Legal document

Privacy notice

Last updated: September 14, 2026 · Draft pending formal legal review.

I. Identity and address of the data controller

GACO SAS de CV ("CashLessTap", "the Controller"), with address at Boulevard del Hipódromo 674, Colonia San Benito, San Salvador, El Salvador, CP 01101, is responsible for the processing of the personal data described in this Privacy Notice.

Contact for the person in charge of personal data: contacto@cashlesstap.com.

II. Personal data we collect

Depending on the role you have when interacting with the platform, we may collect:

From event attendees

• Name and, when the event Organizer requires it to register your wristband or tag, an ID document number.
• The physical identifier of your NFC wristband or tag and its history of association with your registration (linking, blocking, replacement).
• Loaded balance and its movement history: top-ups, purchases, refunds, and voids tied to your tag within the event.
• If you contact us to recover balance or for support: the data you yourself provide in that contact (name, email, message).

From point-of-sale operators (mobile app)

An operator is an Organizer's staff member who uses the mobile point-of-sale app during an event (not an attendee). Their personal data is of a different nature than an attendee's, which is why it's detailed separately:

• Your operator account data: username, password, and role assigned by the Organizer. This account does not require your email address; a supervisor typically hands it to you before your shift.
• Your device's position (GPS). While your shift is open, the app reports your point of sale's location every 5 minutes. It's kept until the event is settled, with a 7-day cap after closing, and is only seen by the Organizer's staff who have permission to manage that event's devices. Granting this permission is optional: declining it never prevents you from logging in, selling, or processing top-ups.
• Your device's technical status while the shift is open: battery level and the number of transactions pending sync, so we can support you if your device loses connection.
• The transactions you process during your shift —amount, items sold, and payment method when applicable— tied to your operator identity, as part of the event's sales record.
• The identifier of the device (POS) you operate from, for hardware inventory control and access revocation when a device is retired.
• If the app crashes unexpectedly during your shift, an internal technical record of the error (error code, where in the app it happened, and the app version) for technical diagnosis. This record never includes your username, your password, or the detail of any transaction or personal data of yours or an attendee's.

From administrative staff (web panel)

• Account data (email address, assigned role) and audit logs of the administrative actions performed from the panel.

From any visitor to this site

• The data you voluntarily submit through the contact form (name, email, organization, message).
• If your browser reports a technical error on this site, we automatically record the error type, the page where it happened, and a truncated IP address (with its last segment removed) — never the full error message or anything you typed into a form.

We do not collect sensitive financial data (for example, full card numbers) through this website; payment processing, when applicable, happens at the event's top-up points under those devices' own controls, not through this site.

III. What we use your data for

Your personal data is used for the following purposes, necessary for the relationship you have with us:

• Operating your wristband or tag within the event: registering and updating your balance, processing top-ups and purchases, and keeping a history of those operations.
• Verifying your identity when you report a lost or stolen tag, or request the return of remaining balance.
• Following up on requests submitted through the contact form.
• Complying with legal and tax obligations applicable to operating the platform.
• If you are a point-of-sale operator: identifying you against the transactions you process, providing technical support for your device during your shift, and — through the position reported while the shift is open — locating your point of sale within the event and detecting operational anomalies.

Today we do not use your personal data for secondary purposes (for example, marketing for future events): all the processing described above is necessary for the relationship you have with us. If in the future we wanted to use your data for an additional purpose that is not necessary for that relationship, we will update this notice and ask for your express consent before doing so — never before asking.

IV. How long we keep your data

We keep your personal data for as long as an active relationship exists with you (for example, while your tag has balance or is valid within an ongoing event), and afterward for as long as necessary to handle balance refund requests, respond to requirements from a competent authority, or comply with legal and tax obligations applicable to operating the platform. Once those periods elapse, or when no purpose justifying retention remains, the data is deleted or anonymized.

Your device's position, if you are a point-of-sale operator, follows a shorter, more specific rule: it is kept only while the event is under way, and is deleted as soon as the event is settled, with a 7-day cap after closing in case settlement is delayed.

V. Who we share your data with

Your data may be shared with:

• The Organizer of the event you take part in, regarding the data strictly necessary to operate your tag during that event (their administrative platform reuses the same data services, with its own access controls).
• If you are a point-of-sale operator: the Organizer's staff who have been assigned the permission to manage that event's devices see your device's position and status while your shift is open — a permission not every role in the Organizer's panel is assigned.
• Technology infrastructure providers (for example, cloud hosting) that process data on our behalf under contractual confidentiality obligations, and not for their own purposes.
• Competent authorities, when a valid legal requirement exists.

We do not sell your personal data to third parties. Any transfer other than those above will require your express consent.

VI. Your rights over your data

You have the right to:

• Access the personal data we process about you and the details of that processing.
• Rectify it when it is inaccurate or incomplete.
• Request its cancellation or deletion when you consider it is no longer required for any of the purposes stated in this notice.
• Object to the processing of your data for specific purposes.

To exercise any of these rights, send your request to contacto@cashlesstap.com or through our contact form, stating: your full name, the right you wish to exercise, a clear description of the personal data involved, and some means that lets us verify the request comes from you. We will respond within a reasonable time.

VII. Withdrawing consent

You may withdraw any consent you have given us for the processing of your personal data, following the same procedure described in the previous section. Keep in mind that withdrawing consent for data necessary to operate your tag during an ongoing event may mean we can no longer provide that service to you during the event.

VIII. How we protect your data

We apply administrative, technical, and physical security measures aimed at protecting your personal data, including: encryption of information in transit and at rest, two-factor authentication for staff with administrative access to the platform, and audit logging of relevant administrative actions. These are security practices we apply; they do not imply nor do we claim to hold a third-party-audited compliance certification (for example, we do not claim PCI compliance), and no system is entirely invulnerable.

IX. Underage attendees

All operations on the platform (registering a tag, top-ups, purchases) must be carried out by adults. If an event Organizer allows minors to attend, any operation on the tag associated with a minor must be carried out by the adult responsible for their care, and the personal data processed in that context is understood to have been provided and managed by that adult.

X. Changes to this notice

We may modify this Privacy Notice to reflect changes in our data processing practices or in applicable law. We will publish any update on this same page, indicating the date of the last modification.