# PanamAdventure Privacy Policy **Version 2.0 — current. Effective or reference date: 2026-08-03.** This Policy clearly explains how the PanamAdventure controller collects, uses, shares, protects and retains personal data through the website, its forms, communications and the **Local Talent** program. It forms part of the platform's legal documents, but consent for optional processing is requested separately when required. The Spanish version is the controlling legal version. This English translation is provided for convenience. ## 1. Scope This Policy applies to: - website visitors and people who manage their cookie preferences; - people who submit questions, corrections, reports or requests; - account holders and applicants to the Local Talent program; - approved Talent, authors, contributors and people who receive credit; - identifiable people who appear or are mentioned in content submitted to PanamAdventure; and - providers, partners and representatives whose data is needed to operate the platform. It does not apply to third-party websites, maps, social networks, tourism operators, payment gateways or other services reached through an external link. Those parties are responsible for their own processing, except when they expressly act as service providers processing data on PanamAdventure's instructions. ## 2. Data controller The controller is the individual who manages PanamAdventure and is identified in the header or legal information panel of this page. **PanamAdventure is the digital platform and public name of the project in its pilot stage; it is not a separate legal person or data controller.** Its public name does not replace the identity of the responsible individual, who determines the purposes, means and scope of processing. - **Responsible individual:** Ernesto Antonio Fisher - **Personal identification:** ------- - **Address:** Panamá, República de Panamá - **Privacy channel:** panamadventure507@gmail.com - **Official domain:** https://panamadventure.com Personal-data requests must be sent to the privacy email address or form shown in that header. If the responsible individual or the platform's legal structure later changes, the change will be communicated and data-subject rights will be preserved in accordance with law. Providers that host, transmit, protect or process data on the controller's instructions act as custodians or processors within the scope of their services and agreements. They are not authorized to use the data for incompatible purposes of their own. ## 3. Principles we apply We process data in accordance with the principles of fairness, purpose limitation, proportionality, accuracy, security, transparency, confidentiality, lawfulness, portability and limited retention. Among other things, this means that we: - request only data reasonably necessary for a disclosed purpose; - do not reuse it incompatibly without notice and, when required, new consent; - seek to keep it accurate and allow correction; - restrict access according to job functions; - document relevant decisions and electronic acceptances; and - delete, anonymize or block data when its purpose ends, unless a legal duty or basis requires restricted evidence to be retained. ## 4. Data we may process Depending on a person's relationship with PanamAdventure, we may process the following categories. ### 4.1 Identity, contact and account data First and last name, credit name, email address, telephone number, country or province, language, date of birth or confirmation of legal age, account identifier, verification status, password stored through a cryptographic function, and information needed to recover or secure an account. ### 4.2 Talent application and profile Biography, specialties, general location, experience, professional links, social profiles, website, references, application responses, stated availability and evaluation notes. We may also record the outcome, date and administrative reason for an approval, request for changes, rejection, suspension or closure. ### 4.3 Portfolio and content Portfolio links and samples; text, photographs, audio, video, illustrations, translations and original files; titles, captions, descriptions, locations, creation date, technical information, metadata and file fingerprints; authorship, credits, contribution percentages, sources, editorial history and publication status. We also process licenses, accepted versions, image or voice releases, permissions involving minors, locations, property, music, drones or communities, and evidence reasonably needed to establish that a work may be reviewed and published. ### 4.4 Identity verification and compliance When needed to prevent impersonation, resolve a dispute, formalize a relationship or enable payment, we may request legal name, identification type and number, date of birth, address, nationality and a copy or validation of an identity document. We do not publish this information. A complete copy of an identity document is requested only when verification cannot reasonably be completed with less information. Where possible, we retain the verification result and delete or block the copy once its purpose has been fulfilled. ### 4.5 Tax, accounting and payment data Tax registration or identification number, tax address, forms, invoices, withholdings, statements, payment history, account holder and payment-method details. Where a payment provider is involved, PanamAdventure may receive only an identifier, status, last digits or confirmation instead of full banking credentials. This data is requested only when a transaction, obligation or enabled economic period makes it necessary. It never forms part of a public profile. ### 4.6 Communications and legal evidence Messages, support requests, reports, replies, attachments, preferences, notices delivered, acceptance or withdrawal of consents and agreements, date and time, document version and cryptographic hash, IP address, language and reasonable technical information associated with an acceptance. ### 4.7 Technical and security data IP address, browser, device, operating system, date and time, requested URL, session identifiers, login records, errors, administrative activity and signals of abuse, fraud, automation, spam or unauthorized access. ### 4.8 Cookies, preferences and analytics Language preference, cookie choice, measurement identifiers, pages visited, interactions, approximate duration, referral source, device type and approximate location derived from the IP address. Non-essential analytics is activated only after the corresponding choice has been obtained. ### 4.9 Third-party data included in a work A work may contain the name, image, voice, statement, occupation, location or other data of someone other than the author. Talent must inform those people and obtain any required permission. PanamAdventure may request evidence, conceal data, reject or remove the work to protect an affected person. ## 5. Sensitive data and information that must not be submitted PanamAdventure does not ordinarily request information about health, sex life, genetics, biometrics, racial or ethnic origin, religious or philosophical beliefs, union membership, political opinions or other sensitive data. It must not be included in forms or content unless it is indispensable, relevant and lawful for a clearly explained purpose. Where sensitive processing is genuinely necessary, enhanced controls will be applied and explicit consent will be requested or the applicable legal exception will be documented. A person's publication of sensitive information on another website does not automatically authorize PanamAdventure to collect or reuse it. Passwords, full card numbers, third-party banking information, medical records, copies of another person's documents, precise locations of vulnerable people or communities, and third-party secrets must not be submitted. ## 6. Purposes and legal grounds We process each category only for defined purposes and on an applicable ground: | Purpose | Main data | Ground | | --- | --- | --- | | Display the site, remember language, maintain sessions and operate forms | technical, account and necessary cookie data | requested service, performance of the relationship and service security | | Answer questions, corrections, reports and requests | contact details, message and evidence | handling the request, pre-contractual measures and protection of rights | | Receive and evaluate Local Talent applications | identity, contact, profile, portfolio and evaluation data | steps requested before participation and consent for optional fields | | Create, verify, administer, suspend or close accounts | account, verification, activity and security data | performance of the agreement, abuse prevention and legal obligations | | Review, edit, credit, license, publish or remove works | content, authorship, permissions, history and license | performance of the agreement and individual license, consent where applicable, and protection of third-party rights | | Display the essential public profile of approved Talent | credit name, portrait, short biography, specialties, country or general work areas, status, roles and published works | operation of the program and express authorization given when applying | | Display optional external profile links | website and social-media links supplied by Talent | Talent's separate choice, revocable for future use | | Award points, calculate statements and make enabled payments | contributions, account, identity, tax and payment data | accepted rules or agreements and accounting or tax duties | | Protect the platform and prevent fraud, spam, infringement and unauthorized access | technical logs, IP, activity, checks and claims | security, defense of rights and legitimate purposes allowed by law | | Comply with authority requests and legal duties | data relevant to the request | legal obligation, valid authority order or defense of claims | | Measure and improve website use | non-essential analytics and cookies | consent managed through the cookie panel | | Send newsletters or promotions | name, email and preferences | separate consent and an unsubscribe option in each message | Where processing relies on consent, the person may withdraw it at no cost without affecting the lawfulness of processing completed before withdrawal. Access to public content and submission of an application are not conditioned on optional analytics, marketing or publication of non-essential profile fields. If we need to use data for a new and incompatible purpose, we will provide notice before the new use and obtain authorization when required by law. ## 7. Local Talent applications and portfolios A portfolio is used to assess experience, style, authenticity and thematic fit. **Submitting a link or sample for evaluation does not make it public, transfer ownership or by itself grant a license to publish it.** A work may be published only under an individual license or specific agreement. Evaluations are performed by authorized people. We may use tools to identify duplicates, malicious files, inconsistencies, fraud or possible violations, but the substantive decision to approve or reject an application is not made solely by an automated system. If an application is rejected or abandoned, its information and private samples are retained for the period stated in the retention section to answer claims, prevent abusive duplicate submissions and demonstrate the process. They are then deleted or anonymized unless a dispute or legal duty applies. ## 8. Public profile: essential and optional information Following administrative approval, the essential public profile may show: - the chosen credit name; - the avatar or portrait and a short biography; - specialties, country and general work areas; - participation in the Local Talent program; - the applicable role and credit on each published work; and - published works and their links within PanamAdventure. This information forms part of the program's editorial presentation and is displayed only after approval and the express authorization requested in the application. Talent may request corrections or close their participation; closure removes the active profile, without prejudice to retaining the author credit and data indispensable to identify a work that remains lawfully published. The legal name remains private when it differs from the credit name. Email, telephone number, identity document, exact address, evaluation notes, tax, banking and security information are never included in the public profile. The website and social-media links are optional elements subject to a separate choice. Talent may withdraw permission for their future display by sending a request through the privacy channel. A public contact form, if offered, does not disclose the Talent's private address. Removing an optional field does not necessarily remove the author credit from a work that remains published. If Talent wishes to remove a work or terminate its license, the Participation Agreement and the individual record for that work apply. ## 9. Published content and other people's data Approved content is accessible worldwide and may be indexed, quoted, linked, downloaded or captured by third parties outside PanamAdventure's reasonable control. Before publication, we seek to reduce personal data that is unnecessary for the editorial purpose. Talent must avoid private addresses, identity documents, telephone numbers, license plates, sensitive coordinates and data that exposes minors, communities, species or vulnerable places. Applicable releases for identifiable people's images or statements must be retained and supplied when requested. A person appearing in a work may request information, correction, internal de-indexing or removal of their data. PanamAdventure will assess the request in light of privacy, freedom of expression and information, public interest, copyright, accuracy, legal duties and less restrictive measures such as blurring, pseudonymization or correction. ## 10. Cookies and similar technologies We use three groups of technologies: 1. **Necessary:** enable security, sessions, load balancing, spam prevention, forms and storage of the privacy choice. They cannot be disabled through the panel because the platform cannot safely provide those features without them. 2. **Preferences:** remember language or selected options. They may be managed when not strictly necessary. 3. **Analytics:** help us understand visits and interaction. They load only after acceptance of that category and may be rejected without losing access to public content or forms. The choice is stored locally in the browser or through a cookie. It can be changed at any time through **Manage cookies** in the footer. Cookies can also be deleted or blocked in browser settings, although doing so may end sessions or prevent necessary features. Anti-spam and abuse checks may process IP addresses and technical signals for security even when analytics is rejected. We do not use cookies to sell personal profiles or authorize third-party behavioral advertising without separate notice and consent. ## 11. Communications Messages needed to verify an account, answer a request, communicate a decision, deliver a legal notice, administer a work or protect security are part of the requested relationship and are not promotional messages. Newsletters, promotions and marketing require a separate subscription or authorization. Each such message will contain a simple unsubscribe mechanism. Unsubscribing from marketing does not prevent essential notices about an active account, agreement, security issue or transaction. ## 12. Providers and recipients We may disclose only the necessary data to: - hosting, storage, backup, CDN and maintenance providers; - email, support, form and notification services; - security, anti-spam, error-monitoring and access-control services; - analytics providers, only when that category has been accepted; - payment providers, banks and accounting services when a statement is enabled; - professional advisers under confidentiality where needed for a claim or compliance; - administrative, judicial or regulatory authorities under a valid request; and - a lawful successor in a reorganization, transfer or continuation of the project, subject to this Policy, applicable law and notice where required. When selecting and contracting providers, we seek—according to the service and risk—to establish documented instructions, confidentiality, purpose limitation, access controls, security, deletion or return at the end of the service, and cooperation with incidents and data-subject requests. A provider that does not offer reasonable safeguards for the data it would receive must not be used for that processing. PanamAdventure **does not sell, rent or trade personal data**. It also does not give Talent data to sponsors, tourism operators or advertisers so that they can contact them directly without specific permission or a relationship requested by Talent. ## 13. International transfers The Internet and some technology providers may involve storage, support or processing outside Panama. Before confidential, sensitive or restricted data is processed across borders, we seek to verify that the provider and safeguards meet standards equal to or higher than those required by Panamanian rules, or that another valid legal authorization or exception applies. Depending on the risk, safeguards include minimization, access controls, encryption in transit, confidentiality commitments, data-processing clauses, purpose restrictions and deletion procedures. A provider that does not offer sufficient safeguards must not receive that data. A person may request information about categories of recipients and countries or regions involved, subject to information that must remain confidential for security. Voluntary publication of a profile or work online means that public material can be viewed from other countries; private data does not become public for that reason. ## 14. Automated decisions and artificial intelligence We may use automated rules or tools to filter spam, secure logins, detect malicious files, identify duplicates, organize applications, flag possible violations and calculate results using a previously defined formula. We do not use automation alone to make a decision producing legal or similarly significant effects concerning Talent admission, publication of a work, permanent suspension or entitlement to a statement. Urgent technical measures to stop an attack or suspicious access may be applied immediately, with subsequent human review available. An affected person may request a reasonable explanation, provide context and ask for human review through the privacy channel. We do not use private data, portfolios or Talent content to train generative models for our own or third-party purposes without specific notice and authorization. ## 15. Retention and deletion We apply the following periods after the relevant purpose ends: | Category | Ordinary period | | --- | --- | | Rejected or abandoned Talent application, including evaluation and private portfolio samples | **6 months** after rejection or last activity | | Submitted work that is unpublished, rejected or withdrawn before publication | **90 days** after the final decision or withdrawal | | Inquiry or support case unrelated to a contract | up to **12 months** after closure | | Ordinary technical security and access logs | up to **12 months**, unless an incident or investigation applies | | Analytics data linkable to an identifier | up to **14 months**; anonymized statistics may be retained without a personal time limit | | Approved account, profile and program administration | while active and up to **12 months** after closure, except for the records below | | Backups following deletion from active systems | up to **120 days**, isolated from ordinary use and overwritten under the backup cycle | Licenses, acceptances, authorship records, publication history, claims, statements, invoices, withholdings and contractual, accounting or tax evidence are kept for the period required by the applicable duty and the legal periods needed to establish, exercise or defend rights. During that period they are blocked from incompatible purposes and access is restricted. If there is a report, lawsuit, investigation, fraud, security incident, authority order, or an authorship or payment dispute, only relevant evidence is retained until closure and for the applicable legal period. Once that basis ends, the data is deleted, anonymized or blocked. Deletion from active systems does not instantly remove backup copies. During the 120-day maximum above, backups are not restored for ordinary use. If an emergency restoration reintroduces previously deleted data, the deletion request will be applied again. We do not control copies lawfully made by third parties from a public page before its removal, but we will remove our own copies and request de-indexing or correction from providers under our control when appropriate. ## 16. Security and confidentiality We adopt reasonable measures proportionate to risk, which may include role-based access, cryptographically protected passwords, encrypted transmission, administrative activity logs, backups, software updates, separation of public and private data, provider review and incident-response procedures. Authorized personnel and providers must maintain confidentiality even after their relationship ends. Access to identity documents, tax and banking data, reports and evaluation notes is limited to those who need it for an authorized function. No system is invulnerable. Users must choose a unique password, protect their email accounts and notify us immediately if they suspect lost credentials, improper access or a fraudulent communication. ## 17. Security incidents We investigate and document damage, loss, alteration, destruction, access to or unauthorized use of data. When we become aware of a breach that poses a risk to the protection of personal data, we will notify the supervisory authority and affected data subjects without undue delay and within the **72 hours** required by the regulations, counted from awareness of the incident. To the extent available, the notice will describe the incident, potentially affected data and people, likely consequences, measures taken or proposed, recommendations for reducing risk and a contact channel. If all information is not initially available, it may be supplied progressively without unjustified delay. We will not send alarming notices for events that a documented assessment determines do not pose a risk to personal data. The event will nevertheless be recorded and appropriate corrective measures applied. ## 18. Individual rights Subject to statutory exceptions, every data subject may exercise the following rights at no cost: - **Access:** learn whether we process their data and receive relevant information and a copy. - **Rectification:** correct incorrect, irrelevant, incomplete, outdated, inaccurate, false or improper data. - **Cancellation:** request deletion where storage lacks a legal basis, was not authorized or the data has expired. - **Objection:** object for legitimate reasons relating to their situation and withdraw consent. - **Portability:** obtain data supplied directly by them in a structured, commonly used and interoperable format where a relevant volume is processed automatically on the basis of consent or contract. - **Human review:** challenge a significant decision supported by automation and submit observations. Individuals may also manage cookies, opt out of marketing, request removal of optional profile fields and lodge a complaint with Panama's National Authority for Transparency and Access to Information (**ANTAI**). ## 19. Exercising rights and response periods A request must be sent to the privacy channel identified in the header and state the name, associated email if any, the right being exercised, the data or processing concerned, and information needed to understand the request. A complete national identity document should not be attached to ordinary email unless requested through a secure channel. We may request proportionate verification to avoid giving or deleting another person's data. A representative must establish authority. If a request is incomplete, we will identify the minimum missing information; the applicable period begins when the request can be properly verified and processed. - **Access** requests are answered within no more than **10 business days** after valid submission. - Data subject to rectification is corrected within **5 business days**. - **Cancellation** and **portability** requests are generally handled within no more than **10 business days**. - A valid objection takes immediate effect unless compelling legitimate grounds or another legal need requires processing or retention to establish, exercise or defend claims. We will respond even if we hold no data about the requester. Where a request cannot be fulfilled in whole or in part because of a legal duty, third-party rights, security, freedom of expression, evidentiary retention or another valid exception, we will explain the basis and, where possible, apply blocking, restriction or a less intrusive measure. ## 20. Minors PanamAdventure's general content may be viewed by families, but the platform is not designed to intentionally collect data directly from minors. A person under eighteen may not apply for a Talent account independently. Any exceptional participation requires verifiable involvement by a parent, guardian or legal representative and specific terms. A person submitting a work containing a minor's image, voice, statement or other data must have valid authorization from the representative and protect the minor's best interests, dignity, safety and location. PanamAdventure may omit, blur or remove that information despite an authorization if it identifies a reasonable risk. If we learn that a minor supplied data without applicable authorization, we will block processing and delete it after the necessary checks. The representative may contact the privacy channel to exercise the applicable rights. ## 21. Data from third parties and public sources We may receive data from Talent, a co-author, a person filing a report, a verification provider or a lawful public source. Before incorporating it, we assess its necessity, relevance, reasonable accuracy and compatibility with the purpose. Public availability does not remove a data subject's rights or authorize bulk collection. We do not purchase contact databases or enrich private profiles for marketing without an appropriate basis and notice. A person providing someone else's data represents that they are authorized to do so and must make this Policy available where appropriate. This does not prevent PanamAdventure from verifying authorization directly or deleting the data. ## 22. Links, maps and embedded content Pages may link to or embed maps, videos, players, social networks or other services. A simple link does not by itself send additional data to the third party until it is visited. Embedded content may allow its provider to receive the IP address, browser and page viewed. Where an integration is non-essential and used for measurement or personalization, we seek to condition it on the applicable preference. Once a person leaves PanamAdventure or activates an external service, that provider's policies also apply. ## 23. Changes to this Policy We may correct wording, update providers or adapt the Policy to operational or legal changes. Material changes will have a new version, effective date and reasonable notice through the page, account or registered email, depending on their impact. A change does not retroactively expand a content license or make optional consent mandatory. If a new purpose requires consent, we will request it before beginning that processing. Earlier versions and their hashes may be kept as evidence of the information provided and accepted. ## 24. Priority and language This Policy takes priority over the general Terms and Participation Agreement concerning personal-data processing. An individual record or agreement may describe additional data needed for a work or payment, but cannot reduce non-waivable rights. The Spanish version prevails over this translation in the event of any inconsistency, unless mandatory law provides otherwise. ## 25. Contact and supervisory authority For questions, rights requests or privacy reports, use the controller's channel shown in the header. Include **“Privacy”** in the subject to assist routing. If you believe that your request was not properly addressed, you may complain to Panama's **National Authority for Transparency and Access to Information (ANTAI), Personal Data Protection Directorate**, through its official channels. ## 26. Legal framework This Policy is structured under Panama's [Law 81 of March 26, 2019 on Personal Data Protection](https://www.gacetaoficial.gob.pa/pdfTemp/28743_A/72148.pdf) and [Executive Decree 285 of May 28, 2021 implementing that Law](https://www.gacetaoficial.gob.pa/pdfTemp/29296_A/GacetaNo_29296a_20210528.pdf), without prejudice to other special rules applicable to a particular activity, category of data or data subject.