Privacy Policy

Privacy Policy

BUYENJOY · PLATFORM LEGAL DOCUMENT

Privacy Policy

How BuyEnjoy collects, uses, and protects personal data

This Privacy Policy explains how BuyEnjoy processes personal data. Atacama Technologies LLC d/b/a BuyEnjoy acts as data Controller (Responsable) and its local operating entity as Processor (Encargado); identity-verification provider Argos acts as a Processor. This allocation reflects the operational structure verified for the Platform.

I. Data We Collect

Identity and contact data: name, email, phone, government ID, and, for KYC, a selfie/biometric template captured by Argos.

Business-verification (KYB) data, for entity accounts: corporate-registry records, ultimate-beneficial-owner personal data (name, date of birth, nationality, identification numbers, ownership percentage, address), authorized-signatory data, and screening results (sanctions, politically-exposed-person, and adverse-media outcomes). Screening results may reveal sanctions or criminal status and are treated as sensitive personal information with heightened safeguards and data minimization.

Transaction data: property interest, showings, offers, source-of-funds declarations, and payment metadata.

Financial-rail data processed by Bridge for on/off-ramp and sanctions screening.

Technical data: device, IP address, analytics events (PostHog), and error telemetry (Sentry).

Residence data: country and, for U.S. users, state of residence, collected to apply AML/FATF jurisdiction rules and geographic eligibility.

II. Purposes and Legal Bases

We process data to operate the platform, verify identity and business ownership, comply with AML/KYC, KYB, and sanctions obligations, enforce geographic restrictions, process payments, prevent fraud, and meet legal duties.

Legal bases include: (a) performance of a contract (Art. 6(1)(b) GDPR); (b) compliance with a legal obligation, including AML/FATF and OFAC sanctions screening (Art. 6(1)(c)); (c) your documented express consent for biometric/sensitive data (Art. 6(1)(a) and Art. 9(2)(a)); and (d) our legitimate interest in securing the Platform and preventing financial crime (Art. 6(1)(f)).

III. How We Share Data

We share data with processors strictly to provide the service: Argos (identity, business verification, and screening, under a data-processing agreement covering all categories above), Bridge (financial rails and OFAC screening), Stripe and PayPal (payments), Twilio/SendGrid/Resend (communications), and hosting/analytics providers. Processors are bound to our documented instructions, to purpose limitation, and to service-provider terms consistent with the CCPA/CPRA. We disclose data to notaries and counterparties only as needed to complete a transaction, and to authorities where legally required. BuyEnjoy does not sell or share personal data for cross-context behavioral advertising.

Mobile information and text messages. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. This excludes only the processors that deliver the messages on our behalf (Twilio), which may use the data solely to send them.

What the notary receives, and what it does not. The notary bound to a transaction receives the identity and residence data it needs to execute the deed and to meet its own anti-money-laundering duties, and the fact that identity verification was completed and its outcome. The notary does not receive the verification provider's own report, its internal scoring, or the biometric template; those remain with BuyEnjoy and the provider under the data-processing agreement between them.

IV. International Transfers

Operating the Platform involves transferring data to the United States and other countries. Transfers are governed by applicable cross-border data-transfer law. We apply appropriate safeguards, including standard contractual clauses where required, and honor any registration or notification duty of the origin country.

IV-bis. Images of Providers and Listed Property

Two consents govern images, and they are deliberately separate.

A Brand Asset Licence covers a service provider’s logo, company name and brand materials, shown on the provider profile, in the service directory, in quotes and invoices sent to clients, and in platform marketing. It is a licence over company property and it ends when the provider profile is deactivated.

A Portrait and Likeness Consent covers a photograph or otherwise recognisable image of a person. Because that is personal data and not company property, the consent is explicit, specific and revocable: you may withdraw it at any time and we will remove the image, and withdrawal does not affect your provider status, your logo, or your account.

Photographs of listed property are governed by the content licence in the Terms of Service. Where an identifiable person appears in that material, the Portrait and Likeness Consent applies to that person as well.

V. Your Rights

Subject to applicable law, you may access, rectify, delete, and object to or restrict processing of your data, and request portability. California residents have CCPA/CPRA rights, including to know, delete, correct, limit use of sensitive personal information, and opt out of sale/share (BuyEnjoy does not sell personal data); residents of other U.S. states with comprehensive privacy laws have the equivalent rights those laws provide. To exercise rights, contact privacy@buyenjoy.io. We respond within the timeframes required by applicable law, and provide a documented process for challenging screening false-positives and correcting derived data. Security-incident notifications are issued within the period required by applicable local law.

VI. Retention and Security

We retain personal and AML/KYB records for the periods required by law — seven (7) years for AML records — and delete or anonymize data thereafter. Where an erasure request conflicts with a retention duty, we retain only what the legal obligation requires, on that legal basis, and document the reconciliation. We apply administrative, technical, and physical safeguards, with heightened controls and impact assessment for biometric and screening data.

Incident notification. Where a personal-data breach occurs, BuyEnjoy notifies the affected users and the competent supervisory authority within twenty-four (24) hours of becoming aware of it, stating what happened, what data was involved and what is being done, and follows up as the investigation develops. Twenty-four hours is BuyEnjoy's own commitment and applies even where local law allows longer.

VII. Additional Rights for EU / EEA Residents (GDPR)

If you are a resident of a European Union member state or a European Economic Area country (EU/EEA), the General Data Protection Regulation (GDPR) applies to the processing of your personal data by Atacama Technologies LLC d/b/a BuyEnjoy as Controller.

Information at collection (Art. 13): Controller: Atacama Technologies LLC d/b/a BuyEnjoy, legal@buyenjoy.io. Purposes and legal bases are set out in Section II. You may lodge a complaint with the supervisory authority of your member state at any time.

Your GDPR rights (Arts. 15–22): access; rectification; erasure ("right to be forgotten"), subject to the AML retention reconciliation in Section VI; restriction; portability in a machine-readable format; objection to legitimate-interest processing; and the right not to be subject to solely automated decision-making with legal or similarly significant effects — adverse screening outcomes are always adjudicated by a human.

Biometric data (Art. 9): biometric data used to identify you is special-category data, processed solely on your explicit, documented consent (Art. 9(2)(a)), preceded by a data-protection impact assessment. You may withdraw consent at any time; withdrawal does not affect prior lawful processing.

International transfers: EU personal data processed in the United States is protected by standard contractual clauses and supplementary measures.

EU Representative: BuyEnjoy does not have a designated EU representative at this time. The Platform does not specifically target EU residents through dedicated advertising; it serves EU residents who voluntarily access the global Platform. We will appoint an EU representative if and when required.

Exercising rights: contact privacy@buyenjoy.io. We respond within 30 days (extendable by two months for complex requests). If unsatisfied, you may complain to your national supervisory authority (list: edpb.europa.eu).

VIII. Data Protection Registration and Contact

Where required by local law, BuyEnjoy maintains a documented processing protocol and registers it with the applicable data-protection authority of each operating country. Data-protection contact: privacy@buyenjoy.io.

ACCEPTANCE

User / Account Holder (in-app consent record with evidence capture)