Privacy Policy

Privacy Policy

BUYENJOY · PLATFORM LEGAL DOCUMENT

Privacy Policy

How BuyEnjoy collects, uses, and protects personal data

This Privacy Policy explains how BuyEnjoy processes personal data. Atacama Technologies LLC d/b/a BuyEnjoy is the sole data Controller (Responsable) in every country, Costa Rica and Ecuador included; no other company processes your data as controller or on BuyEnjoy’s behalf. Identity-verification provider Argos acts as a Processor (Encargado). This allocation reflects the operational structure verified for the Platform.

I. Data We Collect

Identity and contact data: name, email, phone, government ID, and, for KYC, a selfie/biometric template captured by Argos.

Biometric residence rule. Biometric identifiers are collected only as permitted under the Biometric Data Consent (document 22). Residence in Illinois, Texas or Washington is determined from the residence you declare; residents of those states are always shown the biometric notice and asked for the written release before any capture.

Business-verification (KYB) data, for entity accounts: corporate-registry records, ultimate-beneficial-owner personal data (name, date of birth, nationality, identification numbers, ownership percentage, address), authorized-signatory data, and screening results (sanctions, politically-exposed-person, and adverse-media outcomes). Screening results may reveal sanctions or criminal status and are treated as sensitive personal information with heightened safeguards and data minimization.

Transaction data: property interest, showings, offers, source-of-funds declarations, and payment metadata.

Financial-rail data processed by the independent escrow agents that hold and disburse transaction funds — for a Buyer resident in the United States, a U.S. escrow holder licensed or exempt for that purpose, and in every case the trust or escrow holder in the property's country — and by our payment processors.

Technical data: device, IP address, analytics events (PostHog and Google Analytics), and error telemetry (Sentry). Only if you allow it: a recording of your session on the site, with all text and fields masked (PostHog), and Meta Pixel and Google Ads advertising identifiers and events. Session recording never runs on identity-verification, payment, bank-detail, transaction-document, signing or messaging screens.

Residence data: country and, for U.S. users, state of residence, collected to apply AML/FATF jurisdiction rules and geographic eligibility.

II. Purposes and Legal Bases

We process data to operate the platform, verify identity and business ownership, comply with AML/KYC, KYB, and sanctions obligations, enforce geographic restrictions, process payments, prevent fraud, meet legal duties and, only with your consent, measure our campaigns and show you BuyEnjoy advertising.

Legal bases include: (a) performance of a contract (Art. 6(1)(b) GDPR); (b) compliance with a legal obligation, including AML/FATF and OFAC sanctions screening (Art. 6(1)(c)); (c) your documented express consent for biometric/sensitive data (Art. 6(1)(a) and Art. 9(2)(a)); (d) our legitimate interest in securing the Platform and preventing financial crime (Art. 6(1)(f)); and (e) your consent to non-essential analytics, session recording and advertising (Art. 6(1)(a) and applicable e-privacy law), which you may withdraw at any time in “Privacy choices”.

III. How We Share Data

We share data with processors strictly to provide the service: Argos (identity, business verification, and screening, under a data-processing agreement covering all categories above), the independent escrow agents that hold and disburse transaction funds (as needed to open, fund and disburse the transaction), Stripe and PayPal (payments), Twilio/SendGrid/Resend (communications); WhatsApp, operated by Meta Platforms, only as a channel for the account and transaction alerts you opted into, which receives your number and the text of each alert; Cloudflare (Turnstile, to protect forms from automated abuse) and Upstash (rate limiting); OpenAI, only for the catalog assistant and automatic translation, with the text you type or ask to translate and never with identity documents, biometric data or account numbers; and hosting and analytics providers (Vercel, Supabase, PostHog and Sentry). Processors are bound to our documented instructions, to purpose limitation, and to service-provider terms consistent with the CCPA/CPRA. We disclose data to notaries and counterparties only as needed to complete a transaction, and to authorities where legally required. Apart from the advertising described below, which runs only with your consent, BuyEnjoy does not sell or share personal data.

Mobile information and text messages. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. This excludes only the processors that deliver the messages on our behalf (Twilio), which may use the data solely to send them.

Advertising and campaign measurement. If you accept marketing cookies, the site loads the Meta Pixel and Google Ads tags, and Meta Platforms and Google receive identifiers from your browser, the pages you visit and events such as signing up or requesting a showing, so that we can measure our campaigns and show you BuyEnjoy ads. Meta and Google also process that data under their own policies. Under some U.S. state laws this may be treated as “sharing” personal data for targeted advertising or as a “sale”: we do not do it without your consent, we treat the Global Privacy Control signal as an opt-out, and you may withdraw consent at any time in “Privacy choices” (buyenjoy.io/privacy-choices), linked at the foot of every page. We never use your identity, biometric, financial, tax or transaction data, or your session recording, for advertising.

What the notary receives, and what it does not. The notary bound to a transaction receives the identity and residence data it needs to execute the deed and to meet its own anti-money-laundering duties, and the fact that identity verification was completed and its outcome. The notary assigned to your transaction receives the identity-verification report, including the images of your identity document (front and back) and of your selfie, which BuyEnjoy retrieves from the provider at the moment of download and does not keep, where you have given the express consent in the Biometric Data Consent (document 22), so that it can execute the deed, meet its own anti-money-laundering duties and keep its notarial reference archive; every download is logged. It does not receive the verification provider's internal scoring or any biometric template.

IV. International Transfers

Operating the Platform involves transferring data to the United States and other countries. Transfers are governed by applicable cross-border data-transfer law. We apply appropriate safeguards, including standard contractual clauses where required, and honor any registration or notification duty of the origin country. For personal data received from the European Union, the United Kingdom and Switzerland, Atacama Technologies LLC participates in the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework (Section VII-bis).

Our identity-verification provider, ARGOS Identity, keeps verification data on Amazon Web Services servers in the United States. Its personnel in the Republic of Korea may access that data remotely, solely for the verification purpose. That remote access is an international data transfer: we disclose it at collection, it is governed by the safeguards in this Section, and the data is not stored in Korea.

IV-bis. Images of Providers and Listed Property

Two consents govern images, and they are deliberately separate.

A Brand Asset Licence covers a service provider’s logo, company name and brand materials, shown on the provider profile, in the service directory, in quotes and invoices sent to clients, and in platform marketing. It is a licence over company property and it ends when the provider profile is deactivated.

A Portrait and Likeness Consent covers a photograph or otherwise recognisable image of a person. Because that is personal data and not company property, the consent is explicit, specific and revocable: you may withdraw it at any time and we will remove the image, and withdrawal does not affect your provider status, your logo, or your account.

Photographs of listed property are governed by the content licence in the Terms of Service. Where an identifiable person appears in that material, the Portrait and Likeness Consent applies to that person as well.

V. Your Rights

Subject to applicable law, you may access, rectify, delete, and object to or restrict processing of your data, and request portability. California residents have CCPA/CPRA rights, including to know, delete, correct, limit use of sensitive personal information, and opt out of sale/share (BuyEnjoy does not sell personal data for money; the advertising described in Section III, which may qualify as “sharing”, runs only with your consent and is switched off in “Privacy choices” or by Global Privacy Control); residents of other U.S. states with comprehensive privacy laws have the equivalent rights those laws provide. To exercise rights, use the privacy option in your account Settings or write to support@buyenjoy.io. We respond within the period set by the law that applies to you (our internal target is five (5) business days), and provide a documented process for challenging screening false-positives and correcting derived data. Security-incident notifications are issued as set out in Section VI.

VI. Retention and Security

We retain personal and AML/KYB records for the periods required by law — seven (7) years from the last movement on the transaction for AML records, or ten (10) years where the property is located in Ecuador — and delete or anonymize data thereafter. Tax-form data — your taxpayer identification number, date of birth, citizenship and address — is kept for seven (7) years from the end of the year of the last payment that relied on that form; the taxpayer identification number is encrypted at field level and shown only by its last four digits. Where an erasure request conflicts with a retention duty, we retain only what the legal obligation requires, on that legal basis, and document the reconciliation. We apply administrative, technical, and physical safeguards, with heightened controls and impact assessment for biometric and screening data.

Biometric data. Your facial image (selfie), the liveness capture and any biometric template derived from them are destroyed on the earlier of (a) thirty (30) days after the verification purpose has been satisfied or you withdraw consent, and (b) three (3) years after your last interaction with BuyEnjoy. They are never retained for anti-money-laundering or other record-keeping purposes. The verification record — the comparison result, the data extracted from the identity document and the sanctions-screening result, without images — is kept separately for the period anti-money-laundering law requires, which does not extend the biometric retention above. BuyEnjoy does not keep the identity-document image: it stays with the provider and is destroyed on the same thirty (30) day schedule.

Incident notification. Where a personal-data breach occurs, BuyEnjoy notifies the affected users without undue delay, and the competent supervisory authority within the time the applicable law requires, stating what happened, what data was involved and what is being done, and follows up as the investigation develops.

VII. Additional Rights for EU / EEA Residents (GDPR)

If you are a resident of a European Union member state or a European Economic Area country (EU/EEA), the General Data Protection Regulation (GDPR) applies to the processing of your personal data by Atacama Technologies LLC d/b/a BuyEnjoy as Controller.

Information at collection (Art. 13): Controller: Atacama Technologies LLC d/b/a BuyEnjoy, support@buyenjoy.io. Purposes and legal bases are set out in Section II. You may lodge a complaint with the supervisory authority of your member state at any time.

Your GDPR rights (Arts. 15–22): access; rectification; erasure ("right to be forgotten"), subject to the AML retention reconciliation in Section VI; restriction; portability in a machine-readable format; objection to legitimate-interest processing; and the right not to be subject to solely automated decision-making with legal or similarly significant effects — adverse screening outcomes are always adjudicated by a human.

Biometric data (Art. 9): biometric data used to identify you is special-category data, processed solely on your explicit, documented consent (Art. 9(2)(a)), preceded by a data-protection impact assessment. You may withdraw consent at any time; withdrawal does not affect prior lawful processing.

International transfers: EU personal data processed in the United States is received under the EU-U.S. Data Privacy Framework (Section VII-bis) and, where that does not apply, under standard contractual clauses and supplementary measures.

EU and UK Representative: At launch the Platform does not offer purchases to EU/EEA residents and does not target them. Where BuyEnjoy processes the personal data of an EU/EEA resident, this Section applies. Because identity verification is open to residents of the EU/EEA and the United Kingdom, BuyEnjoy has appointed Prighter Group, with its local partners, as its privacy representative under Article 27 GDPR and Article 27 UK GDPR, and as your point of contact for the European Union (EU) and the United Kingdom (UK). Prighter gives you an easy way to exercise your privacy-related rights (for example, requests to access or erase personal data). If you want to contact us via our representative, Prighter, or make use of your data-subject rights, please visit https://app.prighter.com/portal/buyenjoy. BuyEnjoy communicates the contact of its Data Protection Officer to the supervisory authority of the member state where the EU representative is established.

Exercising rights: contact support@buyenjoy.io. We respond within 30 days (extendable by two months for complex requests). If unsatisfied, you may complain to your national supervisory authority (list: edpb.europa.eu).

VII-bis. EU-U.S. Data Privacy Framework, UK Extension and Swiss-U.S. Data Privacy Framework

Atacama Technologies LLC, d/b/a BuyEnjoy, complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Atacama Technologies LLC has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Atacama Technologies LLC has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Who is covered. Atacama Technologies LLC. It has no subsidiaries or other U.S. entities that adhere to the Principles.

Data received and purposes. The categories of personal data described in Section I, received from users and visitors in the EU, the UK and Switzerland, for the purposes described in Section II. We do not receive human resources data under the DPF.

Your choices. You may access the personal data we hold about you and correct, amend or delete it where it is inaccurate or has been processed in violation of the Principles. You may opt out of the disclosure of your personal data to a third party other than our agents, and of its use for a purpose materially different from the one for which it was originally collected or later authorized. Sensitive data, including biometric data, is processed or disclosed only with your affirmative express (opt-in) consent. Write to support@buyenjoy.io or use Settings.

Onward transfers. We disclose personal data to the third parties described in Section III. Our processors act as our agents under contracts that limit processing to our instructions and require at least the same level of protection the Principles require. We remain liable under the Principles if an agent processes personal data in a manner inconsistent with the Principles, unless we prove that we are not responsible for the event giving rise to the damage.

Public authorities. We may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Enforcement. The U.S. Federal Trade Commission has jurisdiction over our compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.

Complaints. In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Atacama Technologies LLC commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact our Data Protection Officer, Gabriel Morales, at support@buyenjoy.io. We respond within 45 days.

Independent recourse. In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Atacama Technologies LLC commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. These services are provided at no cost to you.

Binding arbitration. Under certain conditions, described in Annex I of the DPF Principles, you may invoke binding arbitration for a complaint not resolved by any of the other DPF mechanisms.

Verification. We verify our compliance with the Principles by self-assessment, at least once a year.

VIII. Data Protection Registration and Contact

Atacama Technologies LLC d/b/a BuyEnjoy is also the controller before PRODHAB in Costa Rica (Law 8968) and before Ecuador’s data-protection authority (LOPDP). Where required by local law, it maintains a documented processing protocol, registers it with the data-protection authority of each operating country and appoints whoever that law requires to represent it in the country. Data Protection Officer: Gabriel Morales, reachable at support@buyenjoy.io.

ACCEPTANCE

User / Account Holder (in-app consent record with evidence capture)