This policy explains what personal data wwupp.com collects, what it is used for, how long it is kept and how you can exercise your rights.
1. Controller
The data controller is [LEGAL NAME], tax ID (RUC) [TAX ID (RUC)], with registered address at [REGISTERED ADDRESS] ("wwup."). Contact for data matters: [CONTACT EMAIL].
2. What data we collect
- Registration: name, email, date of birth, phone, organization, shipping address and the version of the terms you accepted.
- Orders: products, amounts, shipping address, accepted version of the terms and the payment processor used.
- Payment result: the reference and result reported by the processor, such as the authorization number, the payment method or the card's issuing country. We neither receive nor store your card number or the IP address recorded by the processor.
- Identity document: only if the payment processor requires it. It is sent to the processor to handle the payment and we do not store it.
- Messages: the notices in your inbox and the log of the emails we send you.
- Technical data: the server logs the IP address, date and page of each visit, for security and diagnostics.
3. What we use it for and on what basis
- Reviewing your access request and verifying your age, based on what you declare when registering.
- Processing, charging, shipping and documenting your orders, because this is necessary to fulfil the purchase.
- Sending you communications about your account and orders, for the same reason.
- Meeting legal, accounting and lot-traceability obligations.
- Protecting the site and preventing fraud, based on our legitimate interest in security.
We do not use your data for advertising, we do not profile you and we do not sell your data.
4. Who we share it with
Only with those we need to provide the service: the payment processor shown at checkout (for example, Bancard or Pagopar), the carrier that ships your order, our email provider and the site's hosting provider. On the payment page, the card form is loaded from the processor's servers. We may also share data when required by a competent authority.
5. International transfers
If your order ships outside Paraguay, shipping data is shared with the carrier and the customs authorities of the destination country. Some providers may process data outside Paraguay.
6. How long we keep it
- Account: while it is active or until you ask us to delete it.
- Paid orders: for [RETENTION PERIOD], due to legal and accounting obligations. They are deleted afterwards.
- Rejected access requests: the data is deleted automatically after 90 days.
- Log of emails sent and technical payment details: 365 days.
- Server logs: 14 days.
7. Cookies and storage in your browser
The site uses a single cookie, wwupsid, required to keep you signed in; it is deleted when you close your browser. It also stores in your browser the cart and the selected country (wwup_cart and wwup_country, until you clear them) and your position when switching language (wwup_resume, until you close the tab). That data never leaves your browser. We use no analytics, advertising or third-party cookies, and fonts are served from our own server.
8. Your rights
You can request access to, correction or deletion of your data, and object to its processing where applicable.
- Download your data: from your account, under "Your data", you instantly get a file with all the information we hold about you.
- Delete your account: from the same place you can request deletion. We process it within 30 days and notify you by email. We delete your contact details, date of birth, address and messages, and the account stops working. Paid orders keep the shipping name and address for the legal period in section 6.
- Any other request: write to [CONTACT EMAIL].
If you live in the European Union, Switzerland, the United Kingdom or another jurisdiction with its own rules, you also have the rights those rules grant you, including the right to lodge a complaint with your country's data protection authority.
9. Security
The site uses an encrypted connection, passwords are stored hashed with a one-way algorithm, payment processor keys are kept outside the public site and administrative access is restricted and audited.
10. Minors
The service is only for people aged 21 or over. If we detect an account belonging to a minor, we delete it.
11. Changes
If we change this policy, we will publish the new version with its date on this page.