Personal Data Processing Policy

1. Who processes your data

The data controller is Ziemtinel Global Cyberdefense Partner Ltda., RUT 78.255.165-5, with registered address at Av. Independencia 1376, Puente Alto, Región Metropolitana, Chile, trading commercially under the Ziemtinel brand on the site ziemtinel.cl.

For any matter relating to this policy or to the exercise of your rights, the channel is contacto@ziemtinel.cl.

2. What data we process and what for

We only collect data in four situations, and in each one we process the following:

Situation	Data	Purpose and lawful basis
Proposal request	Name, email, phone, company, job title, service and regulations of interest, size of the organisation, timescale and message.	To prepare and send you a commercial proposal. Basis: pre-contractual measures requested by you.
Diagnóstico gratuito	Email, company, regulation assessed and your answers to the self-assessment.	To calculate your compliance percentage and send you the report. Basis: your consent, which is requested expressly before sending.
Compra	Name, email, phone, company, RUT and country; if the payer is someone else, their name, RUT and email as well.	To process the payment, issue the tax document and deliver what you bought. Basis: performance of the contract and legal tax obligations.
Navegación	IP address, browser and version, operating system, device type and make, language, approximate country, region and city, internet provider, referring site and pages visited.	To keep the site secure and operational and to understand which content is useful. Basis: legitimate interest in the security and improvement of the service.

We do not process sensitive data within the meaning of article 2, letter g) of Law 21,719, nor data of children and adolescents. Our services are aimed at organisations and at people acting in their professional capacity.

We do not sell or transfer your data to third parties for commercial purposes, nor do we build profiles with legal effects for you, nor do we take automated decisions that affect you.

3. Cookies

We use two, and neither for advertising purposes:

• ZIEMSESSID — session cookie, essential for the basket, the login and the protection against request forgery to work. It is deleted when you close the browser.
• ZIEMVID — a random visitor identifier that makes it possible to recognise successive visits from the same browser and to measure use of the site. Lasts 90 days and it contains no data that identifies you.

You can delete or block them from your browser. If you block ZIEMSESSID, the cart and access to your account will stop working.

4. Who else is involved

To deliver the service we rely on providers acting as data processors, each with access only to what it needs:

• Flow.cl — processes the payments. Your card details never pass through our servers: Flow receives and processes them directly.
• Railway — the infrastructure where the application runs and the database is stored.
• Cloudflare — domain resolution, protection against attacks and delivery of static resources.
• Google Fonts — the site's fonts. When they load, your browser connects to Google servers, which receive your IP address.
• Our own mail server, hosted in Chile, from which the communications we send you go out.

5. Transfers outside Chile

The infrastructure of Railway and Cloudflare is located outside Chile, mainly in the United States. This means your data is stored and processed abroad, under the data processing agreements signed with each provider and with the safeguards required by Title V of Law 21,719.

6. How long we keep them

• Requests and assessments: for as long as the commercial relationship lasts and up to 24 months after the last contact.
• Purchases: for the period required by Chilean tax and commercial legislation, currently six years.
• Browsing logs: for up to 12 months, after which they are irreversibly anonymised.

7. Your rights

Law 21,719 grants you the following rights, which you may exercise free of charge:

• Access — to know what data of yours we process and to obtain a copy.
• Rectification — to correct any that are inaccurate or incomplete.
• Erasure — to ask us to delete them when they are no longer necessary or you withdraw your consent.
• Objection — to object to processing based on legitimate interest.
• Portability — to receive your data in a structured, commonly used format.
• Blocking — to ask for processing to be temporarily suspended while a request is resolved.

Write to us at contacto@ziemtinel.cl stating which right you wish to exercise. We will reply within 30 calendar days. We may ask you to prove your identity before we hand over information, precisely in order to protect your data.

If you believe we have not handled your request properly, you can complain to the Personal Data Protection Agency.

8. Security

We apply encryption in transit across the whole site, role-based access control, logging of administrative activity, passwords stored using key derivation functions designed for that purpose, and separation of credentials from the code. No system is infallible: should a breach occur that affects your data and poses a risk to your rights, we will inform you and notify the authority in accordance with Law 21,719.

9. Changes

If we amend this policy, we will update the effective date in the heading. Where the change is substantial and affects processing based on your consent, we will tell you by email before applying it.