Privacy Policy

Last updated: January 1, 2026 · Version: 1.0.0 · Applies to: sociosplus.la and the SociosPlus mobile app for Android and iOS.

1. Introduction

SociosPlus is a multi-tenant Software-as-a-Service (SaaS) platform used by trade unions, mutual aid societies, professional associations and clubs ("Organizations") to manage their member rosters, dues, benefits and administrative procedures. The SociosPlus mobile app is a wrapper (Trusted Web Activity/WebView) that displays the mobile view of the web portal of the Organization each user belongs to. The only user profile available in the app is "Member".

This document describes what personal data we process, for what purpose, for how long, with whom we share it, and how you can exercise your rights. Country-specific sections cover Mexico, Argentina, Chile, Colombia, Uruguay, the European Union / United Kingdom and rest of the world.

2. Controller and Processor

The legal relationship over your personal data has two layers:

  • Your Organization (the union, mutual, association or club you belong to) is the Data Controller of your data as a member: name, ID number, address, employment data, family details, dues, benefits, medical leave, etc. The Organization decides what data is collected, why, and for how long it is kept.
  • SociosPlus (SAMUEL GASTON BERENSTEIN, with registered office at Aguirre 1675, CABA, Argentina) acts as Data Processor on behalf of and following the documented instructions of the Organization. SociosPlus acts as Controller only for platform operational data (technical logs, sign-in, security incidents).

For inquiries or to exercise your rights, please contact contacto@sociosplus.la. Where appropriate, we will route your request to the Organization acting as Controller.

3. Personal data we process

The following data is either loaded by your Organization or uploaded by you through the app:

  • Identity: full name, national ID (DNI, CURP/RFC, RUT, CC, CI according to country), date of birth, gender, profile picture.
  • Contact: postal address, phone number, email.
  • Employment: employer, category, seniority, employment status, contributions, declared salaries.
  • Financial / associative: membership dues, debts, payments, benefits granted (amounts), redeemed coupons.
  • Family / dependents: name, ID, date of birth and relationship of spouse, children and dependents; plus supporting documents (education certificates, disability certificates, PDF/image files).
  • Technical: truncated IP address, device type and operating system, app version, access logs. Only for security and diagnostics.

4. Sensitive data (special categories)

Explicit consent required. Sensitive data is only processed when you expressly upload it or provide it to the Organization.

  • Health data: only when you upload a medical leave certificate, disability certificate or request a health-related benefit. Each upload includes an explicit consent checkbox.
  • Trade union membership: if your Organization is a union, holding an app account implies union membership. Processing is based on your consent granted upon affiliation and on the union's legitimate interest in administering its roster.

5. Purposes of processing

Primary purposes (necessary to provide the service):

  • Authenticate you and give you access to your member profile.
  • Display and manage dues, contributions, benefits and procedures.
  • Allow you to upload receipts, medical leave certificates and updates to personal and family data.
  • Issue digital credentials, certificates and receipts.
  • Send operational notices (dues overdue, benefit approved, appointment, general assembly).
  • Prevent fraud, abuse and secure the platform.
  • Comply with legal obligations (tax, labor, associative, accounting).

Secondary purposes (not required to provide the service; you may refuse without any impact on the app):

  • Sending satisfaction surveys and product improvement questionnaires.
  • Sending informational communications from your Organization that are not strictly operational (e.g. cultural news or partner discounts).

How to refuse secondary purposes: email contacto@sociosplus.la with the subject "Opt-out of non-operational communications" and your email/ID number. You may also use the unsubscribe link at the bottom of every non-transactional email. Exercising this option has no cost or consequence on your membership status.

What we do not do: we do not sell personal data, we do not perform advertising profiling, we do not share data with ad networks, we do not include third-party SDKs for marketing in the app, and we do not take decisions based solely on automated processing that produce legal effects on you.

6. Legal basis by purpose

  • Performance of contract / associative bond: for all primary purposes derived from your member status.
  • Explicit consent: for processing sensitive data (health), for geolocation, and for non-operational communications.
  • Legal obligation: for tax, accounting and associative retention and to respond to competent authorities.
  • Legitimate interest: for platform security, fraud prevention and aggregate, non-identifiable service improvement.

7. Device permissions used by the app

  • Camera and storage: only requested when you tap "attach" on a form (profile picture, receipt, medical leave). We use the operating system's file picker. Your gallery is never accessed in the background.
  • Location: optional. Only prompted when your Organization enables check-in for general assemblies or union events, and only at the moment you tap the check-in button. No background tracking or continuous collection.
  • Push notifications: prepared but not enabled by default. When enabled they will be strictly transactional (dues overdue, benefit approved, appointment, assembly). You can disable them from the operating system.

8. Transfers and hosting

SociosPlus data is hosted on a virtual private server (VPS) provided by GoDaddy, physically located in United States. This implies an international data transfer for Organizations and members from Argentina, Chile, Colombia, Mexico, Uruguay and other countries.

We apply the following safeguards:

  • Data Processing Agreements with our hosting provider and TLS 1.2+ encryption for all traffic.
  • Standard Contractual Clauses (SCC) when the transfer involves EU/UK territory.
  • Backup encryption at rest.

We share data only with:

  • Your Organization (Controller of the roster).
  • Necessary infrastructure providers: hosting (GoDaddy), transactional email (GoDaddy Professional Email), payment gateways when the Organization uses them. All under processor agreements.
  • Competent authorities upon a lawful and duly founded request.

9. Data retention

We keep your personal data while you have an active bond with your Organization, plus applicable statutory retention periods:

  • Tax and payment data: for the periods required by the tax rules of the Organization's country (typically 5 to 10 years).
  • Employment / associative data: for periods required by labor law or the association's statute.
  • Health data: for the minimum period necessary for the purpose; afterwards anonymized or deleted.
  • Technical logs: maximum 90 days.

After these periods, data is irreversibly deleted or anonymized.

10. Security measures

  • TLS 1.2+ encryption in transit on all connections.
  • Password hashing with modern algorithms.
  • Role-based access control and least-privilege principle.
  • Regular encrypted backups.
  • Audit logs of access and modification of sensitive data.
  • Incident management procedure and notification to authorities and data subjects where required.

11. Minors

The app is intended for individuals aged 16 or older, the typical age of employment affiliation. Data about minors in the family group is uploaded by the adult member acting as legal guardian and treated with the same safeguards as an adult's data, with access restricted to the member and the Organization.

12. Exercise of rights

In every country where we operate you may exercise, at a minimum, the following rights: access, rectification, cancellation/erasure, objection and withdrawal of consent. In jurisdictions that provide for them, also portability and restriction of processing (see country-specific section below).

  1. Email contacto@sociosplus.la from your registered email, stating the right you wish to exercise and attaching a copy of your ID for verification.
  2. We reply within 20 business days (or the shorter period required by your country's law).
  3. To delete your account, use the Delete my account form.
  4. You may withdraw consent at any time; withdrawal does not affect the lawfulness of prior processing.

13. Country-specific notice

Select your jurisdiction to view the applicable legal supplement. The previous sections apply to all countries; the following sections add the formal requirements of each local law.

🇲🇽 Mexico — Comprehensive Privacy Notice (LFPDPPP)

Pursuant to the Federal Law for the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations and the Privacy Notice Guidelines issued by INAI.

a) Identity and address of the controller

The Organization you are affiliated with is the primary Controller of your roster data. SociosPlus acts as Processor on behalf of the Organization and as Controller for platform operational data. Processor's address: SAMUEL GASTON BERENSTEIN, Aguirre 1675, CABA, Argentina, contacto@sociosplus.la.

b) Personal data collected

As listed in section 3 of this policy (including CURP and RFC).

c) Sensitive data collected

Express notice: the Controller collects and processes sensitive personal data concerning health (when the data subject uploads medical leave certificates, disability certificates or requests health-related benefits) and data revealing trade union membership. The data subject grants express consent upon acceptance of this notice and upon each upload.

d) Primary and secondary purposes

As described in section 5 of this policy. Secondary purposes are separable and may be refused.

e) Mechanisms to refuse secondary purposes

Email contacto@sociosplus.la with the subject "Refusal of secondary purposes — LFPDPPP" indicating your full name, registered email and CURP or membership number. You have five (5) business days from the moment this notice is made available to you to exercise this right; you may nonetheless do so at any time thereafter.

f) Transfers

Your data may be transferred to the Organization, to necessary processors (hosting, transactional email, payment gateways) and to competent authorities.

Express acceptance of transfers (art. 36 LFPDPPP): if you do not express your opposition, your consent to the transfer shall be deemed granted. To object, email contacto@sociosplus.la before completing your enrollment.

g) Legal basis for transfers

Articles 36 and 37 LFPDPPP: transfers necessary to perform the associative bond (section IV) and to comply with legal obligations (section III). Express consent is obtained where required.

h) ARCO rights, consent revocation and limitation of use/disclosure

You may exercise your Access, Rectification, Cancellation and Objection (ARCO) rights, revoke consent and limit use/disclosure by emailing contacto@sociosplus.la with your full name, contact address, ID copy, precise description of the right and, if applicable, supporting documents. Response within 20 days from receipt, extendable for an equal period upon justified cause (art. 32 LFPDPPP). If the request is granted, it will be implemented within 15 days.

i) Changes to the notice

Any change will be communicated via publication at this URL with at least 30 days' advance notice and will also be notified by email or in-app.

j) Supervisory authority

Should you consider your right to data protection has been affected, you may file a complaint with the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI) — Insurgentes Sur 3211, Col. Insurgentes Cuicuilco, C.P. 04530, Mexico City. home.inai.org.mx.

🇦🇷 Argentina — Law 25.326 on the Protection of Personal Data

Controller

SAMUEL GASTON BERENSTEIN, address Aguirre 1675, CABA, Argentina. Rights: contacto@sociosplus.la.

Purpose

Provide the SaaS service to the Organization you belong to, allow you to access your member profile, manage dues, benefits, medical leave and procedures, and comply with applicable legal duties.

International transfers

Data is processed on infrastructure located in United States. The United States is not listed as an adequate country under AAIP Disposition 60-E/2016; therefore, the transfer relies on the data subject's consent (art. 12 sec. 2 e) and on contractual clauses that mirror Law 25.326 principles.

Database registration

The "Member roster processed as Processor" database is not independently registered by SociosPlus, since the obligation to register the member roster with the AAIP National Database Registry rests, under art. 21 of Law 25.326, on the Organization as the Controller of the roster with the AAIP National Database Registry. Registration, where applicable, is the responsibility of the Organization owning the roster.

Rights

You have the right to access (free of charge at intervals no shorter than six months, art. 14), rectification, update and deletion (art. 16). You may at any time request the removal or blocking of your name from the database.

The Agency for Access to Public Information (AAIP), supervisory authority under Law 25.326, handles complaints. argentina.gob.ar/aaip.

🇨🇱 Chile — Law 19.628 (2024 update)

Controller

SAMUEL GASTON BERENSTEIN, acting as Processor for the Organization. Contact: contacto@sociosplus.la.

Purpose and processing

Data is processed for the purposes described in section 5. Consent is free, informed, specific and provided in writing/electronically upon accepting this notice and using the app.

Sensitive data

Health data and trade union membership are processed with explicit consent and only for the specific purposes for which they were provided.

Rights (ARCO + Portability)

You may request access, rectification, cancellation (deletion), objection and portability. Requests to contacto@sociosplus.la.

Supervisory authority

Once the Personal Data Protection Agency becomes fully operational under the new law, it will be the competent authority. Until then, ordinary courts of justice may be seized under the procedures set forth in Law 19.628.

🇨🇴 Colombia — Law 1581 of 2012 and Decree 1377 of 2013

Controller and Processor

The Organization is the Controller. SAMUEL GASTON BERENSTEIN is the Processor. Contact: contacto@sociosplus.la.

Purposes

As described in section 5.

Sensitive data (art. 5 Law 1581)

Health data and trade union membership are sensitive data and are only processed with the data subject's prior, express and informed authorization, granted upon acceptance of this notice and upon each upload. You are not obliged to authorize the processing of sensitive data; refusal does not affect the rest of the associative relationship, although it may prevent access to certain benefits (e.g. medical leave).

Rights

To know, update and rectify data; obtain proof of authorization; be informed of use; file complaints with the SIC; revoke authorization and request deletion when there is no legal or contractual duty to remain in the database.

Consultation and complaint procedure

File your inquiry with contacto@sociosplus.la. Inquiries are answered within 10 business days (extendable by 5). Complaints are addressed within 15 business days (extendable by 8), per articles 14 and 15 of Law 1581.

Supervisory authority

Superintendence of Industry and Commerce (SIC) — Personal Data Protection Delegation, Bogotá D.C. sic.gov.co.

🇺🇾 Uruguay — Law 18.331

Controller

The Organization. SAMUEL GASTON BERENSTEIN acts as Processor. Contact: contacto@sociosplus.la.

Registration with URCDP

Where applicable, the database is not independently registered by SociosPlus. Registration with URCDP is the responsibility of the Organization as Controller of the roster, under arts. 28 et seq. of Law 18.331 with the Regulatory and Personal Data Control Unit (URCDP). Registration is the Organization's responsibility.

Rights

Access, rectification, update, inclusion, deletion, objection and withdrawal of consent (arts. 13-15 Law 18.331).

International transfers

AGESIC/URCDP recognizes as adequate the countries that signed Convention 108. The United States does not have a general adequacy declaration; transfers rely on the data subject's consent and on contractual clauses mirroring Law 18.331 principles.

Supervisory authority

URCDP — Torre Ejecutiva Sur, Liniers 1324, floor 4, Montevideo. gub.uy/urcdp.

🇪🇺 European Union / United Kingdom — GDPR / UK GDPR

Controller / Processor

The Organization is the Data Controller. SociosPlus (SAMUEL GASTON BERENSTEIN) is the Data Processor and has signed a Data Processing Agreement with the Organization. Generic privacy / DPO contact: contacto@sociosplus.la. DPO appointed: not appointed. Designation is not mandatory under GDPR art. 37: SociosPlus is not a public authority or body, does not carry out processing operations that require regular and systematic monitoring of data subjects on a large scale, and does not process special categories of personal data on a large scale. GDPR inquiries are routed through contacto@sociosplus.la.

Legal basis by purpose (art. 6 GDPR)

  • Performance of the associative bond (art. 6.1.b).
  • Consent (art. 6.1.a and art. 9.2.a for sensitive data) for health data, geolocation and non-operational communications.
  • Legal obligation (art. 6.1.c) for tax and accounting retention.
  • Legitimate interest (art. 6.1.f) for security and fraud prevention; balancing test documented and available upon request.

Rights of the data subject

Access, rectification, erasure (right to be forgotten), restriction, objection, portability, withdrawal of consent, and the right not to be subject to solely automated decisions (arts. 15-22 GDPR). You may lodge a complaint with your national Supervisory Authority (Spain: AEPD; United Kingdom: ICO).

International transfers

Transfers outside the EEA rely on Standard Contractual Clauses (SCC) approved by the European Commission (Decision 2021/914) and, for the UK, the ICO's International Data Transfer Addendum. A Transfer Impact Assessment (TIA) is performed for the destination country.

Retention by category

See section 9. Storage limitation principle applies (art. 5.1.e GDPR).

🌐 Rest of the world — General principles

Where the local law applicable to your jurisdiction is not covered above, SociosPlus applies the following universally accepted data protection principles as a minimum baseline:

  • Lawfulness, fairness and transparency.
  • Purpose limitation.
  • Data minimization.
  • Accuracy.
  • Storage limitation.
  • Integrity and confidentiality.
  • Accountability.

Even without a designated local authority, we guarantee the exercise of access, rectification, cancellation, objection and withdrawal of consent rights at contacto@sociosplus.la.

14. Changes to the privacy notice

We may update this document to reflect regulatory, technical or operational changes. Material changes will be announced with at least 30 days' advance notice via publication at this URL and notification to your registered email and/or inside the app.

15. Contact