ChallenPay
Contents
This document forms an integral part of the General Terms and Conditions of Use. By using the ChallenPay website (the "Website") and the ChallenPay mobile application (the "App"), and by contracting services through them, you accept the policies set out here. Any term not expressly defined in this document has the meaning given to it in the Terms and Conditions.
ChallenPay LLC, a company organized under the laws of the State of Delaware, United States, with registered address at 16192 Coastal Highway, Lewes, Delaware 19958, USA (the "Company"), is the controller of the personal data of Users of the Service.
In compliance with Argentine Law No. 25,326 on the Protection of Personal Data and other applicable legislation, the Company undertakes to adopt the technical and organisational measures necessary for a level of security appropriate to the risk of the data collected.
Privacy contact: info@challenpay.com · ChallenPay LLC, 16192 Coastal Highway, Lewes, Delaware 19958, USA.
When you request that withdrawals be enabled, we collect and process:
Purpose. To verify your identity before transferring funds, to prevent fraud and impersonation, and to comply with applicable legal obligations.
Legal basis. Performance of the contract between us and compliance with the Company's legal obligations.
Provider involved. This process is carried out with the involvement of a specialist identity verification provider established in the European Union, which acts as a processor on the Company's behalf and to which the images and data described are transferred for the sole purpose of carrying out the verification.
Retention. Document images and extracted data are kept for five (5) years from the closure of the Account, in compliance with legal identification and fraud prevention obligations, and are then deleted.
The Company does not collect or store credit or debit card numbers, or their security codes. Balance top-ups are processed through an external payment platform, which processes that data as its own controller under its own privacy policy. The Company receives from it only the transaction identifier, its status and the amount.
For withdrawals we do collect and retain the bank account details you provide (CBU, alias and account ownership), as well as the movement history of your virtual wallet, which is retained for the periods required by applicable accounting and tax rules.
5.1. Camera and microphone. To take part in Challenges and publish content, the Service requests access to your device's camera and microphone. Access is activated only at the moment of capture and requires prior permission from the operating system, which you may revoke at any time in your device settings. The captured content — which may include your image and your voice — is stored on third-party servers engaged by the Company and published according to the visibility applicable to the Challenge or post.
5.2. Location. If you allow the Service to access your device's location services, we may collect your location at the level of precision you have authorised, in order to show you Challenges and content relevant to your area. You may revoke that permission at any time. Independently of this, the IP address you connect from allows an approximate location to be inferred.
All audiovisual content you upload to the Service is subjected, before publication, to automated analysis designed to detect child sexual abuse material, using a hash-matching service provided by a third party established in the United States of America. The analysis is performed on the technical representation of the file and its result is stored with the content.
Where the analysis, or subsequent human review, produces a confirmed match, the Company will retain the content, the associated metadata and the User's identifying data for evidentiary purposes, and will make the corresponding report to the National Center for Missing & Exploited Children (NCMEC) of the United States of America and to the competent Argentine authorities. This processing is based on compliance with legal obligations and on the public interest in protecting children, and does not require the consent of the User concerned.
| Purpose | Legal basis |
|---|---|
| Creating and administering your Account and providing the Service | Performance of the contract |
| Organising and running Challenges, evaluating entries and determining results | Performance of the contract |
| Administering your virtual wallet, processing top-ups, crediting prizes and executing withdrawals | Performance of the contract |
| Verifying your identity before enabling withdrawals | Performance of the contract and legal obligation |
| Verifying your email and phone, and sending you security alerts | Performance of the contract and legitimate interest in security |
| Moderating content, handling reports and applying sanctions | Legitimate interest and legal obligation |
| Analysing content and reporting incidents under section 6 | Legal obligation and public interest |
| Personalising the content shown to you | Legitimate interest, with a right to object |
| Preventing fraud and abuse of the Service | Legitimate interest |
| Complying with accounting, tax and record-keeping obligations | Legal obligation |
| Responding to your enquiries and claims | Performance of the contract |
When you create your account you are asked to choose categories and Challenges of interest. Those initial preferences, together with your subsequent activity — Challenges you have entered, interactions with content and Users you follow — are used to order and recommend the content shown to you.
This personalisation produces no legal effects on you, does not affect your participation in Challenges or their results, and does not constitute an automated decision with significant effects. You may request information about the criteria applied and object to personalisation by writing to info@challenpay.com.
9.1. Email. By using the Service you authorise the Company to send you emails relating to your Account, to the Challenges you take part in, and in response to your enquiries. The Company may also send you information about the Service, without prejudice to your ability to indicate that you do not wish to receive such communications through the unsubscribe mechanisms included in each message.
9.2. Push notifications. If you authorise them in your browser or device, the Company will send you notifications about your account activity and the Challenges you take part in. A subscription identifier is stored for each authorised device. You may revoke that authorisation at any time from your browser or device settings, or from your notification preferences within the Service.
9.3. Text and WhatsApp messages. SMS and WhatsApp messaging is governed by the Messaging Privacy Policy and the Messaging Terms.
To provide the Service, the Company shares personal data with the following categories of recipient, which act as processors on its behalf unless otherwise stated:
| Recipient | Purpose | Data received |
|---|---|---|
| Managed database provider | Hosting the Service database | Account, activity and wallet data |
| File storage provider | Storing audiovisual content and identity document images | Published content and identity documentation |
| Payment processor | Balance top-ups and withdrawal payouts | Payer identification, amount and transaction status |
| Identity verification provider | Documentary verification before withdrawals | Document images, extracted data and result |
| Content safety analysis service | Automated detection under section 6 | Digital fingerprint of audiovisual content |
| Reporting body (NCMEC) | Legal reporting of confirmed incidents | Content, metadata and User identification |
| Communications providers | Email, phone verification and push notifications | Email address, phone number and message content |
| Real-time messaging server | Chat between Users | User identifier and message content |
| Deployment and analytics platform | Running the Service and usage statistics | Technical connection data |
| Social sign-in providers | Authentication with external accounts | Email address, name and profile picture |
We may also share data with professional advisers — lawyers, auditors, banks and insurers — and with public bodies that require us to report. We require all third parties to respect the security of your information and to process it in accordance with the law and our instructions.
Cooperation with public authorities. The Company may disclose personal information at the request of a competent judicial or governmental authority in the context of investigations conducted by them, or where disclosure is necessary to protect the rights, safety or property of the Company, its Users or the public.
The Company does not sell, rent or transfer your personal data to third parties for those third parties' own marketing or advertising purposes.
Some of your data is stored and processed in countries which, under Argentine law, are not deemed to provide an adequate level of protection, in particular the United States of America. In those cases the Company enters into the contractual clauses required for that purpose by the Argentine supervisory authority, a copy of which is available on request by writing to info@challenpay.com.
While your Account remains active we retain the data necessary to provide the Service. Once the Account is closed, data is retained for the following periods, according to its purpose:
| Category | Period |
|---|---|
| Profile data, published content and communications | 2 years |
| Wallet accounting records, payment and withdrawal receipts | The period required by applicable accounting and tax rules |
| Identity verification data and documentation | 5 years |
| Audit records of moderation, sanctions and prize distribution | 5 years |
| Data relating to incidents reported to competent authorities | The period required by those authorities |
| Data used for commercial communications | Until you withdraw consent, and in any event after 2 years of inactivity |
Scope of deletion. Deleting the Account removes your public profile and ends its visibility within the Service. Data covered by the periods above remains stored with restricted access and is used solely for the purposes stated. Once those periods expire, the data is deleted or irreversibly anonymised.
The Company adopts technical and organisational measures appropriate to the level of risk of the data processed, in order to prevent its destruction, loss or accidental or unlawful alteration, as well as unauthorised access. These include encryption of data in transit, role-based access controls, audit logging of administrative access, and restricted storage of identity documentation.
As the impregnability of the internet cannot be guaranteed, the Company undertakes to notify you without undue delay of any breach of the security of your personal data that is likely to result in a high risk to your rights and freedoms.
Personal data is treated as confidential by the Company, which undertakes to ensure through legal or contractual obligations that this confidentiality is respected by its employees, collaborators and suppliers.
14.1. A cookie is a small piece of text that the Website sends to your browser, allowing it to remember information about your visit.
14.2. Consent. Cookies necessary for the Service to function — in particular those that keep you signed in — are set without requiring consent, as they are essential to the service you have requested. All other categories are set only with your prior consent, given through the preferences panel available on entry and changeable at any time from the Website settings.
14.3. Types of cookies we use:
14.4. You can also manage cookies from your browser settings, blocking or deleting them; note that this may affect how the Service works.
As a data subject you may exercise the following rights:
How to exercise them. By writing to info@challenpay.com or by post to ChallenPay LLC, 16192 Coastal Highway, Lewes, Delaware 19958, USA, stating your name, a copy of your identity document or any other valid means of evidencing your identity, the specific request, an address or email for notices, and the date. If you act through a representative, that representation must be evidenced.
Response times. Ten (10) calendar days for access requests and five (5) business days for rectification, updating or erasure requests.
The Service is intended exclusively for individuals aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we learn that we have done so, we will suspend the Account and delete that data, retaining only what is strictly necessary to document the closure.
17.1. The Service may include links to third-party websites not operated by the Company. The owners of those sites have their own privacy policies and are responsible for their own practices.
17.2. If you believe that the way we process your personal data infringes applicable regulations, you have the right to effective judicial protection and to lodge a complaint with the supervisory authority. In the Argentine Republic, the Agencia de Acceso a la Información Pública.
The Company reserves the right to amend this Privacy Policy, on its own initiative or as a result of legislative or case-law developments. The version in force is always published on this page, with its version number and date. Changes that materially affect the processing of your data will be notified to you by email to the address you have provided, before they take effect.
This is an English translation provided for convenience. The Spanish version, available at challenpay.com/privacidad, is the binding version; in the event of any discrepancy, the Spanish text prevails.