This notice explains what personal data we handle when you register with WPLO, use the app, receive our alerts or visit wplo.org: what we use it for, who we share it with, how long we keep it and how you can exercise your rights.
Version 1 · In effect from 16 November 2026
1. Who is responsible for your data
Worldwide Preventive Logistics Observatory (WPLO) · Observatorio Mundial de Logística Preventiva (OMLP), a non-profit association incorporated in the Republic of Panama. Public Registry Folio No. 25057689 · RUC 25057689-3-2024. Legal personality recognised by Resolution No. 280-PJ-280 of 14 June 2024 of Panama's Ministry of Government.
Avenida Federico Boyd and Avenida Ricardo Arango, Edificio Studio Coliving, 4th floor, apartment 436, Bella Vista, Panama City, Republic of Panama.
Questions about your data and support: support@wplo.org · Institutional contact: info@wplo.org · Phone: +507 6861 5526
2. What data we handle
2.1 When you register
On the registration form we ask for your account type; your name; your email address; your organisation's name (for government accounts, the institution's); your sector and line of business, where relevant; your country and city; and, if you choose to give them, your address and phone number. We send you a code to confirm your email address. The fields marked as required are needed to create your account and provide the service; without them we can't register you.
Payment is handled by PayPal. We never receive or store your card or PayPal account details: PayPal only tells us the status of your subscription — active, cancelled, reversed or with a failed payment — and gives us a reference to identify it.
2.2 Your account
- About you: your email address, name, language, type of access and when you last signed in. We don't store your password — only a one-way cryptographic hash of it that lets us check it.
- Your acceptance: when you accept the Terms of Use and this notice — on registering or on accepting an invitation — we record which version you accepted and when.
- About the account: the organisation's name (or yours, for a personal account), the account type, the contact name, email and phone, the countries where it operates, the places it monitors — their location, name, monitoring radius and whether they are marked as main places — and notification preferences (email, push and minimum level), including any rules the organisation sets for everyone on the account.
The places you monitor reveal where your organisation operates. We protect them as confidential business information: we don't share them with other members or with third parties.
2.3 When you use the app and receive alerts
- Sessions. We keep a record of each open session (you can have up to three). That record doesn't include your IP address or any details of your device.
- Browser push notifications. If you turn them on, we store the address your browser's notification service assigns to your device, the keys used to encrypt notifications, when you gave permission and which version of the wording you saw, and your browser and operating system.
- Push notifications in the mobile app. If you turn them on in the app, we store the push notification token your phone assigns to the app, the device's platform (Android or iOS), the app version, the technical identifier your device sends when it connects (its user-agent), and when you gave permission and which version of the wording you saw.
- Deliveries. We record which alerts we sent to you or your account, through which channel and when. For push notifications, we also record whether the alert was opened from a notification on any device on your account — the first time only. We use that to see how well the service works: no one else sees it, and it doesn't change which alerts you get.
- Your alert status. If you follow, acknowledge or dismiss an alert, we store that choice and when you made it, so it shows on all your devices and that alert's push notifications stop making a sound. No one else on your account sees it.
- Emails. Our emails are sent in HTML, with a plain-text version, and contain no tracking pixels or tracked links, so we don't know whether you open them.
- Security. We record sign-in attempts — when, and whether they succeeded — and sensitive account actions such as a password change. Our servers' technical logs may include the IP address you connect from.
- On your device. The app stores your language, your display preferences and a copy of your active alerts and of those that ended in the last 7 days, so you can see them offline. That copy is erased when you sign out. To keep you signed in, it uses a strictly necessary cookie, which is never used to track you.
2.4 When you contact us or visit wplo.org
- If you use the contact form, we receive your organisation, your name and role, your email address, the countries or ports you're interested in and your message. We use your IP address only to limit the number of submissions and stop spam.
- If you email support@wplo.org or info@wplo.org, we use your message and contact details to reply.
- The website uses no analytics, advertising or tracking cookies. Its server keeps the usual access records — IP address, date and time, page requested — for security.
2.5 What we don't do
- We don't ask for your device's location.
- We don't profile you. Which alerts you get is decided by comparing each event with your account's places and preferences — not with your behaviour — and we make no automated decisions that have legal effects on you or affect you in a similarly significant way.
- We don't sell your data or use it for advertising.
3. Why we use your data, and on what legal basis
| Purpose | Legal basis in Panama (Law 81 of 2019) | Legal basis if you are in the European Economic Area (GDPR) |
|---|---|---|
| Providing the service — registration, subscription, sign-in, alerts and preferences — if yours is a personal account | The contract you are party to (art. 6(2)) | Performance of a contract (art. 6(1)(b)) |
| The same, if you have access to an organisation's account | Your consent when accepting this notice, of which we record the version and date (art. 6(1)), and the legitimate interest of the Observatory and your organisation in giving you the access they agreed on (art. 17(7) of Executive Decree 285 of 2021) | Legitimate interests (art. 6(1)(f)) |
| Keeping the service and accounts secure | Legal obligation to keep data secure (arts. 6(3) and 7; arts. 36 to 38 of Executive Decree 285 of 2021) | Legitimate interests (art. 6(1)(f)) |
| Bookkeeping and meeting tax obligations | Legal obligation (art. 6(3)) | Legitimate interests (art. 6(1)(f)) |
| Answering your questions (contact form and email) | Your consent (art. 6(1)) | Legitimate interests (art. 6(1)(f)) |
| Handling your rights requests and keeping a record of them | Legal obligation (arts. 6(3) and 16 to 18; art. 21 of Executive Decree 285 of 2021) | Legal obligation (art. 6(1)(c), read with arts. 12 to 22) |
Where we rely on legitimate interests, our interest is to provide the service that you or your organisation signed up for, securely. You can object by emailing support@wplo.org, and we will stop using your data unless we have compelling legitimate grounds or need it to establish, exercise or defend legal claims.
4. Who we share your data with
We don't sell or hand over your data. The providers that handle data on our behalf receive only what they need to provide their service to us, and handle it under the terms of service and data protection terms that each of them sets for its customers.
| Provider | Service | Country |
|---|---|---|
| KuarcTech Solutions S.A. | Developing, running and supporting the platform | Costa Rica |
| Microsoft Corporation (Azure) | Hosting the platform, the wplo.org website, account registration and their backups | United States |
| Zoho Corporation (ZeptoMail) | Sending platform and registration emails (alerts, codes and links) | United States |
| Zoho Corporation (Zoho Mail) | Mailboxes for support@wplo.org and info@wplo.org | United States |
| Expo (Expo Application Services), by 650 Industries, Inc. | Delivering the mobile app's push notifications: it receives the device's notification token and the text of the notification, only to deliver it | United States |
| Google LLC (Firebase Cloud Messaging) | Delivering the app's push notifications to Android phones | United States |
| Apple Inc. (Apple Push Notification service) | Delivering the app's push notifications to iPhones (iOS) | United States |
Also involved:
- The push notification service of your browser's maker (for example Apple, Google, Microsoft or Mozilla). For browser notifications, they receive each notification encrypted — only your device can read it — and your device's address.
- PayPal, which handles your payment details as an independent controller under its own privacy policy.
- Public authorities, where the law requires us to disclose data to them.
To translate event headlines, we use a machine translation service (DeepSeek, based in China). It receives only the public text of the event — never any of your data.
5. International transfers
The Observatory is based in Panama and its providers are in other countries — Costa Rica and the United States — so your data is handled outside the country you're in. Under Panama's Law 81 of 2019, these transfers are needed to provide the service to you (art. 33(9)). If you are in the European Economic Area, your data is also transferred to those countries in order to provide the service that you or your organisation signed up for. You can ask us about these transfers at support@wplo.org.
6. How long we keep your data
| Data | Retention period |
|---|---|
| Account, places, preferences and alert status | While the account is active, and up to 12 months after it stops being active; then the data is deleted or anonymised |
| Session records | 12 months after the session expires or is closed; a session expires after 14 days without use |
| Browser push notification subscription | Until you turn notifications off, sign out on that device or your browser tells us it is no longer valid |
| Push notification token of the mobile app | Until you turn notifications off, sign out, your session expires after 14 days without use or the notification service tells us the token is no longer valid |
| Delivery records | 12 months from sending |
| Sign-in attempts and sensitive actions | 12 months |
| Server technical logs | Rotated automatically by volume and overwritten |
| One-time codes and links | They expire between 10 minutes and 7 days after being issued; their record is kept for 12 months after they expire or are used |
| Registrations that were never paid | 12 months |
| Subscription and payment records | 5 years after the subscription ends, for accounting and tax purposes |
| Records of the rights requests we handle | 5 years |
| Contact form messages and emails | 12 months from our last exchange |
| Access logs for the wplo.org website | 12 months; used only for security |
| Copy of alerts on your device | Ended alerts, 7 days; everything is erased when you sign out |
Data we delete may remain in our backups for up to 15 days; backups are used only to restore the service.
When a retention period ends, we delete the data or irreversibly anonymise it. If a claim or a request from an authority is pending, we keep the strictly necessary data locked until it is resolved.
7. Your rights
You can ask us for access to your data, to correct it, to delete it, to object to our use of it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time: for push notifications, by turning them off in the app or in your browser or device settings; for anything else, by emailing support@wplo.org. If you are in the European Economic Area, you can also ask us to restrict how we use it.
- You can change your name, language and notification preferences yourself in the app; places can be changed by whoever administers the account.
- To exercise your rights, email support@wplo.org from your account's email address and tell us which right you want to exercise. If you can't write from that address, we'll ask you to verify your identity another way.
- We reply within 10 business days, or within 5 business days if you ask us to correct inaccurate data.
Deleting your account. Anyone with access to an account can ask us to delete their own access; whoever administers the account can ask us to delete the whole account. We turn off access as soon as we have verified the request, and complete the deletion within 15 calendar days of verifying it and in any case within a month of receiving it. Deleting the whole account also cancels the subscription's renewal. Afterwards we keep only subscription and payment records (5 years, for accounting and tax purposes), a record of your request (5 years) and, until their retention period ends, delivery and security records, in case we need to defend a legal claim. Backups are overwritten within 15 days.
Complaints. If you think we haven't handled your request properly, you can complain to Panama's National Authority for Transparency and Access to Information (ANTAI) or to the data protection authority of the country where you live.
8. Security
- Communications with the app, registration and the website are encrypted.
- Passwords are stored only as an irreversible fingerprint.
- You can be signed in on up to three devices and sign out of all of them at once.
- Browser push notifications are encrypted all the way to your device. Those of the mobile app travel over encrypted connections, but Expo, Google and Apple receive the text of the notification in order to deliver it.
- Only the people who need your data to run the service can access it.
9. Children
WPLO is not intended for anyone under 18, and we don't knowingly collect data from children.
10. Changes to this notice
We publish each version of this notice with its number and date. If a change is significant, we'll email you before it takes effect.