Legal document

Privacy notice

In force from: October 17, 2026

I. Identity and address of the data controller

GACO SAS de CV ("CashLessTap", "the Controller"), with address at Boulevard del Hipódromo 674, Colonia San Benito, San Salvador, El Salvador, CP 01101, is responsible for the processing of the personal data described in this Privacy Notice.

Contact for the person in charge of personal data: contacto@cashlesstap.com.

II. Personal data we collect

Depending on the role you have when interacting with the platform, we may collect:

From event attendees

• Name and, when the event Organizer requires it to register your wristband or tag, an ID document number.
• The physical identifier of your NFC wristband or tag and its history of association with your registration (linking, blocking, replacement).
• Loaded balance and its movement history: top-ups, purchases, refunds, and voids tied to your tag within the event.
• If you contact us to recover balance or for support: the data you yourself provide in that contact (name, email, message).
• Your email address and/or phone number, if you give them when registering your tag, to send you service notices and the Portal access code.
• A record of your communications: which notice was sent, through which channel, when, its delivery status (sent, delivered, read or failed), your consent to receive WhatsApp (date, Terms version, device and registering operator) and, if applicable, your opt-out.

From point-of-sale operators (mobile app)

An operator is an Organizer's staff member who uses the mobile point-of-sale app during an event (not an attendee). Their personal data is of a different nature than an attendee's, which is why it's detailed separately:

• Your operator account data: username, password, and role assigned by the Organizer. This account does not require your email address; a supervisor typically hands it to you before your shift.
• Your device's position (GPS). While your shift is open, the app reports your point of sale's location every 5 minutes. It's kept until the event is settled, with a 7-day cap after closing, and is only seen by the Organizer's staff who have permission to manage that event's devices. Granting this permission is optional: declining it never prevents you from logging in, selling, or processing top-ups.
• Your device's technical status while the shift is open: battery level and the number of transactions pending sync, so we can support you if your device loses connection.
• The transactions you process during your shift —amount, items sold, and payment method when applicable— tied to your operator identity, as part of the event's sales record.
• The identifier of the device (POS) you operate from, for hardware inventory control and access revocation when a device is retired.
• If the app crashes unexpectedly during your shift, an internal technical record of the error (error code, where in the app it happened, and the app version) for technical diagnosis. This record never includes your username, your password, or the detail of any transaction or personal data of yours or an attendee's.

From administrative staff (web panel)

• Account data (email address, assigned role) and audit logs of the administrative actions performed from the panel.

From any visitor to this site

• The data you voluntarily submit through the contact form (name, email, organization, message).
• If your browser reports a technical error on this site, we automatically record the error type, the page where it happened, and a truncated IP address (with its last segment removed) — never the full error message or anything you typed into a form.

We do not collect sensitive financial data (for example, full card numbers) through this website; payment processing, when applicable, happens at the event's top-up points under those devices' own controls, not through this site.

III. What we use your data for

Your personal data is used for the following purposes, necessary for the relationship you have with us:

• Operating your wristband or tag within the event: registering and updating your balance, processing top-ups and purchases, and keeping a history of those operations.
• Verifying your identity when you report a lost or stolen tag, or request the return of remaining balance.
• Following up on requests submitted through the contact form.
• Complying with legal and tax obligations applicable to operating the platform.
• If you are a point-of-sale operator: identifying you against the transactions you process, providing technical support for your device during your shift, and — through the position reported while the shift is open — locating your point of sale within the event and detecting operational anomalies.
• Sending you service notices by WhatsApp or email (Portal access code, welcome, top-up and purchase receipts, remaining balance and refund confirmation), and proving that you consented to receive them.

Today we do not use your personal data for secondary purposes (for example, marketing for future events): all the processing described above is necessary for the relationship you have with us. If in the future we wanted to use your data for an additional purpose that is not necessary for that relationship, we will update this notice and ask for your express consent before doing so — never before asking. The WhatsApp messages we send are service notices only; we do not use your number for advertising.

IV. How long we keep your data

We keep your personal data for as long as an active relationship exists with you (for example, while your tag has balance or is valid within an ongoing event), and afterward for as long as necessary to handle balance refund requests, respond to requirements from a competent authority, or comply with legal and tax obligations applicable to operating the platform. Once those periods elapse, or when no purpose justifying retention remains, the data is deleted or anonymized.

Your device's position, if you are a point-of-sale operator, follows a shorter, more specific rule: it is kept only while the event is under way, and is deleted as soon as the event is settled, with a 7-day cap after closing in case settlement is delayed.

Your email address, your phone number, the record of your communications and the record of your consent or opt-out are kept for as long as they are necessary for the purposes described, with no predefined period; you can request their deletion at any time by writing to contacto@cashlesstap.com. If you opt out of WhatsApp, we keep the record of the opt-out so we can honor it.

V. Who we share your data with

Your data may be shared with:

• The Organizer of the event you take part in, regarding the data strictly necessary to operate your tag during that event (their administrative platform reuses the same data services, with its own access controls).
• If you are a point-of-sale operator: the Organizer's staff who have been assigned the permission to manage that event's devices see your device's position and status while your shift is open — a permission not every role in the Organizer's panel is assigned.
• Technology infrastructure providers (for example, cloud hosting) that process data on our behalf under contractual confidentiality obligations, and not for their own purposes.
• Meta Platforms, Inc. (WhatsApp), provider of the WhatsApp Business service: if you receive notices on WhatsApp we send it your phone number and the message content (for example, a receipt amount) solely to deliver it. Meta processes that data under its own terms and privacy policy and may process it outside El Salvador (including the United States). We do not control how Meta uses WhatsApp data for its own purposes.
• Postmark (ActiveCampaign, LLC), email delivery provider: if you receive notices by email we send it your email address and the message content solely to send it.
• Competent authorities, when a valid legal requirement exists.

We do not sell your personal data to third parties. Any transfer other than those above will require your express consent.

VI. Your rights over your data

You have the right to:

• Access the personal data we process about you and the details of that processing.
• Rectify it when it is inaccurate or incomplete.
• Request its cancellation or deletion when you consider it is no longer required for any of the purposes stated in this notice.
• Object to the processing of your data for specific purposes.

To exercise any of these rights, send your request to contacto@cashlesstap.com or through our contact form, stating: your full name, the right you wish to exercise, a clear description of the personal data involved, and some means that lets us verify the request comes from you. We will respond within a reasonable time.

For your contact and communications data (email, phone, notice history and consent) you have the same rights of access, rectification, erasure and objection. If you ask for erasure of your number we will stop sending you WhatsApp, but may keep the minimum record needed to prove your consent or opt-out and meet legal obligations.

VII. Withdrawing consent

You may withdraw any consent you have given us for the processing of your personal data, following the same procedure described in the previous section. Keep in mind that withdrawing consent for data necessary to operate your tag during an ongoing event may mean we can no longer provide that service to you during the event.

WhatsApp notices. We process your number to send you WhatsApp notices based on the consent you give when registering under the Terms and Conditions (section 9) and because it is necessary to provide the service you use. You may revoke it at any time by replying "BAJA" or "STOP" to any message, or by writing to contacto@cashlesstap.com. Revoking does not affect the lawfulness of earlier processing or your Balance. To re-enable, reply "ALTA".

VIII. How we protect your data

We apply administrative, technical, and physical security measures aimed at protecting your personal data, including: encryption of information in transit and at rest, two-factor authentication for staff with administrative access to the platform, and audit logging of relevant administrative actions. These are security practices we apply; they do not imply nor do we claim to hold a third-party-audited compliance certification (for example, we do not claim PCI compliance), and no system is entirely invulnerable.

IX. Underage attendees

All operations on the platform (registering a tag, top-ups, purchases) must be carried out by adults. If an event Organizer allows minors to attend, any operation on the tag associated with a minor must be carried out by the adult responsible for their care, and the personal data processed in that context is understood to have been provided and managed by that adult.

X. Changes to this notice

We may modify this Privacy Notice to reflect changes in our data processing practices or in applicable law. We will publish any update on this same page, indicating the date of the last modification.