Privacy Policy
Last updated: 08/27/2026
This policy explains what personal data ViaParaguay processes, for what purpose, on what legal basis, with whom it is shared and for how long it is kept. It is written to describe what the site actually does, not what would be convenient to declare.
1. Who processes your data
The data controller is ViaParaguay.com, a website operated in the Republic of Paraguay, with its address for service of notices at Dr. Francisco Morra 940, Asunción 001411.
The channel enabled for any matter relating to your personal data — enquiries, complaints and the exercise of rights — is the site's contact form.
Law No. 7,593/2025 on Personal Data Protection was enacted on 27 November 2025 and will come into force on 27 November 2027. Until then, Law No. 1,682/2001 and its amendments apply. This policy already meets the standard of Law 7,593/2025 rather than waiting for it to become enforceable.
2. What data we process
We process only the data we need to provide each service. Depending on what you do on the site, this may include the following:
- User account: name, email address, phone number, profile picture, preferred language and password, which is stored encrypted and never in plain text.
- Enquiries to advertisers: name, email, phone, language, type of interest, the message you write and the campaign parameters that brought you to the site.
- Ticket purchases: the buyer's name, email, phone and identity document number, IP address, browser identifier and, if you pay by bank transfer, the receipt you upload.
- Billing details for companies and professionals: legal name, tax identification number or equivalent document, address, city and billing email.
- Reviews, ratings and answers to satisfaction surveys, including those answered over WhatsApp.
- Messages exchanged with the platform through WhatsApp, when you start a conversation on that channel.
- Browsing data: pages viewed, session identifier, country, referring site, and your IP address and browser identifier, the latter two stored in an encrypted and irreversible form in our visit metrics.
- Data received from Google or Facebook if you choose to sign up or sign in with those accounts: name, email and profile picture.
3. Why we process it and on what legal basis
Each processing operation has a specific purpose and a legal basis that permits it, in accordance with article 5 of Law No. 7,593/2025. This table summarises them together with the applicable retention period.
| Purpose | Legal basis | Retention |
|---|---|---|
| Creating and maintaining your account and its features (favourites, alerts, comparison tool) | Performance of the contract | While the account is active and up to 12 months after it is closed |
| Passing your enquiry to the advertiser so they can reply | Performance of the contract and pre-contractual steps | Up to 24 months from the last contact |
| Issuing tickets, validating entry to the event and allowing them to be resent | Performance of the contract | Up to 24 months after the event |
| Issuing invoices and meeting tax obligations | Compliance with a legal obligation | The period required by tax legislation |
| Measuring use of the site and attributing advertising campaigns | Consent in the European Union; legitimate interest elsewhere | Up to 24 months |
| Preventing fraud, abuse and attacks, and maintaining the security of the service | Legitimate interest | Up to 24 months |
| Sending you newsletters and commercial communications | Consent, revocable at any time | Until you unsubscribe |
| Handling enquiries, complaints and the exercise of rights | Compliance with a legal obligation and legitimate interest | Up to 5 years from the close of the matter |
4. What happens when you enquire about a property or a service
It matters that you understand this point before sending an enquiry.
When you complete a contact form about a property, a development, a business or a professional, we pass your contact details and your message to that advertiser so they can reply. That transmission is the service itself: without it, the enquiry never reaches its destination.
From that moment, the advertiser becomes an independent controller of your data and is answerable for the use they make of it. We require them contractually to use it only to answer your enquiry and not to transfer or resell it, but we do not technically control what happens inside their systems.
To exercise your rights against an advertiser, contact them directly. You may also write to us through the contact form and we will tell you who your request concerns and what data we passed on to them.
5. Audience measurement and advertising
We use measurement and advertising tools from Google and Meta. We would rather explain this in detail than reduce it to a vague formula, because it involves sharing information with those companies.
Through Google Analytics, Google Tag Manager and Google Ads we measure how the site is used and which campaigns generate visits. These tools use cookies and browser identifiers.
Through the Meta Pixel and the Meta Conversions API we send events describing use of the site, such as an enquiry submitted or a purchase completed. Alongside those events we transmit your email address, phone number, first name, surname, country and an internal user identifier, all of them first converted using an irreversible cryptographic hash, so that Meta does not receive that data in readable form. We also transmit your IP address, your browser identifier and Meta's advertising cookies, which do travel unencrypted because they are required to match the event.
The purpose of this processing is to measure the performance of our campaigns and attribute their results correctly. We do not sell your data, nor do we pass it to third parties so they can market their own products to you.
You may object by installing the Google Analytics opt-out add-on, adjusting your ad preferences in your Meta account, blocking cookies in your browser, or writing to us through the contact form so that we stop sending events associated with you.
6. Who we share data with
In addition to advertisers, as described in section 4, and the measurement providers described in section 5, we work with technical providers that process data on our behalf. They act as processors, are contractually bound to follow our instructions and may not use the information for their own purposes.
- Hosting of the infrastructure and the database, in data centres located in Germany.
- Content delivery network and protection against attacks, which processes requests to the site.
- Transactional email delivery: confirmations, notices, tickets and notifications.
- Application error monitoring, which may record technical data about the request in which a failure occurred.
- Support chat, when you start a conversation from the site.
- Payment gateways, which process the transaction. We do not store full card numbers.
- The WhatsApp Business messaging platform, operated by Meta, for conversations on that channel.
- Artificial intelligence providers, used to translate and draft content for the portal. We do not send them users' contact details for that purpose.
- Public authorities, where a legal obligation or a court order requires us to do so.
7. International transfers
Our servers are in Germany and several of our providers are established in the European Union and the United States. This means your data is transferred outside Paraguay.
Under article 19 of Law No. 7,593/2025, these transfers rely on contractual safeguards with each provider, binding them to a level of protection equivalent to that required by Paraguayan law.
For visitors from the European Union and the United Kingdom, transfers are made under standard contractual clauses approved by the European Commission or another valid mechanism under Regulation (EU) 2016/679.
8. How long we keep your data
We keep each category of data for the period set out in the table in section 3, counted from the last use or contact as applicable.
Once that period has elapsed, the data is deleted or irreversibly anonymised, unless we must keep it to meet a legal obligation or to defend an ongoing claim.
You may request early deletion at any time through the contact form. If deletion affects data we need in order to meet a legal obligation, we will tell you so and keep only what is strictly necessary.
9. Your rights
As the data subject, Law No. 7,593/2025 grants you the following rights, which cannot be waived:
- Information: to know what data we process, for what purpose, on what legal basis and to whom we transfer it.
- Access: to obtain a copy of the data we process about you.
- Rectification: to correct inaccurate or outdated data.
- Objection: to ask us to stop processing based on our legitimate interest, and in particular the use of your data for marketing purposes.
- Erasure: to ask us to delete your data when it is no longer necessary or when you withdraw your consent.
- Portability: to receive your data in a structured, commonly used format, or to have it transferred to another controller.
- Human review: to request human intervention in relation to a decision based solely on automated processing, and to contest it.
10. How to exercise your rights
Write to us through the contact form stating which right you wish to exercise. We may ask you to prove your identity, to prevent a third party from accessing your data by impersonating you.
We will reply within a maximum of thirty calendar days. Where your request is an objection, processing will cease within the shorter periods set by law.
Exercising these rights is free of charge. If you believe we have not handled your request properly, you may complain to the National Personal Data Protection Agency, part of the Ministry of Information and Communication Technologies, once it is operational. If you are in the European Union, to the supervisory authority in your country.
11. Minors
The service is aimed at people over the age of eighteen. We do not knowingly collect data from minors, nor do we offer them features requiring registration.
If we find that we have processed a minor's data without the authorisation of their legal guardian, we will delete it. If you are a parent or legal guardian and believe this has happened, write to us through the contact form.
12. Security and incidents
We apply technical and organisational measures proportionate to the risk: traffic encryption over HTTPS, irreversible encrypted storage of passwords, irreversible encryption of the IP address and browser identifier in our visit metrics, internal access controls and logging of administrative activity.
No internet transmission or storage system is entirely infallible, so we cannot guarantee absolute security. What we do undertake is to act diligently and transparently if something fails.
Should a security breach occur that affects your personal data and poses a risk to you, we will notify the supervisory authority within seventy-two hours of becoming aware of it, and will inform you directly where the risk is high.
13. Automated decisions
We do not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing of your data.
We do use automated processes to rank search results, suggest content, send you alerts about new listings matching your criteria, and route your enquiry to the appropriate advertiser or agent. These processes do not decide on your rights.
In any event, you may request human intervention through the contact form.
14. Changes to this policy
We may update this policy when we add new services, change providers or need to adapt to changes in the law. The version in force is always the one published on this page, with its last updated date shown at the top.
Where a change is substantial and affects how we process your data, we will communicate it through a prominent notice on the site or by email if you hold an active account.
15. Contact
For any question about this policy or about the processing of your data, write to us through the site's contact form.