Back to home

PUL Privacy Policy

Last updated: September 27, 2026 — version 2026-09-27

This Privacy Policy describes how BASEL DATA S.R.L. ("we", "PUL" or "the Platform") collects, uses, stores and protects the personal data of users of the university carpooling platform available at pul.com.ar. By registering and using PUL you consent to the practices described here, in accordance with Argentine Personal Data Protection Law No. 25,326, its regulatory decree 1558/2001 and the provisions of the Agency for Access to Public Information (AAIP). This is a courtesy translation: in case of discrepancy, the Spanish version prevails.

1. Data controller

The controller of your personal data is:

  • Company: BASEL DATA S.R.L.
  • Tax ID (CUIT): 30-71847186-5
  • Registered address: Autonomous City of Buenos Aires, Argentina (full address available on request at info@pul.com.ar)
  • Contact: info@pul.com.ar

PUL's user database is registered with the National Registry of Databases of the Agency for Access to Public Information as required by section 21 of Law 25,326; you can ask about the registration status at info@pul.com.ar.

2. Data we collect

We only process the data needed for the service to work. Depending on how you use the Platform, we collect:

  • Identification: first and last name, institutional (university) email address and, if you add them, nickname and profile photo.
  • Contact: phone number (optional) and your preference on whether to show it to other users ("phone visible", off by default).
  • Location: coordinates (latitude and longitude) of the point you set as your home and the neighborhood label we derive from them.
  • University: the organization you belong to and the campuses you attend.
  • Class schedule: days, campuses and arrival/departure time slots.
  • Vehicle (drivers): make, model, color, license plate and number of seats.
  • Trips: trips you publish or join, origin, destination, meeting point, times, passengers, status and cancellation reason.
  • Companions: nudges you send and receive and the direct conversations opened when two people match.
  • Messages: content of trip chats and direct conversations within the Platform.
  • Ratings and comments: ratings you give and receive after trips.
  • Reports: reports you file or receive, their description and resolution.
  • Notifications: in-app notices we send you (new passenger, message, nudge, etc.) and whether you read them.
  • Reputation: average rating, number of trips, trust score (see section 11) and, where applicable, the reason for a suspension.
  • Preferences: language and email preferences.
  • Acceptance of terms: date and version of the Terms and Conditions and of this Policy that you accepted.
  • Technical and security data: IP address and browser (user agent) of each request, security logs with the action performed, date, IP and user (for example logins, profile changes, administrative actions) and request counters used to limit abuse (rate limiting).

3. Legal basis for processing

We process your personal data under the following bases of Law 25,326:

  • Free, express and informed consent (section 5): by registering you accept this Policy and the Terms and Conditions, and you expressly consent to the international transfer described in section 7.
  • Performance of a contract: processing is necessary to provide the carpooling service you requested.
  • Legitimate interest: security and moderation of the Platform, including the trust score, handling of reports and abuse prevention.
  • Legal obligation: where processing is required to comply with legal, judicial or administrative requirements in force in Argentina.

4. Purposes of processing

We use your personal data to:

  • Verify that you belong to a university community through your institutional email and a one-time code.
  • Connect you with compatible companions and trips: we match your class schedule and the distance between your home and other users' homes at your university to show you compatible companions and published trips that fit your schedule.
  • Coordinate trips: publishing trips, managing passengers, chat, meeting points, automatic closing of expired trips and ratings.
  • Security and moderation: trust score, handling of reports, incident investigation, account suspension and audit logs.
  • Communications: verification codes, in-app notifications and emails about your account, your trips, nudges and matches with companions, and trips compatible with your schedule (see section 13).
  • Service improvement: aggregated, anonymous usage statistics.
  • Legal compliance: responding to requests from competent authorities.

5. Data visible to other users

PUL is a closed community: only registered, verified users of your own university can see your profile. For the service to work, the following data is visible to them:

  • Name (or nickname, if set) and profile photo or initials.
  • University, average rating, number of completed trips and how long you have been on PUL.
  • Approximate neighborhood of your home and the approximate distance between your area and that of the user viewing your profile.
  • Days and campuses of your class schedule; exact times only if their schedule is compatible with yours.
  • Make, model, color and seats of your vehicle, if added. Never the license plate.
  • Your phone number only if you turn on "phone visible", and only to people with compatible schedules or with whom you share a trip. It is hidden by default.
  • On trips you publish or join: the meeting point and time. In conversations: the messages you write.

Your exact address is never shown to other users. PUL administrators can see your location on an internal map for moderation and statistics; that map is not public.

6. Sharing data with third parties

We never sell or trade your personal data.

We only share personal data in the following cases:

  • Service providers (data processors): Hostinger International Ltd. hosts PUL's server and database and provides the email delivery service. Hostinger processes data on behalf of BASEL DATA under a data processing agreement (DPA), solely to provide those services. We do not use third-party analytics, advertising or social media tools.
  • Legal or judicial requirement: where a court order, a request from a competent authority or a legal obligation so requires.
  • Aggregated and anonymized data: we may share aggregated statistics (for example, number of trips or users per campus) with member universities for mobility and sustainability reports, without any user being identifiable.

7. International data transfers

Your data is hosted on Hostinger International Ltd. servers located in São Paulo, Brazil, and emails are sent through Hostinger servers. Brazil has not been declared a country with an adequate level of protection under DNPDP Provision 60-E/2016.

By registering on PUL you give your express consent to this international transfer (section 12, paragraph 2(a) of Law 25,326). The transfer is also supported by data protection contractual clauses with the provider. You may withdraw this consent at any time by deleting your account (section 9).

8. Data retention periods

We keep your personal data for the following periods:

  • Account data: while the account is active. Accounts with no activity for more than 12 (twelve) months may be closed as set out in the Terms and Conditions.
  • Chat messages (trip and direct): 6 (six) months from sending; they are then deleted automatically by a periodic process.
  • In-app notifications: read notifications are deleted after 90 (ninety) days.
  • Reports and resolutions: 2 (two) years for security and prevention purposes; then deleted.
  • Nudges: valid for 30 (thirty) days to detect matches.
  • Verification codes (OTP): valid for 10 (ten) minutes. Stored only as a cryptographic hash, discarded when used, when a new one is issued or during periodic cleanup.
  • Technical security logs: kept for a short period (roughly up to 30 days, depending on activity volume). Rate-limit counters expire within hours and are purged every 6 hours.
  • Backups: a daily database backup is kept for 7 (seven) days; backups taken before each system update are kept up to 5 (five) versions. Deleted data may persist in those copies until they rotate.

9. Deleting your account

You can delete your account from the Profile section of the Platform or by writing to info@pul.com.ar. Deletion is immediate and irreversible and consists of:

  • Anonymized immediately: name, nickname, email, phone, profile photo, location and neighborhood. Your schedules and vehicle are deactivated and no longer visible. Any open trips you had are cancelled and their passengers notified.
  • Kept, unlinked from your identity and for the periods in section 8: the messages you exchanged (still visible to the other person, without your name), ratings you gave and received, reports you were involved in and the trip history, for security, dispute resolution and statistics.

Anonymized data cannot be linked back to you, so a deleted account cannot be recovered.

10. Your rights (access, rectification, deletion and objection)

Under sections 14 and 16 of Law 25,326, as the data subject you have the right to:

  • Access: know what data we hold about you and how we process it. We reply within 10 (ten) calendar days of receiving the request.
  • Rectification, update or deletion: correct inaccurate data or request its deletion. We do so within 5 (five) business days of receiving the request. Most of your data (name, nickname, phone, location, schedules, vehicle, preferences) can be edited by you from your profile.
  • Objection and withdrawal of consent: object to processing or withdraw your consent, including consent to the international transfer, in which case we will delete your account.

To exercise these rights write to info@pul.com.ar from your registered email, stating your full name and the right you wish to exercise. Requests are free of charge.

THE DATA SUBJECT HAS THE RIGHT TO ACCESS THEIR PERSONAL DATA FREE OF CHARGE AT INTERVALS OF NO LESS THAN SIX MONTHS, UNLESS A LEGITIMATE INTEREST IS DEMONSTRATED PURSUANT TO SECTION 14, PARAGRAPH 3 OF LAW No. 25,326. (Mandatory notice under AAIP Provision 10/2008; the official wording is the Spanish one.)

Note that deleting data essential to the service (for example, your institutional email) means deleting the account.

11. Reputation and trust score

Your profile shows the average rating you receive from other users and the number of completed trips. Ratings are shown without indicating who gave them. Each account also has an internal trust score that starts at 100, rises when you complete trips and drops with late cancellations and substantiated reports. The score does not deactivate accounts automatically: suspensions are decided and reviewed by a person on the PUL team.

12. Security measures

We implement reasonable technical and organizational measures to protect your data against unauthorized access, alteration, disclosure or destruction:

  • Encryption in transit: all communication between your device and our servers uses HTTPS/TLS.
  • No passwords: access is through a one-time code sent to your institutional email; the code is stored only as a cryptographic hash.
  • Secure session: signed session cookie with the httpOnly, secure and SameSite attributes.
  • Role-based access control: only authorized BASEL DATA staff access personal data, and every administrative action is logged.
  • Rate limiting: protection against brute force and abuse on login, registration and sensitive actions.
  • Isolation and backups: the database is not reachable from the internet; daily backups with restricted access are kept for 7 days.

No system is infallible. If we become aware of a security incident affecting your data, we will notify you by email.

13. Emails we send you

We email your institutional address in these cases:

  • Account and security (cannot be turned off): login verification code, notices about reports you receive or file, suspension or reactivation of your account and relevant changes to these documents.
  • Your trips (cannot be turned off while you take part in a trip): new passenger, changes, start, completion or cancellation of a trip you are part of, and new ratings.
  • Companions and compatible trips (can be turned off): when another user nudges you, when you match and when a trip compatible with your schedule is published. You can disable each of these from Profile → Email notifications.

All our emails state why you receive them and BASEL DATA's details. We do not send advertising or give your email to third parties.

14. Cookies and local storage

PUL uses only technical cookies required for the Platform to work. There are no third-party, analytics or advertising cookies.

  • pul-session: session cookie (signed token) with the httpOnly, secure and SameSite=Lax attributes. It expires on logout or after 7 days.
  • NEXT_LOCALE: remembers your chosen language (Spanish or English).
  • Browser local storage (localStorage and application cache): app preferences (for example, whether you dismissed the install prompt) and static files so the app loads faster and works offline. This data never leaves your device.

15. Minors

PUL is intended exclusively for people aged 18 or over. By registering you declare that you are of legal age. We do not knowingly collect data from minors; if we learn that someone under 18 has registered, we will delete their account.

If you are a parent or guardian and believe a minor in your care has registered on PUL, write to info@pul.com.ar.

16. Changes to this Privacy Policy

We may change this Policy. Each version carries a date and version number at the top of the document. For material changes we will notify you by email or within the Platform and ask you to accept the new version to keep using PUL. We keep the date and version you accepted.

17. Contact and supervisory authority

For any question, complaint or request regarding the processing of your personal data you can contact us at:

You also have the right to file a complaint with the supervisory authority:

  • Supervisory authority: Agencia de Acceso a la Información Pública (AAIP)
  • Address: Av. Pte. Gral. Julio A. Roca 710, 2nd floor, Autonomous City of Buenos Aires, Argentina
  • Website: www.argentina.gob.ar/aaip

THE AGENCY FOR ACCESS TO PUBLIC INFORMATION, IN ITS CAPACITY AS SUPERVISORY BODY OF LAW No. 25,326, HAS THE POWER TO HANDLE COMPLAINTS AND CLAIMS FILED BY THOSE WHOSE RIGHTS ARE AFFECTED BY NON-COMPLIANCE WITH THE PERSONAL DATA PROTECTION RULES IN FORCE. (Official Spanish wording: "La AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N.º 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales.")