This Privacy Policy has been prepared in accordance with the Personal Data Protection Law of El Salvador (Legislative Decree No. 144 of November 12, 2024), supervised by the State Cybersecurity Agency (ACE). TAKE AND GO, SOCIEDAD POR ACCIONES SIMPLIFICADA DE CAPITAL VARIABLE (TAGO, S.A.S. DE C.V.), registered with the Commercial Registry of the CNR under entry 152 of book 4942, with registered office at Avenida Jacarandas 175, Colonia Miramonte, San Salvador (hereinafter, "Tago"), describes here how it collects, uses, processes, and discloses your personal information. This policy constitutes the Privacy Notice required by Salvadoran legislation. The Spanish version at tago.rent/es/legal/privacy-policy is legally authoritative.
1. Guiding principles
Per Art. 5 of Decree 144-2024, Tago bases the processing of your information on:
- Lawfulness, fairness, and transparency.
- Purpose limitation: data collected for specified, explicit, legitimate purposes.
- Minimization: only strictly necessary data.
- Accuracy: accurate and up-to-date data.
- Storage limitation.
- Proactive accountability.
2. Legal basis for processing
Tago bases the processing of your data on one or more of the following:
- Express consent — free, specific, informed, and unambiguous. Consent boxes will never be pre-checked.
- Performance of a contract to which you are a party (e.g., managing your Booking).
- Legal obligation applicable to Tago.
- Legitimate interest, provided your fundamental rights do not prevail.
- Protection of vital interests of the data subject or another person.
3. Personal information we collect
We collect three categories: (a) what you provide directly, (b) what is collected automatically, and (c) what comes from third-party sources.
Data you provide:
- Account data: name, email, password.
- Profile data: address, phone, driver license, photos, date of birth.
- Vehicle data: listing details, VIN, location, availability, reviews.
- Payment data: card or bank account information, processed by PCI-DSS certified providers.
- Identity verification data: DUI, license, passport, last 4 digits of NIT, driving history, insurance info.
- Biometric data (sensitive): facial recognition derived from photos and documents, only with prior express consent. Per Art. 5 of Decree 144-2024, no person may be compelled to provide sensitive data.
- Communications: content of correspondence with Tago or other users.
Automatically collected data:
- Usage data: pages visited, login history, searches, bookings.
- Location data: with your consent, precise mobile device location. Without consent, only approximate via IP.
- Device data: OS, browser, IP address, unique identifiers.
- Trip data: date, time, amounts charged.
- Cookies and similar technologies: managed via site footer.
Third-party data:
- Social sign-in (Google, Apple).
- Devices installed in vehicles by manufacturers or hosts.
- Background verification from public sources and judicial records to the extent permitted by law.
4. How we use your information
To provide and operate the Services:
- Create and manage your account.
- Process bookings and transactions.
- Customer service and technical support.
- Service communications, security alerts, reminders.
- Sign-in via Google / Apple.
- Personalize the experience.
- Facilitate Host-Guest communication.
For research and development: analytics to improve Services and create aggregated or anonymized data.
For marketing and advertising: promotional communications with your express consent. You can always revoke and unsubscribe.
For security and protection: verify identity, resolve disputes, detect fraud and incidents, identify dangerous driving, assess risk where legally pertinent.
To comply with law: Decree 144-2024, Cybersecurity Law, Commercial Code, fiscal and financial regulations.
5. How we disclose your information
Tago does not sell your personal data. We only disclose in the following cases:
- With your express consent.
- Public profile and listing information (name, photo, vehicle city, listing description, reviews). This information may be indexed by search engines.
- Between Hosts and Guests upon Booking confirmation (phone, license data, photo, delivery address).
- Service providers acting under our instructions (hosting, analytics, payment processing, marketing, insurance, roadside assistance, customer service). These providers are bound by confidentiality agreements.
- Third-party platforms and social networks, only if you voluntarily link your account.
- Professional advisors (lawyers, auditors, bankers, insurers) under professional confidentiality.
- Business transfers in case of merger, acquisition, or sale of assets; the resulting entity must respect this policy.
- Legal requests and authorities: courts, Attorney General, State Cybersecurity Agency, National Civil Police, when legally required.
6. Your ARCO-POL rights
Per Decree 144-2024 you have the following rights:
- Access — know what data we hold about you.
- Rectification — correct inaccurate data.
- Cancellation / Erasure — request deletion when no longer necessary.
- Opposition — object to processing for specific purposes, including advertising profiles.
- Portability — receive your data in a structured format and transmit to another controller.
- Erasure (Right to be Forgotten) — total deletion when data is inadequate, inaccurate, outdated, or excessive.
- Limitation — temporary suspension of processing while accuracy is verified or a complaint is resolved.
To exercise any of these rights:
- Sign in and access "Settings and privacy", or
- Send a request to privacy@tago.rent, or
- Write to the Data Protection Officer at dpo@tago.rent.
We will respond within a maximum of 30 calendar days. Exercise of these rights is free. If your request was not properly addressed, you may file a complaint with the State Cybersecurity Agency (ACE).
To close your account and request data deletion, write to cuentas@tago.rent. Per law, we may retain certain information to comply with legal obligations, resolve disputes, or detect fraud.
7. Consent and revocation
Consent must be free, specific, informed, and unambiguous via a clear affirmative action (never pre-checked boxes).
You may revoke your consent at any time without affecting the lawfulness of prior processing. To revoke, contact us at privacy@tago.rent.
If Tago plans to process your data for a purpose different from the one originally authorized, we will notify you in advance and request new authorization.
8. International transfers
Tago Services are controlled and operated from the United States. Your personal information may be stored and processed in countries where Tago has facilities or providers.
Per Decree 144-2024, international transfers will only be made when the destination country guarantees a level of protection equivalent or superior, or when you have given express consent. Tago will implement adequate contractual safeguards with overseas recipients.
9. Security and incident notification
Tago implements technical, physical, and organizational measures to protect your information: encryption, access controls, continuous monitoring, and staff training. No method is 100% secure.
In case of an incident that compromises your data, Tago will promptly notify:
- The State Cybersecurity Agency (ACE).
- The Attorney General when applicable.
- Affected data subjects, as soon as possible.
The notification will include the nature of the incident, affected data, measures taken, and recommended steps to protect yourself.
10. Data Protection Officer
Tago has appointed a Data Protection Officer (DPO) responsible for compliance with this policy and the law.
DPO contact: dpo@tago.rent
The DPO handles ARCO-POL requests, queries about data processing, and privacy complaints.
11. Minors
The Services are not directed to persons under 18. Tago does not knowingly collect data from minors. If you are a parent or guardian and know that your minor child has provided us data without your consent, contact us at privacy@tago.rent to request immediate deletion.
12. Other important information
Sensitive data: Salvadoran law affords special protection to sensitive data (health, religion, sexual orientation, ethnic origin, political affiliation, biometric or genetic data). We ask you not to share these unless expressly requested.
Cookies and advertising: manage preferences in the site footer, in browser settings, or by limiting the mobile advertising ID on your device.
Data retention: we will retain your data for the time necessary to fulfill the purposes described or the time required by applicable Salvadoran legislation. Once met, we will proceed to secure deletion or anonymization.
Third-party practices: this policy applies only to processing by Tago. We are not responsible for practices of linked third-party sites or services (Google Maps, Google Places, reCAPTCHA Enterprise, etc.).
Language versions: in case of discrepancy between the Spanish version and any other, the Spanish version prevails for users in El Salvador.
13. Changes to this policy
We may update this Privacy Policy to reflect changes in our practices or in Salvadoran legislation. The "Last reviewed" date will indicate when the latest changes were made. Material changes will be notified by email or prominent notice with at least 15 days advance.
14. Contact and supervisory authority
For any privacy query or complaint:
- General privacy: privacy@tago.rent
- Data Protection Officer: dpo@tago.rent
- Account closure and data deletion: cuentas@tago.rent
If you consider that processing infringes the Personal Data Protection Law (Decree 144-2024), you may file a complaint with the State Cybersecurity Agency (ACE) — agenciadeciberseguridad.gob.sv. We recommend trying to resolve first with Tago via the channels listed.