How we handle your data

This Privacy Policy describes how Rpagos S.R.L ("RSends", "we", "us") collects, uses, stores, and shares personal data when you use the RSends platform, dashboard, APIs, and related services (collectively, the "Service").

1. Data Controller

The data controller responsible for your personal data is:

Rpagos S.R.L
Registered in Costa Rica, registry no. 4062001345466
San José, Costa Rica
Contact: emiliocatteddu@rsends.io

2. Data we collect

We collect the following categories of personal data:

• Account information — name, email address, phone number, business name, tax identifiers, and authentication credentials.
• Identity verification (KYC) data — government-issued ID, proof of address, ultimate beneficial ownership records, and documentation supporting source of funds.
• Transaction data — wallet addresses, transaction hashes, amounts, source and destination chains, settlement records, fees, and counterparty references.
• Technical data — IP address, device type, browser fingerprint, cookie identifiers, log files, and approximate geolocation derived from IP.
• Communications — support tickets, emails, and any correspondence you send to us.

3. Legal basis for processing

We process your personal data on the following legal bases:

• Performance of a contract — to provide the Service, process transactions, and operate your account.
• Legal obligation — to comply with anti-money-laundering (AML), counter-terrorism-financing (CTF), tax reporting, and sanctions-screening obligations.
• Legitimate interest — fraud prevention, network security, product improvement, and internal analytics.
• Consent — where required (for example, optional marketing communications), which you may withdraw at any time.

4. How we use your data

• To open, maintain, and secure your account.
• To execute and settle transactions on the supported blockchains.
• To perform KYC, sanctions screening, and ongoing AML monitoring.
• To detect, prevent, and investigate fraud and abuse.
• To provide customer support and respond to your requests.
• To comply with applicable law and respond to lawful requests from authorities.

5. Data sharing

We share personal data only with:

• Service providers — KYC vendors, blockchain analytics partners, cloud hosting providers, and email/communication tools, all bound by data-processing agreements.
• Authorities and regulators — when required by law, court order, or in response to a lawful request.
• Successors — in connection with a merger, acquisition, or sale of assets, subject to equivalent privacy protections.

We do not sell your personal data and we do not share it with advertisers.

6. International transfers

We are headquartered in Costa Rica. Personal data of users located in the European Economic Area (EEA) or the United Kingdom is transferred to Costa Rica under the European Commission's Standard Contractual Clauses (SCCs), supplemented by appropriate technical and organisational safeguards.

7. Retention

We retain personal data for the duration of your account plus five (5) years following termination, in line with our record-keeping obligations under Costa Rican AML regulations and contractual commitments. Transaction records may be retained longer where required by law.

8. Your rights

Depending on your jurisdiction, you have the following rights:

• EEA / UK users (GDPR Articles 15–22) — access, rectification, erasure, restriction of processing, data portability, objection to processing, and the right not to be subject to solely automated decisions.
• Costa Rica users (Law 8968) — the rights of access, rectification, deletion (where permitted), and revocation of consent.

To exercise these rights, contact emiliocatteddu@rsends.io. We will respond within the timeframes required by applicable law. Some rights may be limited where we are required to retain data for legal or regulatory reasons (for example, AML record-keeping).

You also have the right to lodge a complaint with your local supervisory authority — in Costa Rica, the Agencia de Protección de Datos de los Habitantes (PRODHAB); in the EEA, your national data protection authority.

9. Security

We apply technical and organisational measures designed to protect your data against unauthorised access, loss, alteration, or disclosure, including encryption in transit and at rest, access controls, segregation of duties, and continuous monitoring. No system is 100% secure; we will notify you of a personal-data breach where required by law.

10. Cookies

For details about the cookies and similar technologies used on the Service, please see our Cookie Policy.

11. Children

The Service is not directed to individuals under 18. We do not knowingly collect personal data from minors.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact

Privacy enquiries: emiliocatteddu@rsends.io
Postal: Rpagos S.R.L, San José, Costa Rica.