40Acres

Introduction

This Privacy Policy explains how we handle your personal data to provide the services offered on our website, applications, and other electronic platforms ("Site"), such as the submission of complaints, subscription to mailing lists, communications, and more (the "Services"). Our policy also explains the data we may collect when you visit the Site, as well as how we may use and share it.

Please read this policy carefully to understand our data processing practices, and if you have any questions, feel free to contact us.

If you do not provide the information marked as mandatory, we may not be able to process your user registration or provide you access to certain Services on our Site. Some benefits of our Services require the sharing of personal information. Among the personal data we may collect are your name, email address, IP address, device identifier, and more. You are solely responsible for ensuring the accuracy of the data you share with us, as maintaining false or outdated information in your user account may affect your use of the Site, the information you receive from it, and our ability to contact you.

Legal Basis for the Processing of Personal Data

The collection and processing of your personal data are primarily based on the contractual and non-contractual relationship you have with us. When we send you newsletters, allow you to use our Services, or use the email address you provided to contact you individually or recognize you when you revisit our website, this is done with your informed consent. The way we process information collected via cookies is also based on the informed consent you have provided, in accordance with applicable laws.

At 40 ACRES, S.A. DE C.V., we adhere to the regulatory compliance of the company's domicile country (El Salvador), as well as internationally to the standards set forth by the General Data Protection Regulation (GDPR). In general, we follow all current legal guidelines to ensure respect and protection for your data.

Information Collection

To access our services via the trading platform, you will need to provide personal information such as, but not limited to: email address, date of birth, country or city of residence, name, surname, and other mandatory or optional details.

In certain cases, you may also be required to submit identity verification documents, including but not limited to government-issued identification, proof of residency, or other supporting documents for KYC onboarding purposes, regulatory compliance, and fraud-prevention requirements.

When you visit or use our Services, we record data related to the frequency of use, date and time of access, and when you view or click on specific content. We may also collect information about the URLs from which you were redirected to our Site. We use this information when you log in and when you read our emails, as well as IP addresses to identify and log your use of the Site.

Data Processing

40 ACRES, S.A. DE C.V. will process your personal data for the following purposes:

To manage your registration as a user of the Site, identify you, and provide access to the Services available to registered users.
To conduct identity verification and KYC onboarding, when required by applicable laws, internal policies, or fraud-prevention standards. This may include reviewing identity documents and validating the authenticity of information you provide.
To develop, comply with, and execute the contract for the provision of our Services.
To contact you via email to update you and inform you about resources, products, or services offered, including platform security updates, as necessary and reasonable.
To respond to inquiries or requests you make through the customer service channels available on our Platform.
To generate anonymized aggregate data, such as statistics about our users, their work or areas of expertise, the number of clicks or views on a specific course or project, or their demographics.
For legitimate interests of 40 ACRES, S.A. DE C.V., such as:
- a. Managing, developing, and growing our business
- b. Operating our Site and providing our Services
- c. Selecting appropriate suppliers
- d. Conducting statistical research and analysis
- e. Marketing development
- f. Internal administration and auditing purposes

We handle your personal data based on the consent you grant by reading this policy and using the Site. If you wish to withdraw your consent, you may do so, but it may affect our ability to provide you with our Services.

Data Retention Period

Your personal data will be retained for as long as necessary to fulfill the purposes for which it was collected and processed, and under no circumstances will it exceed that period. The exact retention time will depend on the purposes for which we have collected and used the information, always considering applicable laws and respecting your data protection rights.

Data Recipients

To fulfill the purposes outlined in this Privacy Policy, it may be necessary to share or disclose your personal data to third parties for the following reasons:

Relationships with service providers: to provide services on our behalf or to help us deliver our services. For example, we hire providers to perform marketing, advertising, communication, IT infrastructure services, to personalize and improve our service, to process credit card or other payment transactions, to provide customer service, collect debts, analyze and improve data (such as user interaction data with our services), and to process and manage satisfaction surveys.
KYC and identity verification providers: If identity verification is required, your personal data and supporting documents (such as identification or address verification documents) may be shared with third-party KYC service providers who assist us in confirming your identity, preventing fraud, and complying with legal obligations.

By accepting our Privacy Policy, you explicitly authorize us to process and share your personal data with the aforementioned providers for the purposes described in this document to provide a complete service. At 40 ACRES, S.A. DE C.V., we are committed to ensuring that such providers also comply with personal data protection standards.

International Transfer of Personal Data

Your personal information may be transferred to and processed in countries other than El Salvador where our service providers are located or where our servers are located. We will take appropriate measures to ensure that such transfers comply with applicable data protection laws, and do so only when the country or territory to which the Personal Data is to be transferred (i) has bilateral or multilateral agreements related to Personal Data Protection with El Salvador or (ii) has specific legislation on personal data protection, including provisions, measures, controls, requirements, and rules for protecting the privacy and confidentiality of your Personal Data, ensuring your ability to exercise your rights, and imposing appropriate measures on the controller or processor through a supervisory or judicial authority.

However, some countries to which your Personal Data may be transferred do not benefit from an adequate data protection regulatory framework. For such countries, we will transfer your Personal Data only upon ensuring that a suitable degree of protection is afforded through the implementation of necessary safeguards, such as an adequacy decision by the relevant authority, binding corporate rules, or inclusion of standard contractual clauses in our agreements with such organizations.

We may also transfer your Personal Data to recipients outside El Salvador based on (i) your express consent; (ii) if such transfer is necessary for judicial processes; (iii) if such transfer is necessary for entering into or performing a contract between us and you or between us and a third party for your interests; (iv) if such transfer is necessary for acts relating to international judicial cooperation; or (v) if the transfer is necessary for the protection of public interest. We shall notify you regarding the specific safeguard adopted when transferring your Personal Data if you request such information in exercise of your rights as a data subject. By accepting this Privacy Policy, you provide your consent for such transfers.

If you wish to obtain specific information about the third-party service providers with whom your Personal Data has been shared, please contact us at [email protected]. If you choose to proceed with a service that requires the involvement of a third-party service provider, your Personal Data may become subject to the laws of the jurisdiction(s) in which that service provider or its facilities are located. For these providers, we recommend that you review their privacy policies to understand how your Personal Data will be handled.

Data Protection Rights

Since 40 ACRES, S.A. DE C.V. collects, uses, and stores its user's personal data, we commit to respecting the confidential nature of your data and guaranteeing the full exercise of the rights provided by applicable legislation. You have the following rights regarding your personal data:

Access and Correction: You have the right to access and correct your personal information held by us. You may update your account information directly or contact us to request access or correction.
Withdrawal of Consent: You have the right to withdraw any consent you have provided for the processing of your personal information. Withdrawing consent may affect your ability to use our services. This request does not affect the legality of processing conducted prior to the withdrawal.
Right to Erasure: You have the right to request that we delete or remove your personal information in certain circumstances, such as when we no longer need it or if you withdraw your consent (where applicable). If we have shared your personal information with others, we will inform them about the erasure where possible. If you request, and where it is possible and lawful, we will also provide information about who your personal data was shared with so that you can contact them directly.
Right to Lodge a Complaint with the Supervisory Authority: If you have any concerns about our privacy practices, including the handling of your personal information, you may report your complaint to the relevant regulatory authority.
Request Correction of Personal Data: You may request that any incomplete or inaccurate personal data we hold about you be corrected. We may need to verify the accuracy of any new information you provide.
Right to Object to Processing: You may object to the processing of your personal data in certain situations, such as when it impacts your fundamental rights and freedoms. You also have the right to object when your personal data is processed for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to continue processing your information that override your rights and freedoms.
Request Restriction of Processing: You may request that we suspend the processing of your personal data in the following cases: (i) to verify the accuracy of the data; (ii) where our processing is unlawful but you do not want us to erase it; (iii) where you need us to hold the data to establish, exercise, or defend legal claims; or (iv) where you have objected to our processing and we are verifying whether we have overriding legitimate grounds to continue.
Request Data Portability: You may request the transfer of your personal data to yourself or to a third party. We will provide your data in a structured, commonly used, machine-readable format. This right applies only to automated information you initially provided consent for us to use, or where the information was used to perform a contract with you.

Amendment

We may update this Policy from time to time by posting a revised version on our website. The revised version will be effective as of the date we post it. We encourage you to review this Policy periodically for any changes.

You must agree to the amendments as a condition of your continued use of our Platform. If you do not agree, you must immediately cease using our Platform and notify us of your refusal to agree by contacting us.

Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us by sending an email to [email protected]

By using our services, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy.