XML 52 R37.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats, including risks relating to disruption of technology infrastructure and business operations, intellectual property theft, fraud, harm to employees or customers, violation of privacy laws and confidentiality, other litigation and legal risks, and reputational risk, as part of our overall risk management principles and processes. Our risk management framework includes several security pillars, including data security, identity management, cloud security, infrastructure security, application security, incident response, and cybersecurity risk management. We conduct annual International Organization for Standardization Information Security Management Systems ("ISMS") Requirements ("ISO/IEC 27001") reviews and Payment Card Industry Data Security Standard ("PCI-DSS") reviews of our payment information security controls with the assistance of an external certified auditor. Our cybersecurity risk management processes incorporate frameworks aligned with recognized cybersecurity and cyber risk established frameworks. Our cybersecurity model is based on four criteria: (i) “Zero Trust” (e.g. a model based on continuous validation of users and devices), (ii) analysis of abnormal or unusual behavior, (iii) automatic response, and (iv) decentralization. Our cybersecurity risk strategy aligns risks, initiatives and controls, consisting of initiatives and projects designed to identify, evaluate, control and monitor cybersecurity risks and incidents. Our data security and privacy strategy focuses on discovery, minimization, detection, response, standardization and awareness. Our incident response strategy is based on best practices, focusing on proactive and automatic response, preparation and prevention, detection and analysis, containment, eradication, recovery and post-incident activity. We have also implemented a security risk management policy that provides guidance on how to identify, analyze, and optimize risk management and subsequent risk mitigation. We have processes in place to assess, identify, manage, and address cybersecurity threats and incidents. These include, among other things: mandatory trainings and drills on social engineering, phishing and ransomware attacks for all our employees; tabletop exercises for employees of the information security team; cybersecurity events in which management and/or certain employees participate and/or organize; ransomware prevention and phishing controls allowing for automatic and timely detection and response; and penetration testing, red team exercises and a bug bounty program to help us evaluate the effectiveness of our information security processes and improve our security measures and planning. We also have teams in place to oversee and manage our cybersecurity risk management processes, including: (i) an information security team, organized around our various services and products, responsible for day-to-day cybersecurity matters related to the respective services and products; (ii) a risk committee that is comprised of members of management and oversees the Company’s financial and non-financial risks, including cybersecurity risks, as described in more detail below under the heading “Governance”; and (iii) internal local, corporate and strategic crisis management teams that form part of our crisis management framework. Our risk management framework further includes processes to manage cybersecurity risks associated with third parties, including, a third-party risk management program that focuses on identifying security and data privacy risks arising out of our interactions with critical third-party suppliers and payment methods, and a program focused on assessing risks arising in mergers and acquisitions transactions. In connection with our cybersecurity risk management processes, while we do not regularly engage assessors, consultants, auditors, or other third parties to assess, identify, and manage material risks from cybersecurity threats, we do involve such parties if there has been a cybersecurity incident that we believe requires an assessment by a third party. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. In the last fiscal three years, we have not experienced any material information security breach incidents and the expenses we have incurred from information security breach incidents were immaterial. See “Risk Factors” in Item 1A of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats, including risks relating to disruption of technology infrastructure and business operations, intellectual property theft, fraud, harm to employees or customers, violation of privacy laws and confidentiality, other litigation and legal risks, and reputational risk, as part of our overall risk management principles and processes. Our risk management framework includes several security pillars, including data security, identity management, cloud security, infrastructure security, application security, incident response, and cybersecurity risk management.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Board of directors The Audit Committee is primarily responsible for the oversight of cybersecurity risks and threats. To fulfill this responsibility, the Audit Committee, assisted, as appropriate, by the risk committee, oversees the risk management framework, including risk assessment and risk management policies and procedures established by management to identify, evaluate, measure and manage existing and potential cybersecurity risks faced by the Company. Annually and on an as-necessary basis, individual members of management and/or of the risk committee provide presentations to the Audit Committee regarding cybersecurity matters, including any material risks. These presentations include information regarding cybersecurity risks, the evolution of those risks and initiatives to optimize and improve the processes of cybersecurity. Further, in the event of a specific cybersecurity incident, these presentations include information about the relevant security incident, such as incident status, informed stakeholders and remediation plans.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | As part of our cybersecurity risk management processes, our Cybersecurity VP presents security risk matters to the risk committee on an as-necessary basis and to the Audit Committee annually and on an as-necessary basis. The risk committee also meets quarterly and presents to management the status, evolution and main indicators of each principal security risk, although information security may not be deemed a risk in each particular quarter.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The cybersecurity risk management processes described above are managed by our Cybersecurity VP under the supervision of the risk committee. The Audit Committee of the board of directors provides additional oversight as needed. Our risk committee is comprised of the Chief Financial Officer, Commerce President, Fintech President and the Heads of Corporate Affairs, Risk & Compliance, Data Privacy, Information Security, AML & Sanctions, Legal & Government Relations, Commerce Product Development, Fintech Product Development and IT Infrastructure. The primary purpose of the risk committee is to assist management and the board, either directly or indirectly through the board’s Audit Committee, with their oversight of the Company’s financial and non-financial risks, including cybersecurity risks. Our Cybersecurity VP and certain other members of our risk committee are skilled in technology, security and/or risk and compliance. Our Cybersecurity VP is a certified information systems security professional and has considerable experience in the field of information security, fraud and prevention. As part of our cybersecurity risk management processes, our Cybersecurity VP presents security risk matters to the risk committee on an as-necessary basis and to the Audit Committee annually and on an as-necessary basis. The risk committee also meets quarterly and presents to management the status, evolution and main indicators of each principal security risk, although information security may not be deemed a risk in each particular quarter. In the event of a critical cybersecurity incident, the Company’s crisis management framework activates the cross-functional crisis management team, which, depending on the circumstances, is comprised of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Commerce President, Fintech President, Corporate Affairs Executive VP, Marketing Executive VP and the Cybersecurity VP. This group works with the incident response team to help to evaluate, contain, eradicate and, if necessary, recover from the incident. The Company’s cybersecurity processes are formally evaluated by the Cybersecurity VP on an annual basis, which includes updating the Company’s cybersecurity policy, security risk management policy and methodology, and classification of information.
Cybersecurity Risk Role of Management [Text Block] | Management The cybersecurity risk management processes described above are managed by our Cybersecurity VP under the supervision of the risk committee. The Audit Committee of the board of directors provides additional oversight as needed. Our risk committee is comprised of the Chief Financial Officer, Commerce President, Fintech President and the Heads of Corporate Affairs, Risk & Compliance, Data Privacy, Information Security, AML & Sanctions, Legal & Government Relations, Commerce Product Development, Fintech Product Development and IT Infrastructure. The primary purpose of the risk committee is to assist management and the board, either directly or indirectly through the board’s Audit Committee, with their oversight of the Company’s financial and non-financial risks, including cybersecurity risks. Our Cybersecurity VP and certain other members of our risk committee are skilled in technology, security and/or risk and compliance. Our Cybersecurity VP is a certified information systems security professional and has considerable experience in the field of information security, fraud and prevention. As part of our cybersecurity risk management processes, our Cybersecurity VP presents security risk matters to the risk committee on an as-necessary basis and to the Audit Committee annually and on an as-necessary basis. The risk committee also meets quarterly and presents to management the status, evolution and main indicators of each principal security risk, although information security may not be deemed a risk in each particular quarter. In the event of a critical cybersecurity incident, the Company’s crisis management framework activates the cross-functional crisis management team, which, depending on the circumstances, is comprised of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Commerce President, Fintech President, Corporate Affairs Executive VP, Marketing Executive VP and the Cybersecurity VP. This group works with the incident response team to help to evaluate, contain, eradicate and, if necessary, recover from the incident. The Company’s cybersecurity processes are formally evaluated by the Cybersecurity VP on an annual basis, which includes updating the Company’s cybersecurity policy, security risk management policy and methodology, and classification of information.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | As part of our cybersecurity risk management processes, our Cybersecurity VP presents security risk matters to the risk committee on an as-necessary basis and to the Audit Committee annually and on an as-necessary basis. The risk committee also meets quarterly and presents to management the status, evolution and main indicators of each principal security risk, although information security may not be deemed a risk in each particular quarter.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our Cybersecurity VP and certain other members of our risk committee are skilled in technology, security and/or risk and compliance. Our Cybersecurity VP is a certified information systems security professional and has considerable experience in the field of information security, fraud and prevention.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The cybersecurity risk management processes described above are managed by our Cybersecurity VP under the supervision of the risk committee. The Audit Committee of the board of directors provides additional oversight as needed. Our risk committee is comprised of the Chief Financial Officer, Commerce President, Fintech President and the Heads of Corporate Affairs, Risk & Compliance, Data Privacy, Information Security, AML & Sanctions, Legal & Government Relations, Commerce Product Development, Fintech Product Development and IT Infrastructure. The primary purpose of the risk committee is to assist management and the board, either directly or indirectly through the board’s Audit Committee, with their oversight of the Company’s financial and non-financial risks, including cybersecurity risks. Our Cybersecurity VP and certain other members of our risk committee are skilled in technology, security and/or risk and compliance. Our Cybersecurity VP is a certified information systems security professional and has considerable experience in the field of information security, fraud and prevention. As part of our cybersecurity risk management processes, our Cybersecurity VP presents security risk matters to the risk committee on an as-necessary basis and to the Audit Committee annually and on an as-necessary basis. The risk committee also meets quarterly and presents to management the status, evolution and main indicators of each principal security risk, although information security may not be deemed a risk in each particular quarter. In the event of a critical cybersecurity incident, the Company’s crisis management framework activates the cross-functional crisis management team, which, depending on the circumstances, is comprised of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Commerce President, Fintech President, Corporate Affairs Executive VP, Marketing Executive VP and the Cybersecurity VP. This group works with the incident response team to help to evaluate, contain, eradicate and, if necessary, recover from the incident. The Company’s cybersecurity processes are formally evaluated by the Cybersecurity VP on an annual basis, which includes updating the Company’s cybersecurity policy, security risk management policy and methodology, and classification of information.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration