Privacy and Personal Data Processing Policy

Perfect Escorts Privacy and Personal Data Processing Policy Version 2026-10-27 · In force from 27 October 2026 · The English version prevails (§19).

If there is any difference between the language versions, this English version prevails (§19).

In short

• The controller of your data is Perfect Escorts, based in New Zealand. For privacy matters, write to us using the contact form on the website or the support in your panel (each request becomes a ticket).
• The platform is only for people aged 18 or over.
• Almost everything you do here (what you search for, save, book, write or publish) can reveal data about your sex life, which the law protects in a special way. That is why we ask for your express consent and explain each use. No sensitive field in the forms is mandatory.
• Personalised recommendations and commercial emails are optional: each is switched on in its own box and withdrawn with one click.
• We do not sell your data or use it for third-party advertising.
• The platform does not show models your email or your phone number. Only if you write to a model through WhatsApp or Telegram, on the profiles where the administration team has enabled that contact, will she see your number or your username.
• You can ask to see, correct, delete or take away your data, and withdraw your consent.
• We keep proof of what you accept (the text, its version and the date), and you can download the text.
• If you are a client, your status (from Bronze to Diamond) comes from what you spend each month and you can see it in your panel; your score from 0 to 100 comes from how the models rate you and is only seen by the administration team and the model of your request or booking. If you ask for it in writing, we will give it to you.

1. Who the controller is

Controller	Perfect Escorts, a platform based in New Zealand
Channel for personal data	the contact form on the website or the support in your panel
Other channels	The support form in your panel and the website's contact form
Who handles your requests	Our data protection officer, a member of the Perfect Escorts team, through those same channels (Decree 1074, art. 2.2.2.25.4.4; in New Zealand, the privacy officer of the Privacy Act 2020, s. 201)
Representative in the European Union and the United Kingdom	We do not have one: we do not direct the service to those countries (§17.5)
Representative in the Bahamas	We will appoint one and state it here when the Data Protection Act 2025 comes into force and requires it

Legal basis. New Zealand (the seat): Privacy Act 2020, principle 3 and s. 201. Colombia: Law 1581 of 2012, art. 12, letter d; Decree 1377 of 2013, art. 13, no. 1; Decree 1074 of 2015, art. 2.2.2.25.4.4 (area handling requests). EU: GDPR, arts. 13.1, letters a and b, 27 and 37. Panama: Executive Decree 285 of 2021, art. 43 (data protection officer, voluntary). USA (California): Cal. Bus. & Prof. Code §22575(b).

2. Who it applies to

Perfect Escorts is a platform for publishing profiles for dates between adults. Models publish their own profile, and clients search, save favourites, write and request bookings. The platform publishes the profiles and manages booking requests and their payments, but it does not take part in the meetings: whatever happens on a date is the responsibility of those who arrange it (Terms and Conditions, §3). This policy applies to visitors (people without an account), clients and models, in every language and country from which the platform is used.

As Perfect Escorts is based in New Zealand, its privacy law (Privacy Act 2020) applies to all processing, also outside New Zealand; and the law of the country where you live also applies when it protects you (§17).

Legal basis. New Zealand: Privacy Act 2020, s. 4. Colombia: Law 1581, art. 2. EU: GDPR, art. 3.2, and recitals 23 and 24. Panama: Law 81 of 2019, art. 5; Executive Decree 285, art. 2, nos. 3 and 4. Bahamas: Data Protection Act 2003, s. 4 (and, when it comes into force, Data Protection Act 2025, s. 3). USA: Cal. Bus. & Prof. Code §22575(a).

3. What data we process

3.1 If you only visit the website

• Your IP address and approximate location. We use them for security and to apply each country's restrictions. Our own server works out the approximate country and city with a database we keep on it (DB-IP Lite): your IP is not sent to anyone for this. If you do not have an account, the city is not stored.
• Technical cookies. They keep your session and remember your language and your cookie choice (see the Cookie Policy). Google Analytics only works if you accept it.
• Google reCAPTCHA. In the sign-up, login, contact, password recovery and support forms (on the home page, when you are about to press a login button), Google receives your IP and data from your browser to detect bots.
• Typefaces and libraries. They are served from our own domain: loading them does not connect your browser to anyone else.
• Contact form. Name, email, subject, message, IP, browser and language, and whether your email belongs to a registered account.
• The legal basis. On your first visit we show you a short notice of what we process when you browse, with the link to this policy. In Colombia, continuing to use the website after seeing it is unequivocal conduct that authorises this technical processing (Decree 1377, art. 7); in the EU, the basis is our legitimate interest in the security of the site (GDPR, art. 6.1, letter f). We do not use it for anything else.

3.2 If you are a client

Category	What data
Account and identity	Email; password (stored only as an irreversible fingerprint (hash), never in plain text); first name, surname and username (nick); if you wish, your phone number and your WhatsApp or Telegram username; date of birth (stored encrypted); language; time zone
Client profile (optional)	Gender, description and photos you add to your profile
Verification (only if we ask you)	If the administration team asks you to verify your identity or age: photos of your document and a selfie, which are kept like the models' ones (§9.1)
Sign-up signature	The word you type to sign, the time you opened each text, date and time of signing, IP, browser, version, language and fingerprint of each accepted text, and the status of each box
How you found us (optional)	Your answer, IP and browser
Searches	Words, city, region, country, service, filters, number of results and the profile you clicked on; IP and browser
Favourites	Models you save and your notes
Bookings	Model, date, meeting place, the duration and extras you book, whether you request companionship only or with services included, and which ones, your message, contact phone number and status history
Payments	Receipt, amounts, references, payment events (with IP) and refund requests
Ratings	Those you give to models
Messages and support	Messages and attachments; messages blocked by the filter, with their content; support tickets and their history; communications log
Security	Known devices (only the fingerprint of a cookie, browser, system, first and last IP); devices remembered with «Remember me» (only the fingerprint); login attempts; blocks; alerts; sessions; activity log with IP and browser
Emails	The emails we send you (their content is emptied after 30 days)
Client status	Your status (no status, Bronze, Silver, Gold, Platinum or Diamond), calculated from what you spend each month on the platform (completed dates, tips and change surcharges, minus refunds); its history and, if the administration team raises it, the reason
Client score	The ratings models give you after each date (manners and respect, quality of the time, hygiene, punctuality, full and timely payment), tips paid through the platform and cancellations after two changes, and the score from 0 to 100 that results from them
Segments	Only if you accepted commercial emails (§6.2): the group your bookings, spending and favourites place you in, to choose which emails we send you; those using the services you are interested in, only if you also accepted recommendations (§6.1)
Habits and interest profile	Only if you tick the optional box for personalised recommendations (§6.1)
Approximate location from your connection	Only if you tick the optional box for personalised recommendations (§6.1): the approximate city, region and country you connect from (our server works them out from your IP; the IP is not kept for this), the first and last time and on how many different days

3.3 If you are a model

Category	What data
Identity	Full name; type, number (stored encrypted) and country of your document; date of birth (stored encrypted); email; phone number and, if you wish, your WhatsApp or Telegram username; language; time zone
Verification documents	Photos of your document (front and back, or passport) and a verification selfie holding the document (or, if you prefer, a video call with a member of the team), checked by hand by a member of the team. That person also checks your document number on the official Colombian websites for criminal records (National Police) and disciplinary records (Procuraduría). The result of that check is not stored: only the decision to approve or reject your application remains
Sign-up consent	The word you type to sign, the time you opened each text, IP, date, language, version and fingerprint of each text, and the status of each box
Public profile	Stage name; tagline; photos and videos; biography, interests, style and likes; published age; gender; physical features (height, body type, bust, buttocks, hair and eye colour, tattoos…); and, only if you wish to give them, your sexual orientation, your skin tone, the origin of your hair, your ethnic origin and your intimate features (pubic hair, size and colour of nipples, type of vagina, size of clitoris, female ejaculation, anal experience, intimate piercings, special skills); the services you offer, chosen from a closed list (those referring to intimacy are not shown to anyone who has not logged in or to search engines); rates; schedule; city
Original photos and blurring	The original unblurred photo (kept separately and never public), the blurred areas and the result of the face detector
Travel	Destination city and dates, hotel details
Payments	Plans, receipts, commissions and your payout details (stored encrypted)
Contact details for clients (optional)	If your plan includes it, the details from your account that you choose to show (your email, your real name, your phone number, your WhatsApp or your Telegram), one by one; the administration team approves each one and can remove it. Only signed-in clients see them, on your profile; never anyone who is not signed in, nor search engines. They stop being shown when your plan expires or changes, or when you remove them
Ratings received	Those clients give you
Messages, support and security	Same as for clients, plus the pages of your panel you visit (with IP and browser)
Block list	If an application is blocked, we keep the document, phone numbers, email and IP to prevent it from signing up again
Unfinished application	If you do not complete it, it is deleted after 30 days and a minimal record remains

We do not collect your precise location: only the city you choose for your profile.

3.4 Data you do not give us

• The ratings other people give.
• The approximate country calculated from your IP.
• Security alerts and recognised devices.
• The decision to approve or reject your application after the official checks (models only, §3.3).
• The client status, calculated from what you spend each month (§3.2): you see it in your panel, with what you still need for the next one. The administration team can raise it, with a reason that is recorded, but never set it below the one your spending gives you.
• The client score, from 0 to 100, calculated from the ratings models give you and the tips paid through the platform; cancelling a booking after changing it twice counts as the worst rating. It is not shown in your panel: it is seen by the administration team and the model holding your request or booking, from three ratings onwards. If you ask for it in writing (§11), we give you your score and how it was calculated.
• The segments, only if you accepted commercial emails (§3.2 and §6.2).
• The interest profile, calculated only if you ticked the optional box for personalised recommendations (§6.1).
• The approximate city you connect from, calculated from your IP, only if you ticked that same box (§6.1).

Legal basis. Colombia: Law 1581, art. 12, letter a; Decree 1377, arts. 7 and 13, no. 2. EU: GDPR, arts. 6.1, letter f, 13.1, letters c and e, and 14 (data you do not give us, §3.4). USA: Cal. Civ. Code §1798.100(a)(1); Cal. Bus. & Prof. Code §22575(b)(1).

4. Sensitive data

This data is sensitive and receives reinforced protection:

• Sex life and sexual orientation: the services the model offers, her sexual orientation, her intimate features, her photos and videos and, for clients, searches, favourites, bookings (with the services you request in them), payments, messages and ratings. Also the very fact of having an account.
• Intimate characteristics of the body (pubic hair, nipples, genital characteristics, ejaculation, anal experience, intimate piercings).
• Ethnic origin and the physical features that may reveal it, such as skin tone and the origin of the hair.
• Interest profile (§6), because it infers sexual preferences.
• Identity document and verification selfie. The selfie is compared by a person with the naked eye, not by an automatic facial recognition system. Although in some countries they are not sensitive data, we give all of them reinforced protection.
• Criminal and disciplinary records checked in official sources (models only): they are checked and not stored.
• Content of messages.
• Nude photos and videos (only from the model who chooses to upload them): voluntary and with her own express acceptance (the Terms for nude photos and videos); they are only shown inside the catalog to clients with a logged-in session, never in public areas, in search engines or as a profile photo.

No activity depends on you giving us sensitive data: all sensitive fields in the forms are optional. What your own use reveals (searches, favourites, bookings, messages) is inherent to the service you request, which is why we ask for your explicit authorisation to process it. Verifying the model's identity and age is mandatory to publish, because the law requires us to prevent a minor from being published (Law 679 of 2001 and Decree 769 of 2026 in Colombia; CJEU Russmedia): for it we offer two ways, the selfie or a video call with a member of the team.

To publish a profile, the stage name, the city, 6 photos, one rate and one service are enough; the rest is optional. Video is voluntary and is always treated as nude.

The face detection used to blur photos runs in your browser: the photo is not sent to third parties, only the library that performs the detection is downloaded.

Legal basis. Colombia: Law 1581, arts. 5, 6 and 12, letter b; Decree 1377, art. 6. EU: GDPR, art. 9.1 and 9.2, letters a and f, and recital 51; criminal records, art. 10. Panama: Law 81, arts. 4, no. 11, and 13. USA: Cal. Civ. Code §1798.140(ae) and §1798.121; Conn. Gen. Stat. §42-515. Bahamas: Data Protection Act 2003, s. 2; Data Protection Act 2025, s. 35.

5. What we use your data for and on what basis

In the «EU» column, legal obligation (6.1.c) is only used when it is imposed by Union or Member State law (GDPR, art. 6.3). The «Panama / Bahamas» column applies the general bases of Law 81 of 2019, art. 6, and of the Data Protection Acts of 2003 (s. 6) and 2025 (ss. 6 and 35).

#	Purpose	Data	Colombia	EU (GDPR)	Panama / Bahamas	Mandatory?
1	Creating and managing your account, verifying your email and assisting you	Identity, contact details, language, time zone, signature	Your authorisation at sign-up	Contract (6.1.b) + explicit consent (9.2.a)	PA: consent or contract (Law 81, art. 6). BS: consent (DPA 2003; DPA 2025, s. 6)	Yes
2	Verifying the model's identity and legal age before publishing, including checking her document number on the official websites for criminal records (National Police) and disciplinary records (Procuraduría)	Document, selfie or video call, date of birth, document number checked	The model's explicit authorisation; duties under Law 679 and Decree 769 of 2026	Explicit consent (9.2.a); duty to verify the advertiser (CJEU Russmedia); records: art. 10, checking without storing the result	PA: consent (Law 81, art. 6). BS: written consent (DPA 2025, s. 35)	Yes, to publish (two ways: selfie or video call)
3	Publishing the model's profile	Photos, videos, features, services, rates, availability, city, travel	Explicit authorisation to publish (Law 1581, art. 4)	Explicit consent (9.2.a)	PA: explicit consent. BS: in writing (s. 35)	What the form marks as mandatory (§4); every sensitive field, optional
4	Searching, saving favourites, booking, writing and rating; letting the model know, before accepting, whether you request companionship only or with services included, and which ones	Searches, favourites, bookings (with the services you request), messages, ratings	Explicit authorisation	Contract + 9.2.a	PA: contract + consent. BS: consent (in writing under the 2025 law)	Yes
5	Payments, plans, commissions, refunds and accounting	Receipts, amounts, references, the model's payout details	Authorisation and accounting obligations (Commercial Code, art. 60)	Contract (6.1.b); keeping records under non-European accounting laws: legitimate interest (6.1.f)	PA: contract or Panamanian legal obligation (Law 81, art. 6). BS: contract	Yes, if you pay or get paid
6	Security and fraud prevention	IP, approximate country, devices, attempts, blocks, alerts, activity log, reCAPTCHA, block list	Authorisation at sign-up and, without an account, the unequivocal conduct of §3.1 (legitimate interest does not exist in Colombia)	Legitimate interest (6.1.f) + 9.2.a	PA: contract or legitimate interest. BS: contract or consent	Yes
7	Preventing trafficking, exploitation and the involvement of minors; moderating; responding to the authorities	Whatever is necessary in each case	Legal duties (Law 679, Decree 1524, Decree 769) and Law 1581, art. 10	Legitimate interest (6.1.f) + art. 9.2.f or 9.2.a; 6.1.c only if required by Union or Member State law (art. 6.3)	PA: legal obligation (Criminal Code, art. 189; Law 81, art. 6). BS: legal obligation (ECTA, s. 20)	Yes
8	Service emails (verification, bookings, payments, security)	Email, name, content	Authorisation	Contract (6.1.b)	PA and BS: contract	Yes
9	Keeping proof of what you accept	Signature, version, text fingerprint, date, IP, browser	Duty to keep proof (Law 1581, art. 17.b)	GDPR, arts. 7.1 and 6.1.c/6.1.f + art. 9.2.f (establishment, exercise or defence of legal claims)	PA: proof of consent (DE 285, arts. 17-18). BS: DPA 2025, s. 35(2)(d)	Yes
10	Register of providers (Colombia)	The model's name, document, address and phone numbers	Law 1480, art. 53	Colombia only; in the EU, 6.1.f + 9.2.f	Does not apply	Yes (models)
11	Backups	All of the above	Authorisation	Legitimate interest (6.1.f), with the art. 9 exception of each data item	PA and BS: the basis of each data item	Yes
12	Knowing how you found us	Your answer, IP, browser	Authorisation	Legitimate interest (6.1.f)	PA and BS: consent	No: the question is optional
13	Visit analytics	Google Analytics cookies	Consent in the cookie notice	Consent (ePrivacy, art. 5.3; 6.1.a)	PA: consent (Law 81, arts. 6 and 11). BS: consent	No
14	Personalised recommendations on the website	Habits and interest profile	Separate explicit authorisation	Separate explicit consent (6.1.a and 9.2.a)	PA: separate consent (Law 81, art. 27). BS: in writing (s. 35)	No
15	Commercial emails and, with a separate yes, the measurement of opens and clicks	Email, name, language, your account's city; and your profile only if you also accepted purpose 14	Separate explicit authorisation (Law 2300, art. 5)	Consent (6.1.a; ePrivacy, arts. 13 and 5.3)	PA: prior consent (Law 51, art. 86). BS: consent (DPA 2025, s. 37)	No
16	Handling your rights and complaints	Your request, identity and our reply	Law 1581, arts. 14-15	Legal obligation (6.1.c: GDPR, arts. 12-22)	PA: Law 81, arts. 15-18. BS: DPA 2003, ss. 8, 10 and 11; DPA 2025, ss. 26-31	—
17	Your client status based on what you spend each month (you see it in your panel)	Completed dates, tips, change surcharges and refunds	Authorisation at sign-up: it is part of the service	Contract (6.1.b) + 9.2.a	PA: contract. BS: consent	Yes
18	Your client score, from 0 to 100, based on the models' ratings: seen by the administration team and the model of your request or booking (the models' safety and the quality of the service); you receive it if you ask in writing	Models' ratings, tips paid through the platform, cancellations after two changes	Explicit authorisation at sign-up	Legitimate interest (6.1.f) + 9.2.a	PA and BS: consent	Yes
19	Segments by bookings, spending and favourites and by the services you request in your bookings	Bookings, spending, favourites, services requested	Only if you accepted purpose 15 (and, for the services you are interested in, also 14): separate explicit authorisation (Law 1581, art. 6; Law 2300, art. 5)	Separate explicit consent (6.1.a and 9.2.a)	PA: separate consent (Law 81, art. 27). BS: in writing (s. 35)	No

Legal basis. Colombia: Law 1581, arts. 4, letters b and c, 9 and 10; Decree 1377, arts. 5 and 7. EU: GDPR, arts. 5.1, letter b, 6.1, 6.3 and 9.2. Panama: Law 81, art. 6. Bahamas: Data Protection Act 2003, s. 6; Data Protection Act 2025, ss. 6 and 35.

6. Personalised recommendations and emails (optional)

There are two optional, separate boxes. Neither is pre-ticked, neither is needed to sign up or book, and each is switched on and withdrawn separately. The measurement of opens and clicks of the emails (§6.2) and the birthday greeting also have their own box.

6.1 Personalised recommendations on the website (interest profile)

If you tick the box «I want personalised recommendations on the website»:

• What we record. Your searches and filters, the profiles you view (model, city and region) and what you do on them, your favourites, the contacts you start, your bookings (and the included services you request in them), your payments (by amount band, not the exact amount), your ratings and your interest in models who travel; and the approximate city you connect from (at most once a day; we work it out from your IP, which we do not keep for this; if you entered your city in your profile, that one prevails). We record it on our server, from a single point, without the free text of your searches, and only while your consent is in force. If you do not tick it, we record nothing for this purpose.
• What we calculate. An interest profile: cities and regions, services, features, price range, travel, and the models you were in contact with and how you rated them. That profile can reveal your sexual preferences. We do not infer health data or use intimate features or ethnic origin.
• What for. To recommend new models and offers in your city and in the ones you frequent, the best rated ones and those who travel, in the «For you» block of your panel; and, only if you also ticked 6.2, to choose the models we send you by email.
• Who sees it. Only the administration team. You have the right to know it: ask for it and we give you a copy within 10 working days at most. Never the models or third parties. We do not use it for advertising outside the platform, to rank paid listings, to set prices, to block accounts or for any other decision about you.
• How long. Habits are kept for 12 months at most and the profile is recalculated every night from them. Each place you connect from is kept for up to 72 months after the last time you connected from there.
• How to withdraw it. With one click from your panel or from the unsubscribe page of any email. At that moment we stop recording your activity and delete your profile, your habits and the places you connected from. The withdrawal is signed and your account does not change at all.

6.2 Commercial emails

If you tick the box «I want to receive recommendations and commercial news by email»:

• What you receive. At most one a day, only during permitted hours, in your language, with a subject beginning with «Advertising», nothing explicit in the sender, subject or preview, and with one-click unsubscribe. If you also ticked 6.1, the email uses your profile; if not, it only includes news from your account's city, the same for everyone in that city.
• Measurement. Only if you also accept its own box, we measure whether you open these emails and which links you click, with our own pixel and redirect (no third-party services and without storing your IP or your browser), for sending statistics. Without that second yes, the emails carry no pixel.
• How to withdraw it. With one click on «Unsubscribe» at the bottom of each email, or with the switch in your panel. It takes effect immediately, is signed and your email goes onto our suppression list. It does not affect 6.1; the unsubscribe page offers to withdraw that too.

When the text of one of these boxes changes. From the moment the new version comes into force, your previous consent stops being valid: if the text of 6.1 changes, recording stops and that same night your habits and your profile are deleted; if the text of 6.2 changes, sending stops. At your next login we ask you only once, with the box unticked; if you do not tick it, it stays withdrawn. If you live in the Bahamas, we do not ask you again: you switch it back on yourself from your panel if you want (§17.4).

Your right to object. You can object at any time, without giving reasons and free of charge, to our use of your data for marketing, including the interest profile. One click on «Unsubscribe» at the bottom of each email, or the switch in your panel, is enough. (This box is kept separate from the rest of the text, as required by GDPR, art. 21.4.)

Legal basis. Colombia: Law 2300 of 2023, arts. 3 and 5; Decree 1074 of 2015, arts. 2.2.2.25.2.3 and 2.2.2.25.2.4. EU: Directive 2002/58/EC, arts. 5.3 and 13; GDPR, arts. 6.1, letter a, 7.2 to 7.4, 9.2, letter a, 21.2 to 21.4 and 22. Panama: Law 51 of 2008, arts. 85 and 86; Law 81, art. 27. USA: 15 U.S.C. §7704 (CAN-SPAM). Bahamas: Data Protection Act 2025, s. 37.

7. Who else receives your data

7.1 Other users

• Models see your nick and, in bookings, your profile photo if you have one, together with the booking details. The platform never shows models your email or your phone number. If the administration team has enabled direct contact on a profile and you decide to write to the model with its WhatsApp or Telegram button, she will see your number or your username, and that conversation takes place outside the platform.
• Clients see the model's public profile and, if the administration team has enabled it, her direct contact.
• Anyone who has not logged in and search engines see blurred copies of the photos, generated on our server; when logged in, the published photos are seen through signed links that expire.

7.2 Providers that process data on our behalf

Provider	What for	Data	Country	Basis or safeguard
GoDaddy	Hosting of the website and the database, and mailbox	All	That of the data centre of our hosting plan	Hosting contract
SMTP2GO	Sending all emails	Recipient, name, content	New Zealand (the company), with servers in several countries	Service contract; it processes the data only to send the emails. EU: New Zealand adequacy decision
Google LLC · reCAPTCHA	Detecting bots	IP, browser data, Google cookies	USA	Colombia: adequate country. EU: EU-US Data Privacy Framework or standard clauses. Google may act as a controller in its own right
Google LLC · Analytics	Statistics, only if you accept	Cookie identifier, pages visited; Google receives your IP when it loads and, according to Google, Analytics 4 does not store it	USA	Consent; idem
Google · Drive	External backups, if switched on	Encrypted copies of the database and the files	USA	Idem; they always leave our server encrypted

The messages you write to a model through WhatsApp or Telegram are processed by those companies under their own terms: they are not our providers. We do not use external payment gateways: payments are made with a receipt within the platform. If that changes, this policy is updated and you are asked to accept it again.

7.3 Authorities, official sources and third parties with a legal right.

• Judges, prosecutors and police when they request it through legal channels, or in an emergency.
• NCMEC and the competent authorities when there are signs of child exploitation.
• In Colombia, a client who files a formal complaint may receive the model's name, document, address and phone numbers, because the law requires it of contact portals (Law 1480, art. 53). This data is never published.
• Official sources we check to verify models: National Police (criminal records) and Procuraduría (disciplinary records). They receive the document number when the check is made.

7.4 What we never do. We do not sell your data. We do not hand it over for third-party advertising. We do not use advertising pixels.

Legal basis. Colombia: Law 1581, arts. 13 and 17; Decree 1074 of 2015, arts. 2.2.2.25.5.1 and 2.2.2.25.5.2 (transmission to processors); Law 1480 of 2011, art. 53 (contact portals). EU: GDPR, arts. 13.1, letter e, and 28. Panama: Executive Decree 285, art. 48. USA: 18 U.S.C. §2258A (reports to NCMEC); Cal. Civ. Code §1798.100(d) (contracts with providers).

8. International transfers

Your data is stored on the servers of our hosting provider (§7.2) and processed by the providers in §7.2 in the countries indicated there.

• New Zealand (the seat). When we send data to a provider in another country, we do so with the safeguards required by principle 12 of the Privacy Act 2020 (comparable protection, by contract) or with your authorisation.
• Colombia. The USA and the EU are listed as adequate countries by the SIC; New Zealand, where Perfect Escorts is based, is not. By accepting this policy at sign-up you expressly authorise the transfer of your data to Perfect Escorts in New Zealand and to the providers in §7.2, and we have service contracts with them.
• Panama. We send data abroad with your consent, where the contract requires it or with contractual clauses (Law 81, art. 33). Sensitive data only leaves with your explicit authorisation (art. 13).
• Bahamas. With consent or under contract. We will review the contracts when the 2025 law comes into force.
• European Union. Transfers to US providers rely on the EU-US Data Privacy Framework, if they are certified, or on standard contractual clauses; transfers to New Zealand, on its adequacy decision. You can ask for a copy of the safeguards.
• Encryption. Backups that leave our server are encrypted.

Legal basis. New Zealand: Privacy Act 2020, principle 12. Colombia: Law 1581, art. 26; Decree 1074 of 2015, arts. 2.2.2.25.5.1 and 2.2.2.25.5.2; SIC Single Circular, title V, chapter 3. EU: GDPR, arts. 44 to 49; Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework); Implementing Decision (EU) 2021/914 (standard contractual clauses). Panama: Law 81, arts. 13, 32 and 33; Executive Decree 285, arts. 46 to 53. Bahamas: Data Protection Act 2003, s. 17; Data Protection Act 2025, ss. 52 to 56.

9. How long we keep your data

Data	Period
Active account (identity, profile, preferences)	While the account exists
Closed account	You close it from your panel, with your password and an email confirmation (or the administration team closes it): it is closed at once and for 30 days you can come back. After that we delete what only describes you (profile, preferences, trail, notifications, photos and videos) and anonymise what others need (your bookings, without phone number, message or address). We keep what the law obliges us to keep (signatures, age verification, reviews and amounts) and the messages, which also belong to the other person. If something is still open (a dispute, a balance), we wait until it is closed
Verification document and selfie	While the account is active; when it is closed, or if the application is rejected, they are kept encrypted for the limitation period of the legal actions in which they may serve as proof of your identity and age (in Colombia, up to 10 years), and then deleted (§9.1)
Original unblurred photos	While the account is active; when it is closed, or if the application is rejected, they are deleted after 30 days (§9.1)
Result of the records check	Not stored: only the decision to approve or reject remains
Application under correction not completed	30 days; a minimal record remains
Applicant block list	While the reason for the block exists (for example, an attempt at impersonation or at publishing a minor)
Messages and attachments	While the conversation exists; when you close your account they are kept for the other person, without your account details
Bookings, payments and records	10 years, as Colombian law requires for accounting books and records (Commercial Code, art. 60; Law 962 of 2005, art. 28)
Searches	90 days
Activity log (logins, changes and alerts)	2 years
Recorded visits to panel screens	90 days
Technical logs with IP or browser (how you found us, blocked messages)	180 days
Notifications already read	180 days
Known devices	The cookie, 400 days in your browser; in our database, while the account exists
Device remembered with «Remember me»	30 days
Sign-up attempts	7 days
Login attempts	2 days
Temporary blocks	90 days after they expire
System logs	Information: 30 days; errors: 90 days
Expired email verification links	7 days
Sessions	They last 2 hours from when you log in (24 hours during the model sign-up); the server deletes them the following day
Emails sent	Their content is emptied 30 days after sending; the record of sending remains
Log of commercial emails sent	400 days (to respect the sending limit)
Marketing habits	12 months at most (§6.1)
Interest profile	Recalculated every night; deleted when you withdraw your consent
Approximate location from your connection (§6.1)	Up to 72 months after the last connection from each place; deleted when you withdraw your consent
Aggregate website usage figures (no personal data)	13 months
Backups on our server	The 7 most recent
Encrypted external backups, if switched on	1 year at most
Signatures and accepted texts	The signature chain, without personal data, is kept for ever. The personal data of each signature (IP, browser, user identifier…) is kept while the account exists and, afterwards, for the limitation period of legal actions (in Colombia, up to 10 years), because it proves your authorisation; then it is erased
Content reported to NCMEC or the authorities	1 year, kept separately (18 U.S.C. §2258A)
Rights requests and their replies	While they can be challenged (in Colombia, up to 10 years)

At the end of each period, the data is erased or anonymised. If you withdraw a consent, we stop using the data for that purpose. We only keep the proof of the signature.

Legal basis. Colombia: Law 1581, art. 4, letter b; Decree 1377, arts. 9 and 11; Commercial Code, art. 60. EU: GDPR, arts. 5.1, letter e, 13.2, letter a, and 17.3, letters b and e. Panama: Executive Decree 285, art. 63. USA: Cal. Civ. Code §1798.100(a)(3).

9.1 The models' original copies

If you are a model, we keep, separately and apart from what is published:

• an unblurred copy of each photo you blur;
• the photos of your identity document;
• your verification selfie.

What for. To check your identity and that you are of legal age before publishing your profile; to correct the blurring if necessary (we let you know when we do, and the editor always works from the original); and to prove to an authority that the person published is the one who signed up, as a control and to prevent trafficking, exploitation and the involvement of minors.

Who sees them. Only the administration team, from its panel and with its session. They are never published, never seen by clients or other models, and they do not appear in your panel either. Each time a member of the team opens one, who did it and when is recorded. A copy of the approved document and selfie is kept encrypted in an evidence archive that cannot be changed or deleted.

Who they are handed to. Only to a competent public or administrative authority that requests them in the exercise of its legal functions, or by court order. To no one else. The law does not require a court order when a competent authority requests them in the exercise of its functions, which is why we do not promise you «only with a court order».

How long. While your account is active. When you close it, or if your application is rejected, the original unblurred photos are deleted after 30 days; the document and the selfie are kept encrypted for the limitation period of the legal actions in which they may serve as proof of your identity and age (in Colombia, up to 10 years), and then deleted.

Your rights over them. You can consult them (we tell you what we keep and give you a copy), ask for them to be corrected and ask for them to be erased. Erasure does not apply while there is a legal or contractual duty to keep them (for example, while your profile is published, or during the period in which an authority may request proof of your verification): in that case we explain it to you and keep them encrypted and blocked, with no other use.

Legal basis. Colombia: Law 1581, arts. 4, letters b, f and g, 10, letter a, 13, letter b, and 17, letter d; Decree 1377, art. 9 (erasure does not apply while there is a legal or contractual duty to keep); Law 679 of 2001 and Decree 769 of 2026 (age verification). EU: GDPR, arts. 6.1, letters c and f, 9.2, letter f, and 17.3, letters b and e. Panama: Law 81, arts. 15 to 18. USA: 18 U.S.C. §2257, to the extent applicable.

10. How we protect your data

• Passwords are stored as an irreversible fingerprint (hash), never in plain text.
• The document number, the date of birth and payout details are stored encrypted (AES-256), with the key outside the website.
• Documents, selfies and original photos are stored outside the public folder, and only an administration screen delivers them, with its session and recording each view.
• Anyone who has not logged in and search engines receive blurred copies with a signed name.
• Access depends on the role: the interest profile is only seen by the administration.
• There are login alerts from new devices and a temporary block after several failed attempts.
• The chat filters numbers and links.
• What you upload (photos, documents, attachments) is checked by its real type; images are re-encoded and lose their metadata (including location); PDFs are checked before being accepted; and everything is stored in isolation, out of public reach. We do not run an antivirus scan on files.
• We log account activity.
• If a breach poses a risk, we notify the competent authorities without delay and, where the law requires it, within 72 hours at most. We notify the people affected without undue delay, within the shortest period set by the applicable law (72 hours in Panama; 30 days at most in the USA), unless an authority asks us to delay it.

No system is infallible: we do not promise absolute security.

Legal basis. Colombia: Law 1581, arts. 4, letters g and h, and 17, letters d and n; SIC Single Circular, title V (incident notice within 15 working days). EU: GDPR, arts. 32 to 34. Panama: Executive Decree 285, arts. 37 and 38. USA: Cal. Civ. Code §§1798.81.5 and 1798.82. Bahamas: Data Protection Act 2025, s. 48 (when it comes into force).

11. Your rights and how to exercise them

Your rights:

• To know and access your data, including your interest profile if you have one.
• To rectify and update it.
• To erase it. You can close your account yourself from your panel (§9).
• To object; to marketing and profiling, unconditionally.
• To restrict processing.
• Portability: to receive your data in JSON or CSV.
• To withdraw your consent, without affecting what was done before.
• To ask for proof of your authorisations and download the texts you accepted.
• Not to be subject to solely automated decisions.
• To complain to the authority (§16).

How to exercise them:

• From the support in your panel or from the contact form on the website.
• We confirm that we have received your request and give you a number to follow it.
• We will check your identity so as not to hand your data to someone else.
• It is free.
• If you act through another person, we need their authorisation.
• We will never treat you worse for exercising your rights.

Time limits we set ourselves: the shortest of the applicable laws.

Request	Our time limit	CO	PA	US (states)	BS today / 2025 law	EU
Enquiry and access (including the copy of your interest profile)	10 working days	10 working days (+5)	10 working days	45 days (+45)	40 days / 30 days	1 month (+2)
Correction	5 working days	Complaint: 15 working days (+8)	5 working days	45 days	40 days / —	1 month
Erasure and other complaints	15 working days	15 working days (+8); 5 days to complete; deemed withdrawn after 2 months	No legal time limit	45 days	40 days / —	1 month
Objection to marketing	Immediate	—	At any time (DE 285, art. 29)	CAN-SPAM: 10 working days; CT: 15 days	40 days / 21 days	Immediate (art. 21.3)

If we refuse your request, we explain why and how to complain. In the USA, you can also appeal from the same ticket or from the contact form on the website, stating «Appeal».

Legal basis. Colombia: Law 1581, arts. 8, 14, 15 and 16; Decree 1377, art. 21 (free access). EU: GDPR, arts. 12 to 22. Panama: Law 81, arts. 15 to 18 and 21; Executive Decree 285, arts. 21 to 30. USA: Cal. Civ. Code §§1798.100 to 1798.130 (and §1798.125: no discrimination for exercising them). Bahamas: Data Protection Act 2003, ss. 8, 10 and 11.

12. Minors

The platform is only for people aged 18 or over, in every country. We verify the identity and age of each model before publishing her profile, with her document and a selfie or a video call. Clients declare that they are of legal age when signing. The pages carry the RTA label so that parental filters can block them.

If we detect a minor:

• we block the account;
• we keep only what is necessary to report it;
• we notify the competent authority;
• we erase the rest.

Legal basis. Colombia: Law 1581, art. 7; Law 679 of 2001, arts. 7, 8 and 10; Criminal Code, art. 219A. EU: GDPR, art. 8; Directive 2011/36/EU. USA: 18 U.S.C. §§1591 and 2258A. Panama: Criminal Code, arts. 184 to 191.

13. Automated decisions

We do not take solely automated decisions that produce legal effects or significantly affect you. The recommendations in §6 are suggestions. An automatic filter may block a chat message, and you can ask for a person to review it. The client status and score are calculated automatically: the status can only give you advantages (for example, more favourites), never take the service away from you; and the score decides nothing by itself: a person (the model or the administration team) looks at it before deciding.

Legal basis. EU: GDPR, arts. 13.2, letter f, and 22.

14. Cookies

The Cookie Policy explains them. If we use cookies that need your consent, you can change your choice at any time from «Cookie preferences», at the bottom of the pages.

Legal basis. EU: Directive 2002/58/EC, art. 5.3. Colombia: Law 1581, arts. 3 and 9. The details, in the Cookie Policy.

15. Changes to this policy

Each version has a number and an effective date, and it is never edited once published: a change always creates a new version.

• Any change creates a new version, which comes into force when we approve it. At your next login we show you what changes; to keep using your account you have to open the new text and sign it again. Your previous signature is kept: both remain. If you do not want to accept it, you can close your account from your panel or ask support for a copy of your data without accepting it.
• We also notify you of substantial changes by email before applying them.
• If the text of a marketing box you had switched on changes, what is said in §6 applies: from the moment it comes into force it stops (and, for recommendations, your habits and your profile are deleted that night), and at your next login we ask you only once. In the Bahamas we do not ask you again.
• You can download the version you accepted and consult the previous ones.

Legal basis. Colombia: Decree 1377, arts. 5 and 13 (substantial changes are communicated before they are applied); Decree 1074 of 2015, art. 2.2.2.25.2.2. EU: GDPR, art. 7.1 (being able to demonstrate each consent). USA: Cal. Bus. & Prof. Code §22575(b)(3); Colorado, 4 CCR 904-3, rule 7.08. Signing the new version: Law 527 of 1999, art. 7; 15 U.S.C. §7001 (E-SIGN).

16. Authorities you can complain to

Country or area	Authority
New Zealand (the seat)	Privacy Commissioner (Te Mana Mātāpono Matatapu). You can go to it in addition to the authority of your country (Privacy Act 2020, part 5).
Colombia	Superintendency of Industry and Commerce (SIC), Delegation for the Protection of Personal Data. You must first file your complaint with us (Law 1581, art. 16).
Panama	National Authority for Transparency and Access to Information (ANTAI), Personal Data Protection Directorate
United States	Federal Trade Commission (FTC); your state's Attorney General; in California, also the California Privacy Protection Agency (CPPA)
Bahamas	Data Protection Commissioner (under the 2025 law, Office of the Data Protection Commissioner)
European Union / EEA	The data protection authority of your State (the list is on the website of the European Data Protection Board, edpb.europa.eu)
Brazil	Autoridade Nacional de Proteção de Dados (ANPD)
Mexico	Secretaría Anticorrupción y Buen Gobierno, the authority for personal data held by private parties since 2025
Chile	The Agencia de Protección de Datos Personales, once Law 21.719 enters into force; until then, the courts (Law 19.628)
Peru	Autoridad Nacional de Protección de Datos Personales (ANPDP), of the Ministry of Justice and Human Rights
Ecuador	Superintendencia de Protección de Datos Personales (SPDP)
Argentina	Agencia de Acceso a la Información Pública (AAIP)
Other countries in Latin America and the Caribbean	The data protection authority of your country, if there is one

Legal basis. New Zealand: Privacy Act 2020, part 5. Colombia: Law 1581, arts. 16 and 19. EU: GDPR, art. 77. Panama: Law 81 of 2019 and Executive Decree 285 of 2021. USA: 15 U.S.C. §45; Cal. Civ. Code §1798.199.10. Brazil: LGPD, arts. 18, §1, and 55-J. Mexico: LFPDPPP of 2025. Chile: Law 21.719. Peru: Law 29733 and Supreme Decree 016-2024-JUS. Ecuador: LOPDP. Argentina: Law 25.326, art. 29, and Decree 746/2017.

17. What changes depending on where you live

17.1 Colombia (Law 1581 of 2012 and Decree 1074 of 2015)

• We process your data with your prior, express and informed authorisation.
• The authorisation for sensitive data is explicit and optional; no activity depends on providing it.
• We keep proof of your authorisation and of the notice you saw.
• Your rights are those of art. 8 of the law, with the time limits in §11.
• If our databases have to be registered in the SIC's National Register of Databases, we register them and state it here.
• If we detect an incident, we report it to the SIC.
• If the language versions differ, the English version prevails (§19), unless the law of your country provides otherwise.

17.2 Panama (Law 81 of 2019 and Executive Decree 285 of 2021)

• Rights of access, rectification, cancellation, objection and portability, free of charge, with the time limits in §11.
• We may build profiles only with the consent in §6.1, and you can object to it at any time.
• Breaches are notified to ANTAI and to the people affected within 72 hours.
• We have not appointed a data protection officer in Panama (it is voluntary); our data protection officer (§1) handles your requests.
• If the language versions differ, the English version prevails (§19), unless the law of your country provides otherwise.

17.3 United States

• Categories of data, sources and purposes: §3 to §5.
• We do not sell or share personal data within the meaning of the CCPA, nor do we carry out cross-context behavioural advertising.
• We use sensitive data only to provide the service requested and, with your consent, for §6.
• Your rights: to know and access, correct, delete, take away your data, object to profiling and, in California, limit the use of sensitive data. We reply within 45 days at most and you can appeal. We will not discriminate against you for exercising them, and we accept authorised agents.
• Browser signals: we treat Global Privacy Control and Do Not Track as a rejection of non-essential cookies.
• Third-party tracking: when we load Google reCAPTCHA (in the sign-up, login, contact, password recovery and support forms) and, if you accept it, Google Analytics, Google may collect data from your browser and link it to your activity on other sites under its own policy.
• Washington: we do not infer health data.
• Connecticut: withdrawal of consent applies immediately, within the legal limit of 15 days.
• Breaches: within the time limit in §10 and, in any case, the one set by your state's law.

17.4 Bahamas

• Today the Data Protection (Privacy of Personal Information) Act 2003 applies. When the Data Protection Act 2025 comes into force, we will also apply its rules:
• written consent for sensitive data (the signed click is written consent);
• not asking you again for marketing consent through the same channel: if the text changes, your consent is paused and only you can switch it back on from the panel, and there is no periodic renewal;
• objection within 21 days;
• breach notification within 72 hours;
• a representative in the Bahamas.
• English version, in plain language.

17.5 European Union, European Economic Area and United Kingdom

• We do not direct the service to these countries, which is why we have no representative in them (§1).
• If the GDPR applies to you anyway, you have all the rights in this policy: the legal bases of each purpose are in the table in §5 («EU» column), the right to object in the box in §6 and the safeguards for transfers in §8.
• You can complain to the authority of your State (§16).

17.6 Brazil (Lei Geral de Proteção de Dados, Law 13.709 of 2018)

• We process your data on the art. 7 legal bases shown in the table in §5 (the contract, a legal obligation, legitimate interest or your consent). Sensitive data (art. 11) only with your specific and highlighted consent: the sensitive-data checkbox, which you sign separately.
• Your rights (art. 18): to confirm that we process your data and to access it; to correct it; to have unnecessary or excessive data anonymised, blocked or deleted; to take it with you; to have the data processed on the basis of your consent deleted; to know who we share it with and what happens if you do not consent; and to withdraw your consent. We give you the full reply within 15 days (art. 19, II).
• Incidents: we notify the ANPD and the people affected, within 3 working days, of those that may cause a relevant risk or harm (ANPD Resolution CD/ANPD 15/2024).
• International transfers: with the ANPD standard clauses or with your specific consent (art. 33; Resolution CD/ANPD 19/2024).
• Encarregado (art. 41): you can reach them using the contact form on the website or the support in your panel, the privacy channel in §1.

17.7 Mexico (Federal Law on the Protection of Personal Data Held by Private Parties, Official Gazette of 20 March 2025)

• This policy is our comprehensive privacy notice, and the one-page Privacy Notice is the simplified one. The necessary purposes are those in §5 (the contract, legal obligations and security); the voluntary ones, those in §6 (recommendations and emails): you can refuse them without losing the service.
• Sensitive data: only with your express and written consent; the electronic signature of the sensitive-data checkbox is such consent.
• ARCO rights (access, rectification, cancellation and objection) and withdrawal of consent, through the email address in §1.
• Transfers: we ask for your consent where a transfer needs it; the providers in §7.2 process data on our behalf and are not transfers.
• You can turn to the Secretaría Anticorrupción y Buen Gobierno (§16).

17.8 Chile (Law 19.628 and, from its entry into force, Law 21.719)

• Today you have the rights of information, modification, cancellation and blocking under Law 19.628.
• Once Law 21.719 enters into force (scheduled for 1 December 2026): access, rectification, erasure, objection, portability and blocking; sensitive data only with your express consent; and incidents that pose a risk notified to the Agencia de Protección de Datos Personales and, where appropriate, to you.

17.9 Peru (Law 29733 and its Regulation, Supreme Decree 016-2024-JUS)

• Rights of information, access, rectification, cancellation and objection, before us and, if we do not answer, before the ANPDP (§16).
• Sensitive data: only with your express and written consent; the electronic signature of the sensitive-data checkbox is such consent.
• Incidents: we notify the ANPDP and the people affected within 48 hours of becoming aware of them.

17.10 Ecuador (Organic Law on Personal Data Protection and its Regulation)

• Rights of access, rectification and updating, erasure, objection, portability and not to be subject to solely automated decisions; we answer within 15 days.
• Sensitive data: only with your explicit consent.
• Incidents: we notify the Superintendencia de Protección de Datos Personales within 5 days and, if they affect you, you as well.
• Data protection officer: you can reach them using the contact form on the website or the support in your panel, the privacy channel in §1.

17.11 Argentina (Law 25.326)

• Access: free of charge every six months (sooner if you show a legitimate interest); we answer within 10 calendar days. Rectification, updating and erasure: within 5 working days.
• Sensitive data: nobody is obliged to provide it; we only process it with your consent.
• You can complain to the AAIP (§16).

17.12 Other countries in Latin America and the Caribbean

• You have all the rights in this policy and, in addition, those granted by the law of your country: where it is more protective in something, we apply it in that respect. You can complain to the authority of your country (§16).

18. Version and validity

Version 2026-10-27 · In force from 27 October 2026 · The SHA-256 fingerprint of the text is calculated when it is stored and shown at the bottom of its page · Previous version: 2026-10-26.3 (2026-10-27: the approximate city from the connection with the recommendations, the model's contact details one by one and the client's optional phone number); before that, 2026-10-26.2 (2026-10-26.3: the seat in New Zealand and the English version as the one that prevails); before that, 2026-10-26.1 (2026-10-26.2 only corrects one word of the French translation); before that, 2026-10-21; before that, 2026-10-14; before that, 2026-10-12.1; before that, 2026-10-11.3; before that, the «Privacy Policy» of 2026-09-24. Texts prior to the signature chain had no version.

Validity of the databases: for as long as Perfect Escorts provides the platform service. Each category of data is kept for the period stated in §9. (Decree 1377, art. 13, no. 6, compiled in Decree 1074, art. 2.2.2.25.3.1.)

Legal basis. Colombia: Decree 1377, art. 13, no. 6. USA: Cal. Bus. & Prof. Code §22575(b)(4).

19. Language

This policy is offered in Spanish, English, French, German, Italian and Portuguese. The English version prevails: if there is any difference between the versions, the English text prevails, unless the law of your country provides otherwise. Each translation says so at the beginning. Your signature stores the exact version you were shown: in your language or, if there is no translation yet, in Spanish. The translation you signed counts as the information you received.

Legal basis. Colombia: Law 1480 of 2011 (consumer information in Spanish). Panama: Law 45 of 2007, art. 74, no. 9. EU: GDPR, art. 12.1, and recital 42.