Privacy Policy | Política de Privacidad

AlianzaVital LLC d/b/a AquiCargo (“AquiCargo”, “we”, “our”, “us”) is a limited liability company organized under the laws of the State of Florida, USA. We operate as a B2B wholesale trade coordinator for the U.S.–Cuba trade corridor, exclusively within the categories authorized by the Trade Sanctions Reform and Export Enhancement Act (TSRA, Pub. L. 106-387, 22 U.S.C. §§ 7201–7211).

AquiCargo acts as the data controller for all personal and business data collected through the platform. We do not have an established presence in the European Union and do not systematically process data of EU residents; accordingly, we are not subject to the GDPR as an established controller.

Privacy contact: [email protected]
Compliance contact: [email protected]
AlianzaVital LLC d/b/a AquiCargo · 7901 4th St. N., Suite 300, St. Petersburg, FL 33702, USA

2.1 U.S. Vendors — KYB Verification

• Business identity: Legal entity name, Employer Identification Number (EIN), state of incorporation, Secretary of State (SOS) registration number.
• W-9 form: PDF encrypted with AES-256-CBC. Required for IRS 1099-MISC reporting. Access restricted to authorized administrators; every access logged in the audit trail.
• Product catalog: Optional encrypted document listing available TSRA products.
• TSRA self-certification: Signatory name and title, sworn compliance declaration, IP address, and UTC timestamp. Stored verbatim in immutable audit log.
• TSRA categories: Authorized product categories declared by the vendor.

2.2 Cuban Buyers — KYB Verification

• NIT: 11-digit Cuban tax ID (ONAT). We validate the province code (digits 1–2) against the official Cuban province table.
• REEUP / Resolution: Business registry number (8–15 alphanumeric characters) or incorporation resolution for MiPYMEs and NGOs.
• MINCEX import authorization: VUCE authorization number, authorized categories, and expiration date.
• Cuban government documents: AES-256-CBC encrypted; processed with OCR (Tesseract, Spanish language pack) to verify match with declared data. Raw OCR text and extraction JSON stored with document confidence score.
• Entity type: MiPYME, cooperative, state-owned, NGO/humanitarian.

2.3 Account Registration Data

• Full name, email address, organization name, country.
• Password hashed with bcrypt (WordPress standard). Never stored in plain text.
• UTM parameters from the registration session (utm_source, utm_medium, utm_campaign, utm_content) for user acquisition analytics.

2.4 Transaction & Deal Room Data

• RFQs: TSRA category, quantity, budget, delivery window, buyer notes.
• Deal Room messages: Encrypted with AES-256-GCM (96-bit nonce, 128-bit authentication tag). Encryption keys not stored in database. Analyzed before encryption for prohibited patterns (see §5).
• Deal status history: open → negotiating → invoice issued → paid → disclosed → closed.
• Coordination invoices: Amounts, dates, payment status.

2.5 Technical & Security Data

• IP address: Captured at registration, login, KYB submission, legal acceptances, and access to encrypted documents. Cloudflare environments: CF-Connecting-IP is used.
• Geolocation: Approximate country and city derived from IP (ip-api.com). No personally identifiable data shared. 1-hour cache per IP.
• Browser user agent: Captured at legal acceptances and security events (maximum 500 characters).
• Failed login attempts: Logged in security events table. More than 5 failures in 15 minutes triggers automatic IP block for 60 minutes.

2.6 Sanctions Screening Results

• OFAC/SDN screening (vendors): Entity name compared against U.S. Treasury SDN List (sanctionslistservice.ofac.treas.gov; 24-hour cache). Result: clear, flagged, or error.
• CRL screening (Cuban buyers): Entity name compared against U.S. State Department Cuba Restricted List (fuzzy matching, 80% threshold). Result stored with similarity score.
• Screening results are compliance records subject to the 10-year minimum retention period (31 CFR §501.601).

• Contract performance: KYB data, transaction data, and Deal Room messages — necessary to provide the trade coordination service under the Platform Agreements.
• Legal obligation: OFAC/SDN screening, CRL screening, W-9, audit logs — required by TSRA (22 U.S.C. § 7207), OFAC CACR (31 CFR Part 515), BIS EAR (15 CFR Parts 730–774), and records retention regulations (31 CFR §§501.601, 515.572).
• Legitimate interest: Security events, fraud detection, anti-circumvention, platform performance analytics.
• Consent: Optional marketing communications. Consent may be withdrawn at any time by contacting [email protected].

• Verify eligibility to participate in the platform under TSRA, OFAC, and CRL requirements.
• Facilitate the complete RFQ → Deal Room process between Cuban buyers and U.S. vendors.
• Detect and prevent circumvention, fraud, and activities prohibited by applicable sanctions.
• Comply with OFAC and CRL screening obligations and report rejected transactions per 31 CFR §501.604.
• Generate coordination invoices and process payments through QuickBooks Payments (Intuit) and PayPal.
• Send transactional notifications: KYB approval, deal status updates, import license expiration.
• Maintain the compliance audit trail required by applicable regulation.
• Respond to legal requests from regulatory authorities (OFAC, BIS, FinCEN, DOJ).
• Improve platform performance, security, and user experience (using anonymized or aggregated data).

AquiCargo’s anti-circumvention system analyzes all messages sent through the Deal Room to detect:

• Phone numbers (international format)
• Email addresses
• Messaging app usernames (WhatsApp, Telegram, Signal, Viber, WeChat)
• Social media profiles
• External URLs
• Physical addresses

If a prohibited pattern is detected: the message is blocked before delivery; a security event is logged (SHA-256 hash of the message, detected pattern, message direction, warning count); and the sender is notified. Unblocked messages are encrypted with AES-256-GCM before storage.

Message content is not accessible to AquiCargo employees during normal operations. It is only decryptable by authorized system administrators in response to a documented compliance investigation. See §6 for the appeal process for blocked messages.

6.1 Automated Decision Systems

AquiCargo uses automated systems for the following decisions that may have significant effects on platform access:

• OFAC/SDN screening: Automated comparison against the U.S. Treasury SDN List. A flagged result suspends the KYB process and requires human review before any final decision.
• CRL screening: Fuzzy matching against the Cuba Restricted List. An 80% threshold triggers mandatory manual review.
• OCR document validation: Tesseract OCR compares declared data against text extracted from Cuban documents. Discrepancies above the configured threshold suspend KYB approval and generate manual review.
• Message blocking: Anti-circumvention analysis blocks messages automatically. Each block is reviewable by the compliance team through the appeal process (§6.2).

No final adverse decision regarding platform access is made exclusively by automated systems without human review. Every denial of access, account suspension, or final KYB rejection is reviewed by a member of AquiCargo’s compliance team.

6.2 Right to Appeal / Derecho de Apelación

If your KYB application was rejected, your account was suspended, or a message was blocked and you believe the decision was incorrect:

1. Email [email protected] with subject: “KYB Appeal — [your organization name]”
2. Include: reason for appeal, supporting documentation, and your EIN or NIT number.
3. AquiCargo will respond with a human review decision within 10 business days.
4. If the appeal relates to a potential OFAC false positive, AquiCargo may request additional documentation per U.S. Treasury procedures.

We do not sell or rent personal or business data to third parties. We share data only in the following cases:

• With the deal counterparty: Entity name and contact data are disclosed only after the coordination invoice has been paid (deal status: disclosed). Until that point, both parties appear anonymized.
• Regulatory authorities (OFAC, BIS, FinCEN, DOJ): When required by law or when AquiCargo detects activity that may constitute a sanctions violation. We may share compliance records without prior notice to the affected user.
• Corporate successors: In the event of a merger, acquisition, or asset sale, data may be transferred. Users will be notified 30 days in advance if data will be processed under a different policy.

7.1 Sub-Processors

The following third parties process data on behalf of AquiCargo:

AquiCargo will notify users of material changes to sub-processors at least 30 days in advance.

• Compliance audit records (aqc_compliance_audit): Minimum 10 years from transaction date (31 CFR §501.601). Append-only table — no updates or deletions permitted from any application layer.
• KYB records and documents (aqc_kyb_records, aqc_kyb_documents): Minimum 10 years from the last transaction activity (31 CFR §515.572).
• Legal document acceptances (aqc_legal_acceptances): Minimum 10 years. Immutable. Include IP, user agent, and UTC timestamp of each acceptance.
• Deal Room messages (aqc_deal_messages): 10 years from the transaction date, consistent with Platform Agreements §13.1.
• Circumvention records (aqc_circumvention_log): 10 years from the event (31 CFR §501.601 — circumvention attempts are compliance records).
• Security events and login attempts (aqc_security_events): 5 years from the event.
• Active account data: While the account is active. Accounts inactive for more than 3 years may be anonymized, unless compliance records require preservation.
• Geolocation cache: 1 hour per IP.
• OFAC screening cache: 24 hours per entity.

When a user requests account deletion, AquiCargo will anonymize identity data to the extent permitted by regulatory obligations. Compliance records (KYB, audit, legal acceptances, circumvention) cannot be deleted under 31 CFR §501.601.

• KYB documents: AES-256-CBC at rest. Initialization vector (IV) stored separately from encrypted content. SHA-256 hash of plaintext content for integrity verification.
• Deal Room messages: AES-256-GCM with 96-bit random nonce and 128-bit authentication tag. Tampered data is rejected at decryption.
• Passwords: Hashed with bcrypt (WordPress standard). Passwords are never stored in plain text on any system.
• Encryption keys: Defined as environment variables or constants in wp-config.php — never stored in the database.
• Brute-force protection: Automatic IP block after 5 failed login attempts in 15 minutes (60-minute block; 240 minutes for coordinated attacks).
• Cloudflare infrastructure: DDoS protection and WAF active. Real IPs captured via CF-Connecting-IP.
• Encrypted document access: Restricted to authorized administrators. Every access logged in the audit trail with IP, user, and timestamp.
• Transmission: All traffic uses TLS 1.2 or higher.

AquiCargo uses the following cookie categories:

• Essential WordPress cookies: wordpress_logged_in, wordpress_sec, wp-settings — required for session management. The platform cannot function without these cookies.
• WooCommerce cookies: woocommerce_cart_hash, woocommerce_items_in_cart — for the invoicing process. Duration: session.
• QuickBooks Payments (Intuit) cookies: Set by the QBO SDK during card payment processing.
• PayPal cookies: Set by the PayPal SDK when a user selects PayPal as payment method. PayPal maintains its own privacy policy.

We do not use third-party tracking cookies for advertising or remarketing. UTM parameters are captured at registration and stored in the database — not through persistent cookies.

Global Privacy Control (GPC) / Do Not Track (DNT): AquiCargo does not sell personal data or engage in behavioral advertising. GPC and DNT signals reflect a preference that is already our default policy: we do not share data for commercial purposes.

Depending on your jurisdiction, you may have the following rights regarding your data:

• Access: Request a copy of the data we hold about you.
• Rectification: Request correction of inaccurate data (to the extent not in conflict with regulatory records retention obligations).
• Erasure: Request deletion of your personal data. Compliance audit records, KYB records, legal acceptances, and circumvention records cannot be deleted under 31 CFR §501.601 and §515.572. Identity data in other records will be anonymized where technically feasible.
• Portability: Request your data in machine-readable format (JSON/CSV).
• Objection: Object to processing based on legitimate interest in specific circumstances.
• Appeal automated decisions: See §6.2 for the KYB and blocked message appeal process.

To exercise any right: [email protected]. We respond within 30 days. Identity verification may be required before processing the request.

12.1 California Residents — CCPA

The California Consumer Privacy Act (CCPA, Cal. Civ. Code §§1798.100 et seq.) grants California residents the following rights:

• Right to know: Request disclosure of the categories and specific personal information collected about you in the past 12 months.
• Right to delete: Request deletion of your personal information (subject to regulatory exceptions — see §8).
• Right to correct: Request correction of inaccurate personal information.
• Right to opt out of sale: AquiCargo does not sell personal data. This right is satisfied by our default policy.
• Right to non-discrimination: We will not deny services or apply different pricing for exercising CCPA rights.
• Categories of data collected (past 12 months): Identifiers (name, email, IP), business data (EIN, NIT, KYB documents), transaction data, encrypted communications, security data (access logs).

To exercise CCPA rights: [email protected]. Response within 45 days (extendable by an additional 45 days with prior notice).

12.2 Florida Residents — FDBR

The Florida Digital Bill of Rights (SB 262, effective July 1, 2024) grants Florida residents the following rights regarding personal data processed by controllers that meet applicable thresholds:

• Access and portability: Request a copy of your data in portable format.
• Correction: Request correction of inaccuracies in your personal data.
• Deletion: Request deletion of data (subject to regulatory exceptions).
• Opt out of targeted advertising: AquiCargo does not conduct targeted advertising based on personal data.
• Opt out of data sale: AquiCargo does not sell personal data.
• Opt out of profiling with significant legal effects: KYB and sanctions screening has effects on platform access. See §6.2 for the appeal process.

To exercise FDBR rights: [email protected]. Response within 45 days.

AquiCargo is an exclusively B2B platform designed for legally registered commercial entities and their authorized representatives. Use of the platform requires:

• Being a legally incorporated business entity (LLC, corporation, MiPYME, cooperative, NGO), or
• Being an authorized representative of such entity, aged 18 or older.

AquiCargo does not knowingly collect personal information from children under 13. The platform is not directed at individual consumers or minors. If we become aware that we have inadvertently collected data from a child under 13, we will delete that information immediately.

If you believe we have collected data from a minor: [email protected]

In the event of a security breach affecting personal data, AquiCargo will follow this protocol:

1. Containment: Within 4 hours of breach confirmation, the incident will be contained and unauthorized access restricted.
2. Assessment: Determination of scope, affected data, and individuals involved.
3. User notification: Within 72 hours of confirmation, affected users will be notified with: incident description, categories and approximate volume of affected data, containment measures taken, and recommendations for affected users.
4. Regulatory notification: To the FTC, applicable state attorneys general, and if applicable, OFAC/BIS, as required by law.
5. Documentation: Preservation of all incident documentation per the Incident Response Protocol (Doc #40) for the applicable retention period.

This Privacy Policy is governed by the laws of the State of Florida, USA, without regard to its conflict of law provisions. For data-related claims, exclusive jurisdiction lies with the courts of Hillsborough or Pinellas County, Florida, or the U.S. District Court for the Middle District of Florida, or binding arbitration under the AAA Commercial Arbitration Rules, pursuant to Platform Agreements §23.

This Policy is complementary to the AquiCargo Platform Agreements (§19 — Privacy and Data). In the event of conflict between this Policy and the Platform Agreements, the Platform Agreements shall prevail on matters relating to contractual obligations between the parties.

Authoritative language: The Spanish text is the authoritative version of this Policy. The English version is for reference only.

AquiCargo may update this Policy periodically. Material changes will be notified to registered users by email with a minimum of 30 days’ advance notice. Non-material changes (typographical corrections, clarifications that do not expand rights or obligations) may be published without prior notice.

The current version will always be available at this URL. The effective date appears in the document header. Version history is available upon request at [email protected].