and Colombia), as well as other countries in the EU (such as Germany, where part of our cloud environment is hosted) and in other regions, whenever necessary.

When cross-border transfer is necessary, Nu complies with all the requirements established by the applicable law, and uses one of the lawful data transfer mechanisms:

  • Disclosure of personal data to a State or international body if the Federal Council has decided that its legislation guarantees an adequate level of data protection.
  • EU-US and Swiss-US Data Privacy Framework, including the UK extension.
  • The use of Standard Data Protection Clauses that the FDPIC has approved, issued, or recognised beforehand.
  • Where disclosure is directly connected with the conclusion or performance of a contract

8. Data subject rights

Under the FADP, natural persons whose personal data is processed have specific rights to protect their personality and fundamental rights.

You may exercise the following rights regarding the personal data we process about you:

  • Right to Information (Access)
    • You have the right to request information from us as the controller on whether we process personal data related to you.
    • You are entitled to receive the personal data processed as such, along with the information provided on this Privacy Notice.
  • Right to Correction (Rectification)
    • You may request that incorrect personal data be corrected. This right may be refused if a statutory provision prohibits the correction or if the data is processed for archiving purposes in the public interest.
    • If the accuracy or inaccuracy of the data cannot be established, you may request that the data be marked as being disputed.
  • Right to Deletion or Destruction
    • You may request that personal data be deleted or destroyed.
  • Right to Prohibition of Processing or Disclosure
    • You may request that a specific data processing activity be prohibited.
    • You may request that a specific disclosure of personal data to third parties be prohibited.
    • You have the right to object, at any time, to the processing of your personal data which is based on our overriding private interests (such as onboarding reminders and marketing communications).
  • Right to Communication to Third Parties
    • You may request that any correction, deletion, destruction, prohibition of processing or disclosure, marking as disputed, or judgment be communicated to third parties or published, when applicable.
  • Right to Data Portability
    • You may request that the personal data you disclosed to us be delivered to you in a conventional electronic format. This applies if we are carrying out automated processing, and the data is processed with your consent or in direct connection with a contract with you.
    • You may also request that your personal data be transferred to another controller, provided the same requirements are met and no disproportionate effort is required.
    • The delivery or transfer must be free of charge.
  • Rights Related to Automated Individual Decisions
    • If a decision is based exclusively on automated processing and has a legal consequence or a considerable adverse effect on you (an "automated individual decision"), we must inform you of this.
    • On request, you may express your point of view and request that the automated individual decision be reviewed by a natural person.

Please note that your rights may be refused, restricted, or delayed by us as the controller in certain cases, for example:

  • If an applicable law or regulation provides for it.
  • To safeguard overriding third-party interests or our own overriding interests.
  • If your request is obviously unjustified, particularly if it does not serve the purpose of data protection or is clearly frivolous.

In all cases of refusal, restriction, or delay, we must provide reasons for our decision.

To exercise any of your rights, please submit a request through the channels indicated in the “Contact us” section. We will not discriminate against you for exercising these rights.

We may require additional information from you to help us verify your identity and process your request. If we are unable to verify your identity, we may deny your request.

You may also receive promotional emails from us if you are an existing customer or if you have previously shown an interest in our Services. You can opt out at any time by using the unsubscribe link in any promotional email we send you or by contacting us through the service channels listed in the “Contact Us” section. If you unsubscribe from receiving emails from us, we may still send you important service emails, such as emails about your account or our ongoing business relations.

9. Retention and deletion of personal data

Your personal data is kept by Nu only as long as necessary for the intended processing purposes.

Data storage and retention periods for personal data held in IT systems and as physical records are defined by legal, regulatory, contractual and business requirements.

When applicable, and even if you stop using our Services, we may store your personal data for an additional period for auditing purposes, compliance with legal or regulatory obligations, for the regular exercise of our rights, or also for the necessary period in accordance with the legal basis that justifies the retention of the data, always in compliance with the applicable law. These legal/regulatory data retention periods generally vary between 5 and 20 years.

Your data will always be kept in a secure and controlled environment and will be deleted or anonymized as soon as its maintenance is no longer necessary or justifiable in accordance with the applicable data protection law.

10. Changes to the Privacy Notice

We can change this Privacy Notice at any time.

We always value transparency: whenever a relevant change is made, we will send you a notice indicating the new version in effect, and we will promptly post any Privacy Notice's changes to this page.

To stay informed of our privacy practices, we recommend you review this Privacy Notice on a regular basis as you continue to use our Services.

11. Contact us

If, after reading this Privacy Notice, you still have any questions or, for any reason, need to contact us for matters involving your personal data, you can contact us through one of the channels below:

  • help@global.nu.co
  • +41 43 505 26 11

We are always available to answer your questions and put you in control of your personal data.

Last update: August 4, 2026