Privacy Policy

The controller of your personal data is CargaExchange, based in Panama City, Republic of Panama. For privacy matters you can write to info@cargaexchange.com or contact us by WhatsApp at +507 6726-2328.

Data you provide to us

• Account data: name or company name, email, phone/WhatsApp and, for companies, RUC and verification data.
• Listing data: content, photos, location (province/district), price, and conditions you post as a seller.
• Contact data: messages and inquiries you send to sellers or to the team via form, WhatsApp, or phone.

Data we collect automatically

• Technical data: IP address, device and browser type, pages viewed, and date/time.
• Cookies and similar technologies (see the Cookie Policy).

• Operate the marketplace: create accounts, post and display listings, and enable contact between buyer and seller.
• Moderate and provide security: review listings, prevent fraud and abuse.
• Communicate with you: respond to inquiries and send service-related notices.
• Improve the Platform: statistical and usage analysis on an aggregate basis.
• Comply with legal obligations and respond to requests from competent authorities.

We process your data based on: your consent; the performance of the relationship arising from use of the Platform; compliance with legal obligations; and our legitimate interest in operating and securing the service, in accordance with Law 81 of 2019 and its Decree 285 of 2021.

We do not sell your personal data. We may share it with providers that deliver services to us and with authorities when the law requires it:

• WhatsApp / Meta Platforms, Inc.: we use the WhatsApp Business API (Meta Cloud API) to send verification codes (OTP) and, if you choose to make contact by WhatsApp, to enable that contact. When you contact a seller by WhatsApp, your number and message become visible to that seller, and the exchange is also governed by Meta's policies.
• PostHog: site usage analytics. It is only loaded and receives data if you accept analytics cookies; if you decline, it is not activated. See the Cookie Policy.
• Supabase: database, authentication, and storage of account and listing data, on our behalf.
• Vercel: hosting and delivery (CDN) of the web application.
• Resend: sending transactional emails (account verification and service notices).
• Competent authorities (e.g. ACODECO, ANTAI, judicial bodies) where there is a legal obligation.

Important: when you contact a seller, the data you provide to them (name, phone, message) is processed by that seller as an independent controller. CargaExchange does not control how the seller uses that information.

Several of our providers process data on servers located outside Panama (for example, in the United States): Meta (WhatsApp), PostHog, Supabase, Vercel, and Resend. In those cases we seek to ensure that appropriate safeguards are in place for the international transfer in accordance with Law 81 of 2019 and its Executive Decree 285 of 2021.

We retain data for as long as you keep your account or as it remains necessary for the purposes described, and afterward for the periods required by law or to handle claims. It is then deleted or anonymized.

Under Law 81 of 2019 you have the right to:

• Access: know what data of yours we process, its origin, and its purpose.
• Rectification: correct inaccurate, incomplete, or outdated data.
• Cancellation / deletion: request the deletion of your data where applicable.
• Objection: object on justified grounds to certain processing.
• Portability: obtain a copy of your data in a structured format.

To exercise them, write to us at info@cargaexchange.com with your request and a means to verify your identity. Under Executive Decree 285 of 2021, we will respond to access requests within ten (10) business days and to rectification, cancellation, or objection requests within five (5) business days from receipt. If you are not satisfied with the response, you may contact the National Authority for Transparency and Access to Information (ANTAI), the entity responsible for overseeing Law 81 of 2019.

We apply reasonable technical and organizational measures to protect your data (access control, encryption in transit, and segregation of sensitive data). No system is infallible; we ask you to safeguard your credentials and not to share unnecessary sensitive data in messages to sellers.

The Platform is intended for persons with the legal capacity to enter into contracts. We do not knowingly collect data from minors without the authorization of their legal representative.

We may update this Policy due to legal or service changes. We will post the current version on this page with its update date.