Back to home

Privacy Policy — PUL

Last updated: February 2026

Welcome to PUL (pul.com.ar), a carpooling platform designed for Argentine university students. This Privacy Policy describes how we collect, use, share, and protect your personal data in accordance with Argentine Law 25.326 on Personal Data Protection and its regulatory provisions.

1. Data Controller

The entity responsible for the processing of your personal data is:

  • Company name: BASEL DATA S.R.L.
  • Argentine tax ID (CUIT): 30-71847186-5
  • Registered domicile: Buenos Aires City, Argentine Republic
  • Contact email: info@pul.com.ar

BASEL DATA S.R.L. operates the PUL platform and acts as the data controller for all personal information processed through the service.

2. Data Collected

We collect the following categories of personal data when you register, use, and interact with PUL:

  • Identification data: Full name, institutional email address (university-issued).
  • Contact data: Phone number (optional).
  • Location data: Latitude and longitude provided by the user, approximate area or neighborhood.
  • Vehicle data: Make, model, color, license plate number, and available seats (for drivers).
  • Academic schedules: Class times and university information used for trip matching.
  • Trip data: Origin, destination, departure and arrival times, assigned passengers.
  • Chat messages: In-app messages exchanged between users for trip coordination.
  • Ratings and comments: Feedback left by other users after shared trips.
  • Trust score: An internally calculated metric based on your reliability and behavior on the platform.
  • Technical data: IP address, user agent (browser and device information), session cookies.

3. Legal Basis for Processing

We process your personal data on the following legal grounds, in accordance with Argentine Law 25.326:

  • Explicit consent (art. 5, Law 25.326): You provide your free, express, and informed consent when you create an account and accept this Privacy Policy.
  • Contractual performance: Processing is necessary to deliver the carpooling service you have requested, including trip matching, coordination, and communication between users.
  • Legitimate interest: We have a legitimate interest in maintaining the security of the platform, preventing fraud, moderating content, and protecting the safety of our users.
  • Legal obligation: We may process data when required by Argentine law, regulation, or judicial or administrative order.

4. Purposes of Data Processing

Your personal data is processed for the following specific purposes:

  • Service delivery: Trip matching based on proximity and schedules, route coordination, passenger and driver pairing.
  • Security and moderation: Calculation and maintenance of the trust score, processing of user reports, investigation of incidents, and enforcement of community standards.
  • Communications: Sending one-time passwords (OTP) for authentication, in-app notifications, and service updates.
  • Service improvement: Anonymous statistical analysis, usage pattern evaluation, and platform optimization. No personally identifiable information is used for this purpose.
  • Legal compliance: Fulfilling obligations under applicable Argentine laws and responding to lawful requests from competent authorities.

5. Data Shared with Other Users

When you use PUL, certain information is visible to other users to facilitate carpooling:

  • Your public name or nickname.
  • Your average rating from other users.
  • Your university affiliation.

Your exact address is NEVER shown to other users. Only an approximate area or neighborhood is displayed for trip matching purposes. When a trip is confirmed, the driver sees only the agreed-upon meeting point — never the passenger's home address.

6. Third-Party Sharing

We do not sell or trade your personal data. We only share personal information in the following limited circumstances:

  1. Legal requirement: When compelled by law, regulation, or order from a competent judicial or administrative authority.
  2. Service providers: With third-party providers who assist in operating the platform (such as hosting and email delivery services), always under strict confidentiality agreements that ensure the same or higher level of data protection.
  3. Aggregated anonymous data: We may share anonymized, aggregated statistics with partner universities for sustainability and mobility reports. This data cannot be used to identify any individual user.

7. International Data Transfers

Your data may be hosted on servers located in the European Union. The European Union is recognized as providing an adequate level of data protection by the Argentine National Directorate for Personal Data Protection (DNPDP), pursuant to Disposition 60-E/2016. This means your data benefits from protections equivalent to those guaranteed under Argentine law when transferred to or stored in the EU.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy. The specific retention periods are:

  • Active account: Your data is retained for the duration of the contractual relationship — that is, as long as your account remains active.
  • Deleted account: Upon account deletion, your personal data is anonymized within 30 business days. After anonymization, the data can no longer be linked to your identity.
  • Chat messages: Retained for 6 months after the associated trip, then permanently deleted.
  • Reports and resolutions: Retained for 2 years to support moderation integrity and dispute resolution.
  • One-time passwords (OTP): Automatically deleted 10 minutes after generation.

9. Your Rights (ARCO Rights)

Under articles 14 and 16 of Argentine Law 25.326, you have the following rights regarding your personal data:

  • Access: You may request information about the personal data we hold about you and how it is being processed.
  • Rectification: You may request correction of inaccurate or incomplete personal data.
  • Cancellation / Deletion: You may request the deletion or anonymization of your personal data when it is no longer necessary for the purposes for which it was collected.
  • Opposition: You may object to the processing of your personal data on legitimate grounds.

To exercise any of these rights, send an email to info@pul.com.ar identifying yourself and specifying the right you wish to exercise. Requests are free of charge and will be answered within 10 business days.

Please note that deleting data that is essential for the operation of the service may result in the inability to continue using PUL.

10. Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

  • HTTPS/TLS encryption: All communications between your device and our servers are encrypted in transit.
  • Cryptographic hashing of OTP codes: One-time passwords are never stored in plaintext; only their cryptographic hashes are retained during the brief validity window.
  • Role-based access control: Internal access to personal data is restricted to authorized personnel on a need-to-know basis.
  • Rate limiting: Authentication endpoints are protected against brute force attacks through request rate limiting.
  • Encrypted backups: Database backups are encrypted at rest.
  • Data anonymization: When an account is deleted, personal data is irreversibly anonymized rather than simply removed.

11. Cookies

PUL uses only the following types of cookies:

  • Technical session cookies: Used for JWT-based authentication. These cookies are flagged as httpOnly and secure, meaning they cannot be accessed by client-side scripts and are transmitted only over encrypted connections.
  • First-party analytics: Minimal, self-hosted analytics to understand usage patterns and improve the service.

We do not use third-party cookies, advertising trackers, or cross-site tracking technologies.

12. Minors

PUL is not directed at persons under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that a user is under 18, we will promptly delete the associated account and all related personal data.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you via email and/or through a notice within the PUL platform.

Continued use of the platform after notification of changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you should discontinue use of the service and request deletion of your account.

14. Contact and Supervisory Authority

If you have questions, concerns, or wish to exercise your data protection rights, please contact us at:

If you believe that your data protection rights have not been adequately addressed, you have the right to file a complaint with the competent supervisory authority:

  • Authority: Agencia de Acceso a la Informacion Publica (AAIP)
  • Address: Av. Pte. Gral. Julio A. Roca 710, 2nd Floor, Buenos Aires City, Argentine Republic
  • Website: www.argentina.gob.ar/aaip

In case of discrepancy between the Spanish and English versions of this policy, the Spanish version shall prevail.