Code of Conduct and Anti-Money Laundering Prevention

Dreampay Mediacao de Negocios Ltda ("DreamPay"), a Brazilian company, registered under CNPF no. 36.342.074/0001-53, headquartered at Avenida Governador Amaral Peixoto no. 492, suite 231, Centro, Nova Iguacu, RJ, concerned with its reputation and committed to the well-being of the society in which it operates, hereby establishes this Code of Conduct and Anti-Money Laundering Prevention ("Code"), which consolidates the values, procedures, and rules to be observed in the conduct of DreamPay's activities and those of all its affiliated, subsidiary, associated, or otherwise controlled companies.

All Employees and service providers of DreamPay, as well as all Merchants and consumers who use DreamPay's services, must read, understand, respect, and commit to following the principles of this Code, in any location, both inside and outside the company's premises. In this way, we uphold Ethics and transparency in the conduct of our business, with Respect as a practice in our relationships and Responsibility in preserving our reputation.

By establishing this Code, the management of DreamPay commits to providing all the engagement necessary to support activities related to Ethics and Compliance, striving to maintain the highest transparency in internal and external relations, and working to disseminate these principles within the company through observance of the following terms and conditions:

1 - Mission, Vision, and Values

DreamPay's mission is to develop and promote innovative solutions to facilitate payments by Brazilians for purchases abroad, in a secure, scalable, and sustainable manner.

DreamPay's vision is to be the partner with the most comprehensive solution within the financial ecosystem to facilitate payments by Brazilians abroad, helping companies overcome challenges and transform their businesses with increased sales volume.

The development of DreamPay's activities is guided by values such as Trust, Responsibility, Transparency, Agility, and Innovation.

2 - Definitions

Database: a structured set of personal data, established in one or more locations, in electronic or physical format.

Merchant: a Legal Entity headquartered abroad to which DreamPay provides its payment facilitation services.

Consumer: a Brazilian and/or foreign natural person holding a CPF registration and a credit card issued by a bank in Brazil, who uses the DreamPay system to pay for an expense incurred at a company headquartered abroad, registered as a Merchant with DreamPay.

Employee: refers to any member of the board of directors, leadership, holder of managerial positions, direct and indirect employees, contractors, interns, and apprentices who are carrying out activities at DreamPay.

Compliance: an English word meaning "conformity." At DreamPay, it refers to a set of disciplines aimed at complying with and enforcing the Code of Conduct, Policies, Processes, and applicable legal and regulatory standards.

Compliance Officer: a DreamPay employee responsible for promoting the Code of Conduct, Policies, Processes, and applicable Legal and Regulatory Standards for DreamPay.

Corruption: from the Latin "corruptus," meaning to decompose or deteriorate something. It refers to the act of bribing someone or something in order to obtain an advantage over others in an unlawful manner.

Data Protection Officer (DPO): also known as the Data Controller, is responsible for coordinating and ensuring compliance with the Data Protection Policy and applicable local legal/regulatory requirements, and also acts as the primary channel with Data Subjects and the National Data Protection Authority ANPD.

Personal Data: information related to an identified or identifiable natural person.

Terrorism Financing: defined as any action of economic assistance or financial support for the activities of terrorist elements or groups.

Suppliers: all those who provide services and products to DreamPay.

Confidential Information: non-public information with a certain level of secrecy.

Money Laundering: an illegitimate practice with the purpose of disguising or concealing the illicit origin of certain financial assets or property, so as to make such assets appear to have a lawful origin.

Bribery (Kickback): the practice of offering, promising, or giving to one or more representatives of the public or private sector an amount of money, favors, gifts, entertainment, or discounts for the purpose of manipulating actions or appropriate decision-making, thereby gaining an advantage.

3 - Use of the Code

The Code is a tool that should be read periodically and understood so that it can be applied in day-to-day activities. It should be consulted whenever there are doubts regarding compliance with the laws and ethical principles of DreamPay.

Should you feel the need to understand each section in greater detail, simply review the implemented actions.

To provide a more comprehensive interpretation of the Code, some examples of possible day-to-day situations have been included. Should any doubt remain, should there be a potential failure to act appropriately, or should this Code simply not address your questions or concerns, you should contact our Compliance Channels.

4 - Who This Code Is For

This Code applies to partners, members of the Executive Board, holders of managerial positions, employees, interns, temporary workers, and apprentices of DreamPay, service providers, and affiliated companies (all of the foregoing defined as "Employees"), as well as the Merchants to whom DreamPay provides its services.

5 - Integrity and Ethics

All employees must act correctly, even though there are situations in which difficult decisions must be made. Each time a particular decision is made in day-to-day activities, it is important to ask the following questions:

  • Is this legal?
  • Is it consistent with the Code and best practices of DreamPay?
  • Will it maintain a good reputation with clients, partners, business associates, suppliers, or employees?

If any of these questions has a negative answer, or if you do not know the answer, you should contact DreamPay's Compliance Channels.

6 - Compliance Channels

Use the following channels if you know of or suspect any activity that deviates from the ethical standards of this Code:

Speak with your immediate supervisor: they are your primary advisor. We suggest that, if it does not cause you any discomfort, you speak first with your immediate supervisor. They can answer some of your questions related to day-to-day work and matters involving DreamPay's Code of Conduct and Anti-Money Laundering Prevention.

Contact the Compliance Officer: they are the primary promoter of this Code. This professional can best guide you in finding an appropriate and ethical solution to your question or observation.

Data Protection Officer (DPO): also known as the Data Controller, is responsible for coordinating and ensuring compliance with the Data Protection Policy. They can answer or clarify your questions, as well as advise you on the best way to handle the matter.

Ethics/Compliance Channel: if you wish to make a suggestion, ask a question, or file a report, send an email to:

Your suggestion, question, or report may be anonymous. Your report will be handled confidentially and impartially, and a response will be sent to the email address used to submit the report.

7 - Principle of Non-Retaliation

DreamPay respects the right to express opinions and does not tolerate retaliation against any employee or third party who, in good faith, raises a concern about any violation of the law or of this Code.

For DreamPay, a situation in which an employee or third party makes reports with false allegations is considered a violation of this Code. For this reason, it is important to verify the truthfulness of the information before filing a report, as a report made in bad faith will be considered a violation.

8 - Responsibilities of Leaders

DreamPay's leaders must set the example within the company; they must maintain and promote the highest standards of conduct for their team. In this regard, each leader must promote this Code and maintain constant communication with their team.

Among the responsibilities of leaders are:

  • Maintaining and encouraging the highest standards of Professionalism at DreamPay.
  • Promoting the Code to their entire team.
  • Maintaining constant communication with their team and guiding them, in case of doubts, on how to act appropriately.

9 - Commitments

9.1 - Professionalism

Acting with professionalism and transparency is fundamental for DreamPay. Employees commit to:

  • Cultivating an environment of respect and dignity for diversity and human rights, combating all forms of prejudice, and not admitting any form of discrimination, whether based on race, nationality, sex, sexual orientation, age, religion, social standing, opinion, political conviction, role, or any other factor of individual differentiation;
  • Adopting policies and practices that actively contribute to the prevention, combat, and eradication of degrading forms of labor (child, forced, and slave labor);
  • Working in a fit state to perform designated tasks in an appropriate manner;
  • Not tolerating sexual, verbal, or physical harassment among colleagues and third parties;
  • Promoting equal opportunities for professional development for all Employees according to each individual's skills, competence, and performance;
  • Ensuring the right of employees to refuse work, accepting the suspension of their activities if there is a situation of serious and imminent risk to their life or physical integrity and/or that of others;
  • Fostering communication channels among employees for the receipt of questions related to diversity or reports, both internal and external;
  • Reporting any type of error, operational failure, or incident to the supervisor and responsible areas in order to remedy the event in a timely manner;
  • Competing fairly and respecting our competitors.

Day-to-day situations illustrating the conduct expected under the commitments above:

Question 1: My boss asked me to perform an activity contrary to this Code of Conduct. How should I act?

Answer: Our organization must be committed to rigorously following this Code of Conduct. Should there be a need to make an exception to any DreamPay policy or procedure that falls outside the parameters of this Code, you should first contact your supervisor. If you do not feel comfortable raising this matter with your supervisor, you should seek the Compliance Officer or use the communication channels presented at the beginning of this Code.

Question 2: By mistake, I forwarded a client's cardholder Personal Data database to another client. I think it is very unlikely that the client will learn of the event. To avoid unnecessary problems, I think I will not report the mistake. Am I acting correctly?

Answer: No, you are not acting correctly. Regardless of the level of complexity of the event, it is essential to escalate it to your supervisor and to the Data Protection Officer (DPO). The responsible team will analyze the event and take the appropriate measures to notify the client.

9.2 - Compliance with Applicable Laws and Regulations

DreamPay respects and rigorously follows the legal and regulatory requirements in the jurisdictions in which it operates. Accordingly, employees are committed to:

  • Repudiating direct or indirect involvement in criminal or illegitimate actions, such as: Money Laundering, Terrorism Financing, Corrupt Activities, Fraud, Cartel Formation, or monopolistic organizations;
  • Maintaining a transparent relationship with the public sector in the jurisdictions where DreamPay operates, respecting applicable laws and repudiating any illicit practice;
  • Neither offering nor accepting any type of gift, present, discount, undue advantage, or direct or indirect exchange of favors to or from public officials, politicians, or related persons, for the purpose of receiving an exchange of private benefits or benefits in favor of DreamPay;
  • Cooperating with public authorities in accordance with the law and in a transparent manner;
  • Respecting the applicable Laws and Regulations regarding proper practices of contribution or assistance to political parties, whether directly or indirectly, personally or on behalf of the company;
  • Conducting DreamPay's work in compliance with accepted accounting principles as defined by law;
  • Conducting its business and activities with social and environmental responsibility, contributing to sustainable development.

Day-to-day situations illustrating the conduct expected under the commitments above:

Question 1: I became friends with a superintendent of BCB at a Fintech Auditing event. Upon leaving the event, we decided to have lunch at an upscale restaurant. I would like to invite them and pay the bill with my own money. Could there be any issue?

Answer: This situation is delicate as it could lead to misinterpretation; the superintendent could interpret this activity as a type of bribery of a public official. To avoid an atypical situation with the public official, we recommend splitting the bill or not inviting them to this type of engagement.

Question 2: A client wishes to use DreamPay's Digital platform. At the time of signing the service agreement, the client asked to remove the Anti-Money Laundering and Counter-Terrorism Financing clauses. Can we proceed with the signing?

Answer: DreamPay does not tolerate being used as a vehicle for practices such as Money Laundering and Terrorism Financing. In this regard, this request can be considered a red flag that we must not overlook. We suggest escalating this matter to the Legal Department and the Compliance Officer; they will assess the event immediately.

9.3 - Conflict of Interest

A conflict of interest is a situation in an institution where a person has difficulty making an impartial decision due to their personal interests. This decision could be considered unethical or illegal. To prevent potential Conflict of Interest events, DreamPay Employees are committed to:

  • Following best practices to avoid or identify conflict of interest situations;
  • Alerting the Human Resources Department about situations that could generate a conflict of interest between DreamPay, employees, directors, or third parties;
  • Acting transparently when there is direct or indirect involvement with employees of third parties that maintain any relationship with DreamPay;
  • Adopting best practices of Corporate Governance -- transparency, accountability, and equal treatment of all parties involved, in accordance with legal provisions;
  • Being transparent when there is a personal or family relationship between employees and candidates for employment at DreamPay.

Day-to-day situations illustrating the conduct expected under the commitments above:

Question 1: My son has just graduated and has not yet found a job. I have a good relationship with several suppliers and was thinking of asking them to find a position for my son. This should not be a problem if the choice is purely technical, right?

Answer: In this type of situation, it is important to make it clear that your personal interests are not the same as those of DreamPay. By clarifying this, you avoid appearing to take advantage of DreamPay's contacts to resolve personal matters and: 1. Being viewed unfavorably by third parties, and 2. Creating a conflict of interest. We recommend seeking prior guidance from your supervisor and the Compliance Officer.

Question 2: I report directly to a Director of DreamPay, and after a business trip, I became seriously involved with this person. We have now been dating for 8 months, but they insist on not telling DreamPay's Board of Directors. Should I remain silent?

Answer: A Conflict of Interest is not necessarily an unethical situation. What would be unethical is not being transparent with DreamPay. If your partner does not agree to inform the Board of Directors, you yourself should initiate the conversation.

9.4 - Confidentiality and Data Protection

Due to the nature of its activities, DreamPay handles confidential information and is therefore committed to:

  • Respecting the confidentiality of DreamPay's information;
  • Ensuring that privileged information of DreamPay is not used for personal benefit or the benefit of third parties;
  • Directing employees to seek internal guidance before participating in seminars, external work meetings, training, industry chamber meetings, interviews, and media programs regarding information that may become public, and refraining from speaking on behalf of the company unless previously authorized;
  • Respecting the confidentiality of processed information (including confidential, privileged, and Personal Data), with the transfer of such information to third parties being prohibited without prior authorization from the information owner, unless there is an explicit request from regulators.

Day-to-day situations illustrating the conduct expected under the commitments above:

Question 1: I went to a bar with some colleagues from work and one of them started talking about a very unusual situation that occurred with a client. Is it acceptable to discuss clients at a bar or public place?

Answer: All employees and business partners of DreamPay must respect the confidentiality of our clients' information. Accordingly, we must avoid discussing work-related matters (clients, operations, and Employees) in public places where confidentiality could be compromised. It is also important to note that the confidentiality of information must extend to colleagues who do not need to know certain information.

Question 2: A public official visited the office and, due to an investigation, requested confidential information I possess regarding three of our Employees. Should I provide the information to the official?

Answer: DreamPay has an obligation to cooperate with public entities, but before providing any information, we must verify the legality of the request. You should immediately contact the Compliance Officer or seek legal counsel for an assessment of the request.

9.5 - Relationship with Our Clients

The business conducted by DreamPay is carried out in an ethical, honest manner and in full compliance with national and international laws and regulations. In respect of its clients, DreamPay is committed to:

  • Offering quality services using advanced technology, with a transparent, equitable, effective, courteous, and respectful standard of service, aimed at the full satisfaction of its clients and the maintenance of lasting relationships;
  • Welcoming suggestions, criticisms, and questions, and responding to them with professionalism and promptness, valuing the interests and opinions of its clients;
  • Always using DreamPay's official communication channels for client service, such as email and telephone, and avoiding the use of personal communication channels (personal email and phone numbers);
  • Never complying with unethical or illegal requests from any client; if an unethical or illegal request is received, the situation must be reported immediately to the Ethics and Compliance Manager.

Day-to-day situations illustrating the conduct expected under the commitments above:

Question 1: A very important client would sign a service agreement with our company if we met operationally impossible deadlines. Should we proceed?

Answer: We must honor our commitments. Therefore, we cannot commit to a service we will be unable to deliver. We suggest reassessing the deadlines with the responsible parties to verify the feasibility of meeting the requested timeline. If, after this, we are unable to establish the deadlines as requested, the best course of action would be to negotiate an appropriate timeline.

Question 2: We have a major client who likes to show off and always invites me to expensive events and dinners. Should I accept to avoid missing business opportunities?

Answer: DreamPay greatly values its relationships with clients and conducts them in a professional and transparent manner. In cases where there is doubt as to whether a gift, favor, or entertainment could call into question the impartiality of decision-making, the matter should be brought to DreamPay's Board of Directors for analysis and a decision.

9.6 - Relationship with Our Suppliers and Business Partners

Our Business Partners, namely the Merchants, must maintain ethical standards and be in compliance with applicable laws. Accordingly, DreamPay commits to:

  • Adopting equitable and fair practices in its relationship with its Business Partners;
  • Engaging suppliers and business partners based on strictly legal, technical, and professional criteria;
  • Refusing suppliers and business partners who adopt illegal practices or violate the principles of this Code;
  • Establishing Due Diligence standards to verify whether strategic Business Partners are in compliance with the requirements of our Code and applicable laws.

Day-to-day situations illustrating the conduct expected under the commitments above:

Question 1: I have a friend who owns an IT services company. He is very eager to become a supplier of DreamPay. I was thinking of sharing with him the data from previous contracts for similar services so that he can better benchmark his proposal and also present us with an offer within our expectations. Is there a problem with this?

Answer: Doing so is not only unethical toward other competing suppliers, but also breaches DreamPay's information confidentiality. If your friend wishes to become a supplier, they must participate in a transparent and fair process along with other competitors. Our Code of Conduct states that we must adopt equal and fair practices in dealing with Business Partners.

Question 2: DreamPay needs to engage a supplier that has a technological tool that will store our clients' Personal Data. Through a media search, we discovered a data breach scandal involving this supplier. Considering DreamPay's need, can we proceed with engaging this supplier?

Answer: A supplier with a history of information breaches may be a red flag to be considered. We suggest verifying whether there are better options available in the market. If there are no better options, we suggest escalating the situation to the Data Protection Officer (DPO) and the legal team, so as to plan a control strategy.

9.7 - Care of Company Assets

Company assets must be used to properly carry out DreamPay's core activities. Accordingly, employees are committed to:

  • Using company equipment and resources only for professional purposes, avoiding access to websites unrelated to work;
  • Preserving the company's physical assets (equipment and facilities);
  • Avoiding storing personal information on IT equipment, both on workstations and network resources;
  • Not removing equipment or materials from DreamPay's offices without proper authorization;
  • Assessing the risks of any significant initiative to be undertaken in DreamPay's operations;
  • Protecting the intellectual capital belonging to the group, for example: methodologies, strategies, know-how, etc.

Day-to-day situations illustrating the conduct expected under the commitments above:

Question 1: A close friend wants to create a payment platform similar to one that a DreamPay company has. Knowing that I am a developer and know the technical specifications of the platform, they asked me for some technology tips. Can I help them?

Answer: No, you cannot. As an employee of DreamPay, you must protect the company's intellectual capital. Providing this type of information may be considered an illicit practice.

Question 2: I notice that a colleague has decided to use the professional mobile phone that DreamPay provided for personal use, including photos and videos of friends and private situations. Is there anything I can do in this case?

Answer: Company equipment must always be used for professional activities. In this case, you should speak with your colleague and alert them that they should not use the mobile phone in this manner. If you do not feel comfortable speaking with your colleague, you may use the Compliance Channels defined in this Code.

10 - Final Provisions

This Code takes effect immediately and shall remain in force for an indefinite period. It is published in full on the website www.dreampay.com.br, as well as in the private profiles of Merchants who use the DreamPay system.

The content of this Code may be revised periodically to reflect changes in our business, on the Sites or Services, or in applicable laws. The revised Code shall take effect as of the date of its publication on the website www.dreampay.com.br.

If the revised version of the Code includes a substantial change, we will send Merchants and all DreamPay employees and service providers prior notice of 10 days, also publishing a notice of the change on the website www.dreampay.com.br.