LEGAL-002 · v2.0 · Effective: 2026-08-17 · Last updated: 2026-08-17
Published under product-owner authorisation. Subsequent legal review scheduled.
1. Identity of the Data Controller
The controller of personal data collected through the CoraSend Platform is Orangepill Colombia SAS, a company incorporated under Colombian law, with tax identification number (NIT) 901835670-7, registered address at CL 127 D 56 B 90, Colombia. Contact: info@corasend.com.
For the purposes of applicable data protection law, Orangepill Colombia SAS acts as controller of data collected directly from users. The data-processing roles of third parties are described in the relevant sections of this Policy.
2. Data We Collect
Depending on how the user interacts with the Platform, we may collect the following categories of personal data:
2.1 Identity Data
Full name, date of birth, nationality, and identity document number.
2.2 Transaction Data
Amounts, currency, payment method type, beneficiary data, transaction timestamps, and transaction references.
2.3 Device Data
IP address, user agent, browser language, and technical characteristics of the device or browser used to access the Platform.
2.4 Messaging Data
Conversation history maintained in the messaging channels enabled by CoraSend, to the extent that the user interacts with the Platform through those channels.
2.5 Support Data
Correspondence exchanged with the CoraSend customer support team, including the content of communications and associated identification data.
2.6 Identity Verification Documents and Information
Identity document image (front and back), biometric data obtained through facial recognition, and live selfie, where the identity verification process is applicable.
2.7 Biometric Data
Biometric data, including data obtained through facial recognition during the identity verification process, are classified as sensitive data under applicable data protection law. Their processing requires explicit consent from the data subject and is subject to enhanced security measures.
2.8 Aggregate Community Page Engagement Data
When a visitor accepts optional analytics and visits public community pages, CoraSend may collect aggregate engagement counters (page views, support form opens, QR expansions, content shares). These counters are exclusively aggregated: no individual click history is stored, no visitor profile is created, and no engagement identifier is linked to the identity of a donor, sender, or payment recipient. Community page engagement data and Orangepill transaction data are held in separate systems and are not combined.
3. Beneficiary Data
When the user designates a beneficiary for a transaction, CoraSend receives beneficiary data directly from the sender. This data is used solely for the purpose of executing the transaction and is not used for marketing activities or disclosed to third parties for purposes other than those necessary to complete the transfer. The legal basis for processing beneficiary data is the legitimate interest in executing the instructed transaction and, where applicable, compliance with legal record-keeping obligations. Where technically feasible and where doing so does not compromise the execution of the transaction, beneficiaries will be informed of the processing of their data.
4. How We Use Your Data
4.1 Transaction Execution
Legal basis: necessary for the performance of the contract. Purpose: processing the payment instruction, coordinating with the applicable Financial Partner, and delivering status notifications and confirmations to the user.
4.2 Identity Verification
Legal basis: legal obligation and legitimate interest in preventing fraud and meeting due diligence requirements. Purpose: verifying the user's identity in accordance with applicable regulatory requirements, including anti-money-laundering obligations.
4.3 Fraud Prevention and Regulatory Compliance
Legal basis: legal obligation and legitimate interest. Purpose: detecting and preventing fraudulent activities, money laundering, terrorist financing, and sanctions evasion; compliance with orders and requests from competent authorities.
4.4 Platform Improvement and Aggregate Analysis
Legal basis: consent for optional measurements; legitimate interest for non-identifiable aggregate technical analysis. Purpose: aggregate analysis of usage behaviour to identify operational improvements, detect errors, and optimise the user experience. Optional analytics measurements (Google Analytics 4 and community page engagement counters) require prior consent and are only activated if the user explicitly accepts them. Declining these measurements does not affect access to any Platform feature.
4.5 Customer Support
Legal basis: performance of the contract. Purpose: addressing queries, managing claims, and providing technical assistance to the user.
4.6 Marketing Communications
Legal basis: explicit consent of the data subject. Purpose: sending commercial and promotional communications. Consent for this purpose is strictly voluntary and may be withdrawn at any time without consequences for access to the service.
5. Optional Analytics Measurements
CoraSend uses Google Analytics 4 (property G-D3KR7GGZ9K) to measure aggregate site usage and, conditionally, community page engagement counters. None of these measurements are activated without the visitor's prior, explicit consent.
- Without consent: no Google Analytics cookies are set, no requests are made to Google servers, and no community page engagement counters are recorded.
- With accepted consent: the measurements described in the Cookie Policy (LEGAL-006) are activated. Data is aggregated and is not used to identify individual visitors or build commercial profiles.
- Withdrawal of consent: available at any time via the cookie preferences link in the page footer. Google Analytics cookies are deleted immediately and no further data is sent. Withdrawal does not affect access to any Platform feature.
CoraSend does not link community page visitor engagement data with the identity of donors or payment senders registered with Orangepill.
Google consent mode is configured so that analytics_storage is denied by default. Google Analytics advertising features, Google Signals, and ad personalisation are disabled on the property.
6. Data Protection Authorisation in Colombia
In accordance with Law 1581 of 2012 (Personal Data Protection Law) and its implementing regulations, the processing of personal data by Orangepill Colombia SAS is based on the prior, express, and informed authorisation of the data subject, or on the legal exceptions set out in Article 10 of that law.
Data subjects have the right to know, update, rectify, and delete their personal data (Habeas Data), as well as to revoke their authorisation for processing, in the terms provided by law. To exercise these rights, data subjects may contact info@corasend.com. Orangepill Colombia SAS will respond within the timeframes established by applicable regulations.
7. Identity Verification
The identity verification process is carried out through our Identity Verification Provider. During this process, the user may interact directly with the provider's interface. Orangepill Colombia SAS receives the verification result and a limited set of associated data; the full verification evidence is stored by the provider in accordance with its own retention and security policies.
The allocation of data-processing responsibilities is governed by the agreement executed between Orangepill Colombia SAS and the provider. Notwithstanding this, Orangepill Colombia SAS adopts contractual and technical measures to ensure that the processing of verification data is carried out in accordance with applicable law.
8. Financial Partners
In the context of transaction execution, Financial Partners may act as independent data controllers with respect to the data-processing activities necessary for the performance of their own legal and operational obligations. The following is a preliminary description of relevant data activities:
- Payment execution: the applicable Financial Partner may act as an independent controller with respect to the data necessary for executing the payment.
- Regulatory compliance and sanctions monitoring: may act as an independent controller for its own regulatory obligations relating to anti-money-laundering compliance and sanctions screening.
- Regulatory reporting: may act as an independent controller vis-à-vis applicable regulatory authorities in its jurisdiction.
The preliminary characterisation of the Financial Partner's data-processing roles is subject to legal review and may be updated.
9. Other Service Providers
CoraSend uses trusted cloud infrastructure to host and operate the Platform. Personal data stored on that infrastructure is protected by appropriate technical and organisational measures. Messaging platforms (WhatsApp, Telegram) are independent third parties with their own privacy policies, over which CoraSend exercises no control. Users should consult those operators' policies to understand how their data is processed on those platforms.
HubSpot (HubSpot Inc. / HubSpot Ireland Limited) is used exclusively on the Aliados/Partners pages to manage contact forms. HubSpot manages its own cookies under its own privacy policy.
10. International Data Flows
Users' personal data may be transferred to or processed outside Colombia, including in countries where the Identity Verification Provider and the applicable Financial Partner are established. Orangepill Colombia SAS adopts appropriate safeguards to protect data in connection with such cross-border transfers.
The legal characterisation of these international data transfers, including the identification of the applicable transfer mechanisms under Law 1581 of 2012 and its implementing regulations, is subject to legal confirmation.
11. Data Retention
Personal data is retained for as long as necessary for the purposes described in this Policy and as required by applicable law and regulation. The criteria for determining the retention period include the duration of the contractual relationship with the user, compliance with legal record-keeping and accounting obligations, and the resolution of pending disputes or claims.
Legal obligations relating to anti-money-laundering and counter-terrorist-financing may require the retention of certain data for periods extending beyond the termination of the relationship with the user. Once applicable retention periods have expired, data is securely deleted or anonymised.
12. Your Rights
Data subjects have the following rights, in the terms provided by applicable law:
- Access: the right to know what personal data is being processed by Orangepill Colombia SAS.
- Rectification: the right to request correction of inaccurate or incomplete data.
- Erasure: the right to request deletion of data where there is no legal basis for its retention.
- Objection: the right to object to processing based on legitimate interest or to withdraw consent.
- Portability: the right to receive data in a structured, commonly used and machine-readable format, where processing is based on consent or contract performance and is carried out by automated means.
The exercise of erasure and objection rights may be limited by applicable legal retention obligations relating to anti-money-laundering compliance. To exercise any of the above rights, data subjects must submit their request to: info@corasend.com.
13. Minors
CoraSend's services are directed exclusively at persons aged 18 years or older. We do not knowingly collect personal data from minors. If Orangepill Colombia SAS becomes aware that it has collected personal data from a person under 18 years of age without the appropriate authorisation, it will proceed to delete that data as soon as reasonably practicable.
14. Cookies and Local Storage
Detailed information on cookies, local storage, and the consent mechanisms used on the Platform is set out in the Cookie Policy (LEGAL-006), available on the website.
15. Automated Processing
CoraSend and its Financial Partners use automated systems in the context of identity verification and regulatory compliance screening, including the detection of suspicious activities. These automated processes are intended to fulfil applicable legal obligations and manage Platform risk. Where applicable law affords the user the right to request human review of an automated decision that significantly affects them, the user may exercise that right by contacting info@corasend.com.
16. GDPR and Other Regulations
Where the General Data Protection Regulation (GDPR) of the European Union is applicable — in particular in relation to users located in the European Economic Area — Orangepill Colombia SAS acknowledges the additional rights provided under that regulation, including the right to lodge a complaint with the competent supervisory authority. The applicability of the GDPR to CoraSend's operations is not asserted universally, but only in the specific circumstances where the regulation so requires.
Similarly, where another territorially applicable data protection law is relevant, Orangepill Colombia SAS will respect the non-waivable rights recognised by that law for the affected data subjects.
17. Material Changes
Material changes — those that affect user rights, the identity or role of Financial Partners, data-processing practices, or fee and refund terms — become effective only after reasonable prior notice and, where required by applicable law, renewed acceptance. Non-material changes (typographical corrections, updated contact information, formatting) may take effect upon publication.
18. Contact
To exercise your rights, ask questions about the processing of your data, or submit any privacy-related complaint, please contact: info@corasend.com. Orangepill Colombia SAS, CL 127 D 56 B 90, Colombia.