Bocatoo Privacy Policy

1) Scope

This policy applies to the use of Bocatoo's website, app and related services (the Platform) by Users (consumers) and affiliated Businesses.

2) Responsible and contact

3) What data we process

3.1. Data you provide directly to us

• Account/profile: name, email, phone (if requested), preferences.
• Orders: order content, notes, ratings and comments.
• Customer service: messages via forms, email or chat; if needed to manage incidents, we may record or transcribe support interactions (we'll notify you).
• Billing: if you request a receipt, the tax data you indicate to us.
• Payments: we don't store complete card data; it's managed by the integrated payment processor.

3.2. Data generated with your use

• Technical/device: IP, device identifiers, operating system/browser, timestamps, URLs visited within the app (clickstream).
• Usage and preferences: browsing history on the Platform, businesses/orders, settings.
• Geolocation (optional): only if you authorize it on your device.

3.3. Third-party data (only with your authorization)

Registration/login through third-party accounts (e.g., Google): we receive the data you authorize to share. You can revoke that link whenever you want.

4) Purposes and legal bases

5) Recipients and processors

• Affiliated businesses: receive the information necessary to prepare and deliver your order.
• Payment processors: to process charges/chargebacks (e.g., Mercado Pago, MODO, Stripe or others).
• Technology providers: hosting, messaging, analytics, support and call-center, only as processors with confidentiality and security contracts.
• Authorities/third parties: when there is a legal requirement or to exercise/defend Bocatoo's rights.
• We don't sell your personal data.

6) International transfers

We may use providers located outside your country. In such case, we require adequate guarantees (standard contractual clauses or other permitted ones) and appropriate technical and organizational measures. If GDPR applies due to user location, the Regulation's mechanisms will be used for such transfers.

7) Retention periods

• While your relationship with Bocatoo lasts (active account or order/support management).
• Then, for the applicable legal periods (e.g., consumer defense, tax, fraud prevention) and only to fulfill obligations or exercise/defend claims.
• Marketing data: until you revoke your consent or expire according to our internal policies.
• Anti-fraud records linked to payment incidents: for the time necessary for their analysis and, if applicable, until the prescription of actions.
• When data is no longer necessary, we delete, anonymize or block it as appropriate.

8) Your rights

• You can exercise, free of charge, the rights of access, rectification, updating and deletion of your data, as well as opposition, limitation and portability when applicable.
• Channels: from your account (if available) or by writing to contacto@bocatoo.com.ar.
• For commercial communications, you can unsubscribe from the "Cancel subscription" link or adjusting preferences in the app.
• Control authority (AR): Public Information Access Agency (AAIP) — more info at argentina.gob.ar/aaip. You have the right to file a complaint with the AAIP if you consider your rights violated.

9) Security

We apply reasonable technical and organizational measures (encryption in transit, access controls, logs, environment segregation). Even so, no system is infallible. If you detect or suspect an incident, write to us at contacto@bocatoo.com.ar.

10) Cookies and similar technologies

We use our own and third-party cookies to operate the Platform, remember preferences, obtain metrics and, with your consent, advertising purposes. Details and controls in the Cookie Policy available in the app.

11) Minors

Services are not directed to minors under 18 years of age for restricted operations (e.g., alcohol). If we discover data from minors without proper legal basis, we will delete it.

12) Changes to this policy

We may update this policy to reflect legal or operational changes. We will publish the current version with its date. If changes are substantial, we will notify you by reasonable means. Continued use implies acceptance.

Annex A — Payment processing (summary)

• Card data entry is done directly with the payment processor; Bocatoo does not store complete card data.
• Chargebacks and refunds are processed according to the processor's policies and applicable regulations.
• In case of an erroneous charge in digital payments, write to us within 48 h with evidence (order no., amount, date/time, screenshots) to contacto@bocatoo.com.ar. This internal deadline does not limit your legal rights.

Annex B — Personnel selection (if applicable)

If you send your CV or participate in selection processes: we will process the data to evaluate your candidacy, conduct interviews and tests. We will keep the information for up to 24 months for future opportunities, unless you request its deletion before. You can exercise rights by writing to contacto@bocatoo.com.ar.