Privacy Policy
This Policy explains what personal data we process when you use the Recargas Ya mobile application and its associated web panel, for what purposes, who we share it with, and what rights you have over it.
1. Data controller
Controller: [LEGAL NAME]
Tax ID: [RUT]
Address: [ADDRESS], Uruguay
Privacy contact: [PRIVACY EMAIL]
Processing is governed by Law No. 18,331 on the Protection of Personal Data and Habeas Data Action of the Eastern Republic of Uruguay and its implementing regulations, under the supervision of the Personal Data Regulatory and Control Unit (URCDP).
2. Who this applies to
Recargas Ya is a professional-use platform. The individuals whose data we process are:
- Resellers: users who order top-ups, data packs, promotions and remittances.
- Providers: users who operationally fulfil those orders.
- Administrators: authorised platform staff.
- Beneficiaries: recipients of a top-up or a remittance, whose data is entered by a reseller. See section 4.
3. Data we process
| Category | Specific data | Source |
|---|---|---|
| Account data | Username, email address, password (stored hashed, never in plain text), role and account status. | Provided by you or by the administrator who creates the account. |
| Profile data | First name, last name, phone number and country. | Provided by you. |
| Beneficiary data | First name, last name, phone number, card number and, where applicable, identity document of the person receiving a remittance. | Entered by the reseller placing the order. |
| Transaction data | Destination phone number, recipient name, amounts, currencies, exchange rates applied, commissions, status and timestamps of each order, and the related balance movements. | Generated through your use of the service. |
| Receipts | Images you upload from your device camera or photo library as proof of a transaction. | Provided by you, after granting the corresponding permission. |
| Technical and audit data | IP address, browser or app identifier (user agent), method and path of each request, response code, date and time, and the request payload — from which passwords are always excluded. | Automatically recorded for security and traceability. |
What we do NOT process
We do not collect location data, your contact list, biometric data, or special categories of data (health, political opinions, religion, trade union membership, ethnic origin, sex life). We use no third-party analytics, we do not advertise, we do not build commercial profiles, and we neither sell nor share data with third parties for advertising purposes.
4. Third-party data: beneficiaries
When you enter a beneficiary's details, you are supplying personal data about someone who is not a user of the platform. By doing so, you represent that you have that person's authorisation to provide us with their data for the purpose of carrying out the transaction, and you accept responsibility for the accuracy and lawfulness of that information.
That data is used solely to execute and evidence the requested transaction. Transaction records are kept immutably as proof of what was executed, even if you later delete the beneficiary from your saved contacts.
5. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing your account; authenticating you. | Performance of the contract. |
| Processing top-ups, data packs, promotions and remittances; maintaining balances and commissions. | Performance of the contract. |
| Informing you of the status of your transactions and answering your enquiries. | Performance of the contract. |
| Preventing fraud, misuse and money laundering; keeping accounting and transaction records. | Compliance with legal obligations. |
| Maintaining platform security and auditing access. | Legitimate interest in the security of the service. |
| Accessing your device camera or photo library to attach receipts. | Your consent, revocable in your device settings. |
6. Who we share data with
We do not sell personal data. We share it only with those necessary to provide the service:
- QvaPay — payment platform used to execute remittance operations to Cuba. It receives the minimum data needed to complete the transaction.
- Platform providers — individuals who fulfil an order and who access only the data strictly required to complete it (for example, destination phone number or beneficiary details).
- Amazon Web Services (AWS) — hosting and file storage infrastructure, in the us-east-1 (United States) region.
- Better Stack — technical log management service for diagnostics and monitoring.
- Competent authorities — where there is a legal obligation or a valid request.
The services we query for exchange rates (Central Bank of Uruguay and elToque) receive no personal data: they only return quotes.
7. International transfers
Given the nature of the service, your data is processed outside Uruguay:
- Infrastructure is hosted in the United States (AWS, us-east-1 region).
- Beneficiary and remittance transaction data is transmitted to Cuba, to the extent strictly necessary to execute the transfer.
These transfers are made because they are necessary for the performance of the contract you request, as provided for in article 23 of Law No. 18,331.
8. How long we keep data
- Account and profile data: for as long as the account is active.
- Transaction records, balance movements and receipts: for the period required by Uruguayan accounting, tax and anti-money-laundering rules, which is no less than five (5) years from the transaction. This period applies even if you close your account.
- Technical and audit logs: [PERIOD — suggested: 12 months].
Once these periods expire, data is deleted or irreversibly anonymised.
9. Your rights
You may exercise the following rights at any time:
- Access: to know what data of yours we process.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to request deletion, subject to the statutory retention periods in section 8.
- Objection and restriction: to object to a given processing activity or ask that it be restricted.
- Portability: to receive your data in a structured, commonly used format.
- Withdrawal of consent: where processing is based on it, without affecting the lawfulness of prior processing.
To exercise them, write to [PRIVACY EMAIL] stating your username and the right you wish to exercise. We will respond within the statutory deadlines. To delete your account, follow the procedure described in Account deletion.
If you believe your rights have not been honoured, you may lodge a complaint with Uruguay's Personal Data Regulatory and Control Unit (URCDP).
10. Security
We apply technical and organisational measures to protect your data:
- Encryption in transit via HTTPS/TLS for all communications.
- Passwords stored using a hash function; never in plain text and never written to logs.
- Database encrypted at rest, not publicly exposed to the internet, with backups.
- Role-based access control: each user accesses only the data their role requires.
- Audit logging of operations performed on the platform.
No system is completely infallible. Should a security breach affecting your personal data occur, we will notify you and report it to the supervisory authority as required by law.
11. Cookies and similar technologies
The web panel uses strictly necessary cookies only, to keep your session securely signed in. We use no analytics, advertising or tracking cookies, whether first- or third-party. The mobile app uses no advertising identifiers.
12. Minors
The service is intended exclusively for people aged 18 or over. We do not knowingly collect data from minors. If we identify an account created by a minor, we will close it.
13. Changes to this Policy
We may update this Policy. If a change is material, we will notify you through the app or by email before it takes effect. The last update date appears at the top of this document.
14. Contact
Privacy enquiries: [PRIVACY EMAIL] — [LEGAL NAME], [ADDRESS], Uruguay.