In this Privacy and Personal Data Processing Policy, “we”, “us”, “El Dorado” or “the Company” refer to EL DORADO LABS PY INC or its affiliates, subsidiaries or related companies, and “our” shall be construed accordingly.
This Policy governs the Processing of Personal Data carried out by El Dorado in connection with the provision of El Dorado Empresas, the self-custodial business platform offered to legal entities under the El Dorado Empresas Terms and Conditions (the “Terms”). Since the User of El Dorado Empresas is a legal entity, the Data Subjects whose Personal Data is processed under this Policy are the natural persons related to the User, as described in Section 2.
The acceptance of the Terms by the legal representative or authorized person of the User, the registration of Team Members on the Platform, the use of El Dorado Empresas and/or the express and unequivocal acceptance of this Policy imply that the Data Subject accepts that their Personal Data will be processed in accordance with the provisions herein.
EL DORADO adopts this Policy in accordance with the general principles of personal data protection and the right to privacy and informational self-determination.
This Policy applies to all Personal Data that EL DORADO, in its capacity as a virtual asset service provider, collects, receives or processes in connection with the provision of El Dorado Empresas. In particular, it applies to the Personal Data of the following Data Subjects:
“Authorization”: the prior, express and informed consent granted by the Data Subject to El Dorado for the Processing of their Personal Data.
“Database”: an organized set of Personal Data that is subject to Processing by El Dorado.
“Inquiry”: a request made by the Data Subject to learn what information El Dorado holds about them in its Databases.
“Personal Data”: any information relating to a natural person that identifies them or makes them identifiable.
“Sensitive Data”: data that affects the privacy of the Data Subject or whose misuse may give rise to discrimination, such as racial or ethnic origin, political orientation, religious or philosophical beliefs, trade union membership, health data, data concerning sex life and biometric data.
“El Dorado Empresas” or the “Product”: the self-custodial business platform offered by El Dorado, as defined in the Terms.
“Data Processor”: a natural or legal person, public or private, who, alone or jointly with others, carries out the Processing of Personal Data on behalf of and following the instructions of El Dorado, in its capacity as Data Controller.
“Purpose”: the purpose for which El Dorado processes the Data Subject’s Personal Data.
“Team Member”: any natural person who acts on behalf or in representation of the User within the Platform, in accordance with the roles and permissions assigned by the User.
“Platform”: the technological infrastructure, interfaces, applications, systems and digital services through which El Dorado Empresas is offered.
“Claim”: a request by the Data Subject to exercise their rights in relation to their Personal Data.
“Data Controller”: a natural or legal person who decides on the Processing of Personal Data, that is, who determines its purpose.
“Services”: the services that El Dorado provides to the User through El Dorado Empresas, in accordance with the Terms.
“Terms”: the El Dorado Empresas Terms and Conditions.
“Data Subject”: a natural person whose Personal Data is subject to Processing, including the persons indicated in Section 2.
“Processing”: any operation performed on Personal Data, such as collection, storage, use, circulation, transmission, transfer, updating, correction or deletion, whether at the national or international level.
“Transmission”: the delivery of Personal Data to a Data Processor, within or outside Panama, so that the latter carries out the Processing following the instructions of El Dorado.
“Transfer”: the delivery of Personal Data to another Data Controller, within or outside Panama, so that the latter processes it autonomously.
“User”: a legal entity that registers for and uses El Dorado Empresas for business, commercial or operational purposes, acting through its representatives and authorized Team Members.
The Processing of Personal Data by El Dorado is governed by the following principles:
The Data Controller of the Personal Data covered by this Policy is EL DORADO LABS PY INC, a company incorporated under the laws of the Republic of Panama and identified with RUC No. 155778564-2-2026.
EL DORADO LABS PY INC may transmit and/or transfer Personal Data, nationally and internationally, to the Data Processors and Data Controllers with which it interacts for the development of its activities, for which it will adopt the relevant legal and contractual mechanisms to ensure the principles set forth in this Policy, as detailed in Section 9.
El Dorado collects Personal Data, among others, in the following cases:
El Dorado will process the Personal Data required in the know-your-business (KYB) verification form at the time of the User’s onboarding. It will also process the Personal Data requested during the document update periods established in El Dorado’s compliance policies, as well as the Personal Data necessary for the provision of the Services, which will always be communicated to the User in advance. This Personal Data may include personal and identification information of the shareholders, ultimate beneficial owners, directors, legal representatives, attorneys-in-fact, Compliance Officers and other natural persons related to the User.
Given the nature of the Service, El Dorado may process certain Sensitive Data, such as the image of the identity document and the photograph obtained through biometric liveness verification of the shareholders, ultimate beneficial owners, directors, legal representatives, attorneys-in-fact, Compliance Officers and other natural persons related to the User, where such verification forms part of EL DORADO’s Identity Validation (KYB) process, as well as any other Sensitive Data necessary to fulfill the purposes described in this Policy and to properly provide the Services.
El Dorado will only collect and process Sensitive Data in the permitted cases and will always inform the Data Subject that they are not obliged to provide it or to authorize its Processing. If the Data Subject does not grant such authorization, El Dorado will not be able to continue with the Identity Validation process and, consequently, will not be able to provide the respective services.
The Personal Data of the shareholders, ultimate beneficial owners, directors, legal representatives, attorneys-in-fact, Compliance Officers and other natural persons related to the User will also be processed in accordance with this Policy when sent to El Dorado through channels other than the Platform, such as WhatsApp, email or other communication channels, in connection with the onboarding process or the updating of information. By sending such information through these channels, the User authorizes El Dorado to process the Personal Data in accordance with this Policy.
El Dorado will process Personal Data to: fulfill its corporate purpose and provide the Services; keep and manage the information of the business relationship with the User; comply with legal, accounting, commercial and regulatory obligations; monitor and preserve the security of El Dorado’s people, assets and information; host Personal Data on its servers or on those of its Data Processors; disclose information when necessary to comply with legal proceedings, prevent fraud or protect the security of El Dorado or third parties; prevent and detect the commission of crimes, for which it may consult national and international databases and restrictive lists; comply with regulations on the prevention of money laundering, terrorist financing and the financing of the proliferation of weapons of mass destruction (ML/TF/PF); maintain direct communication with Data Subjects for contractual and informational purposes; carry out statistical, commercial, financial and administrative analyses; and respond to Inquiries, requests and Claims.
In addition, El Dorado will process Personal Data to:
To fulfill the purposes described in this Policy, El Dorado may use Data Processors, that is, third parties that carry out the Processing of Personal Data on behalf of El Dorado and exclusively following its instructions. The involvement of a Data Processor does not release El Dorado from its responsibility as Data Controller vis-à-vis the Data Subject.
Notwithstanding the foregoing, depending on the type of relationship the Data Processor has with El Dorado, and where deemed appropriate given the nature of such relationship, the Data Processor may contract directly with Data Subjects to offer its own services. In such case, the Data Processor will act as Data Controller with respect to the Personal Data it processes under that direct relationship, which will be governed by its own terms and conditions and its own privacy policy, for which El Dorado will not be responsible.
El Dorado contractually requires all its Data Processors to: (i) process Personal Data exclusively for the authorized purposes and following El Dorado’s instructions; (ii) implement technical, human and administrative security measures equivalent to those required of El Dorado; (iii) keep Personal Data confidential, even after the contractual relationship has ended; (iv) not subcontract the Processing without El Dorado’s prior authorization; (v) delete or return Personal Data upon termination of the contractual relationship, unless there is a legal obligation to retain it; and (vi) cooperate with El Dorado to timely respond to Data Subjects’ Inquiries and Claims.
By accepting this Policy, the Data Subject authorizes El Dorado to transmit their Personal Data, within or outside Panama, to the corresponding Data Processors under the terms described in Section 8.2, so that they may provide El Dorado with the operational, technological, compliance or administrative support necessary for the provision of the Services.
El Dorado may transfer Personal Data to third-party Data Controllers, within or outside Panama, when the Data Subject so authorizes, when permitted by law or when there is an administrative or judicial order requiring it. Personal Data may be transferred, among other cases, for: (i) the proper provision of El Dorado’s Services; (ii) compliance with requirements from governmental, judicial or regulatory authorities, including competent authorities in digital asset matters; and (iii) the provision of services by technology or infrastructure providers located outside Panama.
If El Dorado transmits Personal Data to a Data Processor, the latter will process it in accordance with this Policy. If it transfers Personal Data to another Data Controller, such Personal Data will be processed in accordance with that new Data Controller’s data protection policy, of which El Dorado will endeavor to inform the Data Subject.
For any international transfer of Personal Data, El Dorado will adopt the contractual and technical measures necessary for the receiving third party to be aware of and undertake to observe the principles of this Policy, ensuring that the information received is used solely for the purposes authorized by the Data Subject and related to the provision of the Services.
El Dorado requires the free, prior, express and informed consent of the Data Subject for the Processing of their Personal Data, except where not required by law.
Authorization may be obtained through electronic documents, data messages, forms on the Platform or any other mechanism that allows the Data Subject’s consent to be unequivocally verified.
When El Dorado substantially modifies the purposes of the Processing, it will publish the changes on the Platform and request a new authorization from the Data Subject when necessary. If the Data Subject does not agree with the new purposes, they may revoke their authorization and request the deletion of their Personal Data, provided there is no legal or contractual duty preventing such deletion.
The Data Subject has the following rights:
A request for deletion of information and the revocation of authorization will not proceed when the Data Subject has a legal or contractual duty to remain in El Dorado’s Database.
A Data Subject who wishes to exercise their rights must send an email to support.admin@eldorado.io, addressed to EL DORADO LABS PY INC, specifying: (i) the name and identification of the Data Subject or of the legitimate representative; (ii) a precise and complete description of the facts giving rise to the Inquiry or Claim; (iii) the request; (iv) the email address to which the response should be sent; and (v) the relevant documents and other evidence.
When the Data Subject wishes to consult the information held in the Database, El Dorado will respond to the request within a maximum term of fifteen (15) business days from its receipt. If it is not possible to respond to the Inquiry within such term, the Data Subject will be informed of the reasons for the delay and the date on which it will be addressed, which may in no case exceed five (5) business days following the expiration of the first term.
When the Data Subject considers that their Personal Data should be rectified, deleted or subject to objection, or when they notice an alleged breach of this Policy, they may file a Claim with El Dorado. If the Claim is incomplete, El Dorado may request the Data Subject, within five (5) business days following its receipt, to complete it; if two (2) months elapse without the Data Subject providing the required information, the Claim will be deemed withdrawn.
El Dorado will address the Claim within a maximum term of fifteen (15) business days from the day following its receipt. When it is not possible to address it within such term, the Data Subject will be informed of the reasons for the delay and the new response date, which may not exceed eight (8) business days following the expiration of the first term.
The removal or deletion of Personal Data will not proceed when there is a legal or contractual duty to remain in El Dorado’s Database.
Any incident related to information security breaches will be reported internally to El Dorado’s Compliance Officer or Data Protection Officer, who will coordinate with the Technology area the adoption of the relevant corrective measures and, where applicable, will inform the competent authorities and the affected Data Subjects.
El Dorado will process the Data Subject’s Personal Data from the time the Data Subject grants their authorization until the purpose for which it was collected has been fulfilled, or until El Dorado is dissolved and liquidated, whichever occurs first. However, once the purpose has been fulfilled, El Dorado may retain the information for the period necessary to comply with legal, contractual, accounting, tax or reporting obligations before authorities, including those related to the prevention of money laundering, terrorist financing and the financing of the proliferation of weapons of mass destruction (ML/TF/PF).
In any case, the Data Subject may revoke their authorization at any time through the institutional channels indicated in Section 12, subject to verification of their identity.
El Dorado implements reasonable human, administrative and technical protection measures, proportionate to the risk, aimed at ensuring the confidentiality, integrity and availability of Personal Data and preventing its alteration, loss, consultation, use or unauthorized or fraudulent access. These measures include, among others: an access management system with role-based differentiated privileges; encryption of sensitive information both in transit and at rest; the definition of internal responsibilities for the safekeeping and protection of Personal Data; and mechanisms for security incident management.
By accepting this Policy, the Data Subject expressly accepts these protection measures and declares that they consider them appropriate and sufficient for the protection of their Personal Data.
A cookie is a file that is downloaded onto the Data Subject’s device when accessing the Platform. Cookies allow, among other things, the storage and retrieval of information about the user’s browsing habits. El Dorado uses its own and third-party cookies in order to personalize the browsing experience, remember preferences, generate metrics and analytics, and track consumption habits within the Platform.
The Data Subject may reject the use of cookies through their browser settings.
El Dorado has appointed Catalina Ortega Osorio as Personal Data Protection Officer, who may be contacted at catalina@eldorado.io. Any questions, Inquiries or Claims related to this Policy may be addressed to her or to the institutional email support.admin@eldorado.io.
Any modification, update or adjustment to this Policy will be timely notified to the User through the application, also referred to as the Platform.
The User accepts and acknowledges that it is their responsibility to periodically review the application in order to become aware of such changes. Continued use of the Platform, or express acceptance within it, will be deemed full and binding acceptance of the new conditions of the Policy.
Last updated: September 28, 2026
THE LATINO DREAM:
El Dorado Dollar Dream $
