Your right to deletion
The data protection laws of the countries where Bonuxo operates recognize your right to request deletion of your personal data, for example when it is no longer needed or when you withdraw consent. The right applies both to businesses and to end customers of a program. Requests are free.
How to request it
Customer of a business — online request
On the business's page you can ask to see, correct or delete your data, or stop receiving advertising. To confirm it is you, we send a code to your registered email or your Wallet card. The request goes to the business, which is the controller of your data and the one that answers.
You will find it on your Wallet card or on the in-store QR code. If you have neither an email nor a Wallet card, ask the business in store.
Customer of a business — other channels
Ask in store or through the business's channels, or write to contacto@bonuxo.com and we will pass it on.
Business
Write to contacto@bonuxo.com from the account email, with the business name and, if relevant, the registered phone. A reason is optional. If something does not match, we will contact you before going ahead.
Each country's response deadlines are in the legal framework by country.
Marketing opt-out
To just stop receiving marketing emails without deleting your account, use the one-click unsubscribe link in any email. It works without signing in and does not affect operational emails.
What is deleted
- Account: credentials, profile, settings and preferences.
- Loyalty history: balance and link to cards. Transactions (purchases, redemptions) remain in the business's records without any data that identifies you.
- Contact data: name, email, phone, birthday.
- Device identifiers: Apple Wallet / Google Wallet tokens.
- Digital cards: invalidated and no longer updated.
- Consents: marketing preference.
What is not deleted
- Accounting and billing records: for the period required by tax law.
- Scheduled automatic purges: some technical records are deleted on their own on the schedule in the privacy policy, not earlier.
- Aggregated, anonymized data: metrics that identify no one.
- Data already sent to third parties (Mercado Pago, Apple, Google) follows their policies; Bonuxo stops sending new data.
Legal framework by country
The applicable law mainly depends on the country where the business that signed you up is established. If your request is not answered in time, you can turn to the authority or court listed for each country.
Argentina
- Applicable law
- Personal Data Protection Law No. 25,326 and Regulatory Decree No. 1558/2001.
- Supervisory authority
- Agency for Access to Public Information (AAIP)
- Your rights
- Access, rectification, update and deletion; withdrawal of consent; removal from databases used for advertising (art. 27).
- Legal deadline
- Access: 10 calendar days. Rectification, update or deletion: 5 business days (arts. 14 and 16).
- If you get no answer
- Complaint to the AAIP or a habeas data action.
- Official source
- servicios.infoleg.gob.ar · argentina.gob.ar
Uruguay
- Applicable law
- Law No. 18,331 on Personal Data Protection and Habeas Data, and Decree No. 414/009.
- Supervisory authority
- Personal Data Regulatory and Control Unit (URCDP)
- Your rights
- Access (free every six months), rectification, update, inclusion and deletion; objection to advertising use (art. 21).
- Legal deadline
- 5 business days for access and for rectification, update, inclusion or deletion (arts. 14 and 15).
- If you get no answer
- Complaint to the URCDP or a habeas data action.
- Official source
- impo.com.uy · impo.com.uy (2)
Chile
- Applicable law
- Law No. 19,628 on the Protection of Private Life. Law No. 21,719, which amends it, takes effect on December 1, 2026.
- Status
- A bill in the Senate (Boletín 18.623-07) proposes postponing Law 21,719 to December 2027.
- Supervisory authority
- Personal Data Protection Agency (created by Law 21,719)
- Your rights
- Access, rectification, deletion and objection; Law 21,719 adds portability and blocking.
- Legal deadline
- Law 19,628: 2 business days before going to court (art. 16). Law 21,719: 30 calendar days, extendable once.
- If you get no answer
- Today, a court claim (habeas data, art. 16). Under Law 21,719, a complaint to the Agency.
- Official source
- bcn.cl · bcn.cl (2)
Peru
- Applicable law
- Personal Data Protection Law No. 29733 and its Regulation (Supreme Decree No. 016-2024-JUS, in force since March 30, 2025).
- Supervisory authority
- National Authority for Personal Data Protection (Ministry of Justice)
- Your rights
- Information, access, rectification, cancellation, objection (ARCO), portability and withdrawal of consent.
- Legal deadline
- Information: 8 business days. Access: 20. Rectification, cancellation or objection: 10. Portability and withdrawal: 15. Extendable once, except information.
- If you get no answer
- Complaint to the National Authority for Personal Data Protection.
- Official source
- gob.pe
Colombia
- Applicable law
- Statutory Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015).
- Supervisory authority
- Superintendence of Industry and Commerce (SIC)
- Your rights
- Know, update and rectify; request proof of authorization; be informed of use; revoke authorization or request deletion; free access.
- Legal deadline
- Queries: 10 business days (extendable by 5). Claims: 15 business days (extendable by 8) (arts. 14 and 15).
- If you get no answer
- Complaint to the SIC, after first claiming to the controller.
- Official source
- funcionpublica.gov.co
Mexico
- Applicable law
- Federal Law on the Protection of Personal Data Held by Private Parties (DOF March 20, 2025).
- Supervisory authority
- Ministry of Anti-Corruption and Good Governance
- Your rights
- Access, rectification, cancellation and objection (ARCO); withdrawal of consent.
- Legal deadline
- Response: up to 20 days (extendable once by 10). If granted, it takes effect within the next 15 days.
- If you get no answer
- Rights-protection procedure before the Ministry of Anti-Corruption and Good Governance.
- Official source
- diputados.gob.mx
Paraguay
- Applicable law
- Personal Data Protection Law No. 7593/2025 (enacted November 2025, fully in force from November 2027). Until then, Law No. 6534/2020 on credit data and constitutional habeas data (art. 135) apply.
- Status
- The supervisory authority is still being set up.
- Supervisory authority
- National Personal Data Protection Agency (being set up under MITIC)
- Your rights
- Under Law 7593: access, rectification, deletion, objection and portability, free and through a simple procedure.
- Legal deadline
- Law 7593: 30 calendar days.
- If you get no answer
- Today, habeas data in court. Under Law 7593, also before the Agency.
- Official source
- bacn.gov.py
Bolivia
- Applicable law
- There is no general data protection law. The Constitution applies (art. 21 and art. 130, Privacy Protection Action).
- Status
- No specific supervisory authority.
- Supervisory authority
- There is no specific authority.
- Your rights
- Know, object to, and obtain rectification or deletion of your data.
- Legal deadline
- No general deadline is set by law.
- If you get no answer
- Privacy Protection Action in court.
- Official source
- oas.org
Ecuador
- Applicable law
- Organic Law on Personal Data Protection (LOPDP, Official Registry 459, May 26, 2021) and its Regulation.
- Supervisory authority
- Superintendence of Personal Data Protection (SPDP)
- Your rights
- Information, access, rectification and update, deletion, objection, portability and suspension of processing.
- Legal deadline
- 15 business days.
- If you get no answer
- Complaint to the Superintendence of Personal Data Protection.
- Official source
- spdp.gob.ec
Brazil
- Applicable law
- General Personal Data Protection Law (LGPD, Law No. 13,709/2018).
- Supervisory authority
- National Data Protection Authority (ANPD)
- Your rights
- Confirmation and access, correction, anonymization, blocking or deletion, portability, information on sharing, withdrawal of consent and objection (art. 18).
- Legal deadline
- Simplified confirmation or access: immediately. Full statement: within 15 days (art. 19).
- If you get no answer
- Petition to the ANPD, after first claiming to the controller.
- Official source
- planalto.gov.br · gov.br