Privacy and Cookie Policy — www.santacruzip.cl

Version 1.0. Approvation pending. In force as of December 1st, 2026

1. Welcome

At Santa Cruz IP we work with assets born of other people's creativity and effort. We apply the same standard to the personal information of those who visit our website: we handle it with care, only for its proper purpose and transparently.

This Privacy and Cookie Policy (the "Policy") explains what personal data we collect through the website www.santacruzip.cl (the "Site") and its contact channels, what we use it for, on what legal basis, with whom we share it, how long we keep it and what rights you may exercise over it. It covers the entire Site —its pages in Spanish and English, including the news section—, the contact forms available on them, the published email addresses and the contact telephone number.

Santa Cruz IP is committed to compliance with Law No. 19,628 on the Protection of Private Life, as amended by Law No. 21,719, which regulates the protection and processing of personal data and creates the Personal Data Protection Agency (together, the "Law"), whose amendments come into force on December 1, 2026. We invite you to read this Policy before continuing to browse the Site or contacting us.

2. Preliminary matters

2.1. Scope

This Policy applies to the processing of personal data that Santa Cruz IP carries out directly through three channels: the Site's contact forms, in Spanish and English; email, with respect to communications you choose to send to the published addresses; and telephone, insofar as the call gives rise to personal data that the Firm records.

The Site also incorporates technologies provided by third parties and contains links to platforms operated by third parties. Each receives a different legal treatment, explained in section 6.3.

2.2. Data subjects

For the purposes of this Policy, a "Visitor" is a natural person who accesses and browses the Site without completing forms or contacting the Firm; a "User" is a natural person who completes any of the contact forms or contacts the Firm by email or telephone; and "You" refers to either of them.

The Site and the services of Santa Cruz IP are aimed at adults acting on their own behalf or on behalf of companies, international organizations, governments and other law firms.

2.3. Duty to inform, transparency and acceptance

The purpose of this Policy is to provide transparent information on the processing of personal data that the Firm carries out as controller, in compliance with the duty to inform under Article 14 ter of the Law and the principle of transparency and information under Article 3(g). It is provided for information purposes only.

Processing associated with the Site is based mainly on taking pre-contractual steps requested by the data subject and on the Firm's legitimate interest. Consent operates as a legal basis only for non-essential cookies and technologies, for the optional fields of the forms and for sending commercial communications. Merely browsing the Site does not constitute consent to processing that, under the Law, requires prior, specific and informed authorization: where the legal basis is consent, it is obtained through a mechanism separate and independent from submitting the form, and it may be withdrawn at any time without retroactive effect.

2.4. About the controller

Santa Cruz IP is a boutique law firm specializing in intellectual property, providing services in trademarks, patents, appellations of origin, copyright, trade secrets, intellectual property audits, technology transfer, licensing and training to multinational companies, international organizations, governments and other law firms.

For legal purposes, the controller is Santa Cruz IP Tecnología e Innovación SpA, Chilean taxpayer ID (RUT) 77.988.806-1, legally represented by Mr. Maximiliano Santa Cruz Scantlebury, with postal address at Av. Andrés Bello 2233, Office 501, Providencia, Santiago, Chile. It can be reached by telephone at +56 2 3245 4500 and, for data protection matters, by email at info@santacruzip.cl. Its website is www.santacruzip.cl. Hereinafter, "Santa Cruz IP" or "the Firm".

2.5. Processing not covered by this Policy

This Policy governs only the processing associated with the Site and the channels described in section 2.1. First, it does not govern the processing the Firm carries out when providing legal services to its clients: in those engagements the Firm may act as processor on the client's behalf or, as the case may be, as controller, and the processing is governed by the relevant engagement or contract, by any data processing addendum forming part of it and by professional secrecy.

Nor does it govern the processing of data of the Firm's employees, job applicants, suppliers and counterparties, which is governed by the applicable internal instruments and policies, or third-party sites and platforms accessed through links published on the Site, which have their own privacy policies.

3. Definitions

For a better understanding of this Policy, the following terms have the meanings set out below.

Personal data means any information linked or referring to an identified or identifiable natural person. A person is identifiable if their identity can be determined, directly or indirectly, in particular by means of one or more identifiers.

Sensitive personal data means personal data referring to the physical or moral characteristics of persons or to facts or circumstances of their private life or intimacy that reveal ethnic or racial origin, political, trade union or professional association membership, socioeconomic status, ideological or philosophical convictions, religious beliefs, data concerning health or the human biological profile, biometric data, and information concerning a natural person's sex life, sexual orientation and gender identity.

Data subject means the identified or identifiable natural person to whom the personal data relates.

Processing means any technical operation or procedure, automated or not, that allows personal data to be collected, processed, stored, communicated, transmitted or used.

Controller means the person who decides on the purposes and means of processing, regardless of whether it processes the data directly or through a third-party agent or processor. Third-party agent or processor means, in turn, the natural or legal person that processes personal data on behalf of the controller.

Consent means any free, specific, unambiguous and informed indication of will, given by a statement or a clear affirmative action, by which the data subject authorizes the processing of data relating to them.

Anonymization means an irreversible procedure by which personal data can no longer be linked or associated with a specific person or allow their identification. Anonymized data is no longer personal data.

Security breach means the accidental or unlawful destruction, leak, loss or alteration of personal data, or unauthorized disclosure of or access to it.

Cookie means a small text file that a website stores in your browser when you visit it, used, among other things, to remember preferences or measure how the site is used. This Policy uses the term to include other forms of local storage that perform equivalent functions.

Agency means the Personal Data Protection Agency, the supervisory authority competent in Chile for the protection of personal data.

4. Principles governing processing

Santa Cruz IP processes personal data in accordance with the principles set out in Article 3 of the Law.

Under the principles of lawfulness and fairness, data is processed lawfully and fairly, and the Firm can demonstrate the lawfulness of its processing. Under the principle of purpose limitation, data is collected for specific, explicit and lawful purposes and is not processed for purposes other than those disclosed. Under the principle of proportionality, only data that is necessary, adequate and relevant is processed, and it is kept only for as long as necessary. The principle of quality requires data to be accurate, complete, up to date and relevant to its source and the purposes of processing.

Under the principle of accountability, the Firm is legally responsible for complying with these principles and its other duties. Under the principle of security, it ensures adequate security standards against unauthorized processing and against loss, leak, damage or destruction of the data. Under the principle of transparency and information, it keeps this Policy permanently accessible in a precise, clear, unambiguous and free manner.

Under the principle of confidentiality, the Firm and those with access to the data keep it secret, even after the relationship with the data subject has ended. Finally, under the principle of data protection by design and by default in Article 14 quater of the Law, the Firm configures its channels so that, by default, only strictly necessary data is processed.

5. What personal data is processed and what is the legal basis in each case?

5.1. Users of the contact forms

The Site has contact forms on its home page and on its contact pages, in Spanish and English. Through them the Firm collects identification and contact data —first and last name, email address and, where the form offers it, telephone number— and the content of the communication, that is, the text you freely write in the message field, together with the date and time of submission.

The email address is always mandatory. On the home page form the other fields are optional; on the contact page forms, the name and message are also mandatory.

Legal basis. Taking pre-contractual steps at the data subject's request (Article 13(c) of the Law), since you voluntarily contact the Firm to raise a query or assess a possible engagement. For keeping the contact details and following up commercially, the basis is the Firm's legitimate interest (Article 13(d)), namely ensuring continuity and traceability of the service you yourself requested. This interest has been balanced against your rights and freedoms, considering that it concerns professional contact data, provided on your own initiative, used for the purpose for which it was provided and kept for a limited period. You may object at any time through the channels in section 10.

Optional fields are processed on the basis of the consent you give by voluntarily completing them; leaving them blank does not prevent you from submitting the form or receiving our reply.

5.2. Users who contact us by email or telephone

When you write to any of the published addresses, the Firm may process your email address, name, signature, position, organization and the content and metadata of the communication. When you call the published number, it may record your name, telephone number and the purpose of the call.

Legal basis. Taking pre-contractual steps requested by the data subject by voluntarily initiating the communication (Article 13(c)) and, for keeping and tracing the conversation, the Firm's legitimate interest (Article 13(d)) in maintaining a reasonable record of its professional interactions, balanced on the same terms as in section 5.1. You may object through the channels in section 10.

5.3. Visitors and technical browsing data

Browsing generates technical data necessary for the operation and security of the Site: IP address, date and time of access, browser type, device and operating system, language, pages requested and error or security logs, to the extent they allow a person to be identified directly or indirectly.

Legal basis. The Firm's legitimate interest (Article 13(d)), namely keeping the Site available and operational; preventing, detecting and investigating unauthorized access, abusive automated submissions and fraud; and diagnosing and correcting technical errors. This interest has been balanced against your rights and freedoms, considering that it concerns technical data, kept for a limited period, that is not used to identify you directly or to build profiles. You may object on grounds relating to your particular situation through the channels in section 10, although this may limit access to the Site where the processing is essential to its security.

5.4. Cookies and third-party technologies

a) Strictly necessary cookies and storage. These allow the Site to function and operate securely. Without them the Site cannot be provided properly, so they do not require your consent, but we must inform you of them. All of them are set by the Squarespace platform.

The crumb cookie prevents cross-site request forgery (CSRF) attacks and the test cookie checks whether the browser supports local storage and prevents display errors; both last for the session. The squarespace-video-player-options item is a session identifier for the platform's video player and is kept until deleted. The ss_performancecookiesAllowed and ss_marketingcookiesAllowed cookies remember, respectively, whether you accepted performance and analytics cookies and marketing cookies, and last 30 days.

b) Performance and analytics cookies. These are not necessary for the Site to function: they allow its use to be measured and improved. They are set only if you give your consent. All of them belong to Squarespace. The ss_cid, ss_cpvisit and ss_cvr cookies identify unique visitors and record their sessions on the Site, and last 2 years. The ss_cvisit and ss_cvt cookies identify unique visitors and record the current session, and last 30 minutes.

c) Third-party technologies embedded in the Site. Unlike a link, which transmits nothing until you click it, an embedded resource is requested as the page loads and transmits your IP address and browser characteristics to the provider. That is why these technologies require your prior consent.

The Site embeds four technologies of this kind. Google Maps, by Google, displays a map with the location of our offices and transmits your IP address, browser characteristics and interaction with the map to the provider. reCAPTCHA Enterprise, by Google, protects the forms against automated and abusive submissions, and transmits your IP address, browser characteristics and interaction data. Google Fonts, by Google, provides the fonts used by the map component and transmits your IP address and browser characteristics. Weglot, by Weglot SAS, provides the Site's translation service and likewise receives your IP address and browser characteristics.

d) Legal basis, consent and withdrawal. For the cookies in letter (a), the legal basis is the Firm's legitimate interest (Article 13(d)) in the Site loading, operating securely and respecting the preferences you yourself express; none of them measures your behavior. For the cookies in letter (b) and the technologies in letter (c), the basis is prior, specific, unambiguous and informed consent (Articles 2(p) and 12 of the Law). Legitimate interest is not a sufficient basis for the latter, and refusing them does not prevent you from browsing the Site.

You give or refuse your consent in the notice displayed when you enter the Site, where you may accept all categories, reject them all or choose by category; optional categories are switched off by default. You may change your decision at any time, without affecting your access to the Site's content, by reopening the preferences manager or deleting cookies from your browser. Your decision is recorded for thirty days, after which you will be asked again. Withdrawal applies going forward and does not affect the lawfulness of prior processing.

5.5. Third-party personal data contained in your communications

The message field of the forms and the emails you send us may, on your own initiative, contain personal data of third parties: members of your organization, inventors, authors, rights holders, counterparties or licensees.

The Firm expressly asks you not to include third-party personal data in such communications and, in particular, not to include sensitive data, data of children or adolescents, or information subject to confidentiality obligations. We also ask you not to include technical information about unprotected inventions or trade secrets: a general reference to the context is enough to describe your request. If you need to share information of that nature with us, we will indicate a secure channel. If you nonetheless decide to send us third-party data, you represent that you have a legal basis allowing you to do so and accept responsibility for having fulfilled your own duties to inform those persons.

Legal basis. For third-party data it actually receives, the Firm acts as controller on the basis of its legitimate interest (Article 13(d)) in understanding and assessing the request made to it, and processes that data for that sole and exclusive purpose. Applying the principles of proportionality and data protection by default, it minimizes its use, does not add it to its commercial management databases and deletes it as soon as it is no longer necessary and, in any case, within the period set out in section 8.2. Sensitive data or data of children or adolescents received without a legal basis allowing its processing is deleted immediately and securely.

5.6. Data the Firm does not request through the Site

Santa Cruz IP does not request or require, through the Site or its contact channels, sensitive personal data, biometric data, precise geolocation data or personal data of children or adolescents. None of its form fields is intended to obtain such data and its processes have not been designed to collect it. Any such data the Firm may receive unsolicited is governed by section 5.5.

6. How is data collected?

6.1. Manual means

Data is collected manually through the contact forms, in the fields the User voluntarily completes; through email, in messages sent to the published addresses; and through the telephone, in calls the User chooses to make.

6.2. Automated means

Data is also collected automatically through the server and platform technical logs generated simply by loading the pages; through the cookies and browser storage described in section 5.4; and through resources served from third-party domains, which are requested during loading and transmit the IP address and browser characteristics to the provider.

6.3. Third-party platforms, technologies and links

Technologies embedded in the Site. These are resources served from third-party domains that are requested while the page loads, without any action on your part; they are identified in section 5.4(c). Weglot acts as processor on the Firm's behalf. Google, by contrast, determines on its own account the purposes and means of the processing it carries out through Google Maps, reCAPTCHA Enterprise and Google Fonts, and is responsible for it as an independent controller under its own policies. In all cases, loading involves an international transfer, on the terms set out in section 8.4.

Outbound links. The Site links to the Firm's institutional profiles on Instagram and LinkedIn, to a professional LinkedIn profile, to media outlets and to the agency that developed the Site. An outbound link transmits no data until you click it: it involves no processing by the Firm and requires no prior consent. When you click, you leave the Site and become subject to the policies of those third parties, over which the Firm has no control.

Platform supporting the Site. The Site is built and hosted on Squarespace, which acts as the Firm's processor for hosting, deployment, receipt of form submissions and platform analytics. Squarespace also carries out processing on its own account regarding visitors' interactions, for which it is an independent controller. Chilean law does not provide for joint controllership: each party is responsible for the processing it decides on.

7. What is personal data used for?

7.1. Users of the contact forms

The data of those who complete the forms is used to reply to their query or request; to assess the matter raised and arrange meetings where appropriate; to take the steps prior to a possible engagement of professional services; and to ensure continuity and traceability of the service process the User initiated.

7.2. Users who contact us by email or telephone

The data of those who write to us or call us is used to handle and reply to the communication they initiate; to keep a reasonable record of professional interactions; and to take the steps prior to a possible engagement of professional services.

7.3. Visitors, operation and security of the Site

Technical browsing data is used to enable the Site to load, be browsed and operate technically; to keep it available and protect its infrastructure; and to detect and manage errors, incidents or security threats, including automated form submissions.

7.4. Cookies and third-party technologies

Cookies and third-party technologies are used to remember your cookie preferences; to produce aggregate statistics on the use and performance of the Site, where consent has been given for the performance and analytics category; and to display the location of our offices, offer translation of the Site and protect the forms against automated submissions, where consent has been given for third-party technologies.

7.5. Third-party personal data contained in your communications

This data is used only to understand and assess the request you make to us, for that sole and exclusive purpose, on the terms of section 5.5.

7.6. Commercial and informational communications

Where you give your specific consent, the Firm may process your name, organization and email address to inform you of intellectual property developments and the Firm's publications, invite you to seminars, training sessions and events it organizes or sponsors, and inform you of regulatory or case-law developments relevant to your activity.

Legal basis. The free, specific, unambiguous and informed consent of the data subject (Articles 2(p) and 12 of the Law), obtained through an indication separate and independent from submitting the form. Refusing to give it does not in any way affect how your request is handled. You may withdraw it at any time, without giving reasons and without retroactive effect, through the unsubscribe link included in each communication or through the channels in section 10. The Firm does not use this data for third-party advertising, nor does it sell, rent or transfer it for that purpose.

7.7. Anonymized and statistical data

The Firm may use, for statistical, historical or management improvement purposes, technical information that does not constitute personal data and data subjected to an irreversible anonymization procedure. Information that can be re-associated with a person will continue to be treated as personal data. The Firm does not use data collected through the Site for purposes other than those stated; should it wish to use it differently in the future, it will inform you in advance and, where appropriate, request new consent.

8. What are the Firm's main obligations?

8.1. Confidentiality, access and purpose

The Firm keeps personal data confidential, limits access to those who need it to fulfil the stated purposes and does not use it for incompatible purposes. Under Article 14 bis of the Law, this duty of secrecy continues even after the relationship with the data subject has ended, and the Firm takes the necessary measures to ensure that its staff and anyone processing data under its responsibility also comply with it. Santa Cruz IP does not sell, rent or transfer personal data for commercial or advertising purposes.

8.2. Retention and deletion

Data is kept only for as long as necessary to fulfil the relevant purpose or to meet legal or contractual obligations or for the defense of rights. Once that period has elapsed, it is securely deleted or irreversibly anonymized.

Cookies and browser storage are kept for the individual periods stated in section 5.4, and you may delete them earlier from your browser. Data from forms and communications that do not lead to a professional relationship is kept for 24 months from the last interaction. Third-party data received under section 5.5 is kept for 6 months from the assessment of the request, or deleted immediately where it is not necessary. Technical and security logs are kept for 12 months. Data for commercial or informational communications is kept until you withdraw your consent or unsubscribe.

Where a query leads to an engagement of services, from the start of the professional engagement that data ceases to be governed by this Policy and becomes governed by the services agreement and by professional secrecy, in accordance with section 2.5.

8.3. Processors and disclosures to third parties

The Firm engages providers that process personal data on its behalf and under its instructions, as processors. Under Article 15 bis of the Law, that processing is governed by a written contract setting out its subject matter, duration, purpose, type of data and categories of data subjects, prohibiting the processor from processing the data for any other purpose or subcontracting the engagement without written authorization, and requiring it to delete or return the data at the end of the service. The Firm remains responsible to data subjects.

The current processors are Squarespace Ireland Limited, with infrastructure and support from Squarespace, Inc. (United States), for hosting the Site, receiving form submissions, platform analytics and technical support; Google (Google LLC / Google Ireland Limited), for corporate email and handling the communications you send us; and Weglot SAS, for translation of the Site. Google also acts as an independent controller for the location map, anti-fraud protection of the forms and the map's fonts, in accordance with section 6.3. Finally, the Firm will disclose information to the courts and public bodies where required by law.

Google therefore acts in two distinct and non-interchangeable capacities: as processor for corporate email, where it processes data on behalf of and under the instructions of the Firm; and as independent controller for Google Maps, reCAPTCHA Enterprise and Google Fonts, where it determines the purposes and means of its processing on its own account.

8.4. International transfers

The providers in section 8.3 process information on servers located outside Chile, mainly in the United States of America and in European Union countries, and loading the technologies in section 5.4(c) likewise involves transmission abroad. Both operations are international transfers subject to Articles 27 and 28 of the Law.

As of the date of this Policy, the Agency has not declared that those countries provide an adequate level of protection. For that reason, each of these transfers relies on Article 27(b) of the Law: standard contractual clauses and equivalent legal instruments entered into with each provider, which establish adequate safeguards, that is, principles, rights and guarantees similar or superior to those offered by Chilean law, including enforceable rights and effective legal remedies for data subjects. The Firm keeps a record of the instrument applicable to each provider and will provide it to you on request through the channels in section 10.

8.5. Security and breach notification

Under Article 14 quinquies of the Law, the Firm adopts appropriate technical and organizational measures, taking into account the state of the art, implementation costs and the nature and risk of the processing: encryption of the Site's communications through the HTTPS protocol, with forced redirection of unencrypted traffic; access control to platforms based on individual credentials; restriction of access to information to staff who need it; confidentiality obligations for all staff, continuing even after their relationship with the Firm ends; and record-keeping and periodic review of providers processing data on its behalf.

In the event of a breach of security measures causing the destruction, leak, loss or alteration of personal data, or unauthorized access to it, that poses a reasonable risk to the rights and freedoms of data subjects, the Firm will report it to the Agency by the most expeditious means and without undue delay, and will keep a record of these notifications. Under Article 14 sexies of the Law, affected data subjects will also be notified, in clear and simple language, where the breach concerns sensitive data, data of children under fourteen or data relating to economic, financial, banking or commercial obligations.

8.6. Automated decisions and data of children and adolescents

The Firm does not make decisions based solely on automated processing of personal data, including profiling, that produce legal effects concerning you or significantly affect you. The Site's analytics are used for statistical and improvement purposes, not to evaluate, classify or segment people for advertising purposes.

The Site is aimed at adults and organizations. The Firm does not request or require data of children or adolescents, and none of its fields is intended to obtain such data; any it may receive without a legal basis allowing its processing is deleted immediately and securely, in accordance with section 5.5.

9. What are your rights as a data subject?

Law No. 19,628 on the Protection of Private Life, as amended by Law No. 21,719, grants you the rights set out below over your personal data. They are personal, non-transferable and non-waivable, and cannot be limited by any act or agreement. Exercising them before the Firm is free of charge.

Right of access (Article 5). You may obtain confirmation of whether we process your data and, if so, access it together with information on its source, the purposes, the recipients, the period of processing and the legitimate interests relied on where that is the legal basis.

Right to rectification (Article 6). You may request that your data be amended or completed where it is inaccurate, out of date or incomplete. Once rectified, we will not process the unrectified data again.

Right to erasure (Article 7). You may request deletion of your data in the cases provided by the Law, including where it is no longer necessary for the purpose for which it was collected, where you withdraw your consent and there is no other legal ground, or where you have exercised your right to object.

Right to object (Article 8). You may object to specific processing, in particular where its legal basis is our legitimate interest or where the processing is carried out for direct marketing purposes.

Right to object to automated decisions (Article 8 bis). You may object to, and not be subject to, decisions based on automated processing of your data, including profiling, that produce legal effects concerning you or significantly affect you, and in any case obtain an explanation, human intervention and review of the decision.

Right to blocking (Article 8 ter). You may request the temporary suspension of processing while a request for rectification, erasure or objection is being resolved. Exercising this right does not affect the storage of the data.

Right to data portability (Article 9). You may receive a copy of the data you have provided to us in a structured, generic and commonly used electronic format, and request its transfer to another controller, where the processing is automated and based on your consent.

Withdrawal of consent (Article 12). You may withdraw the consent given at any time and without giving reasons, by means similar or equivalent to those used to give it. Withdrawal has no retroactive effect and does not affect the lawfulness of prior processing.

In the event of the data subject's death, these rights may be exercised by their heirs, unless the deceased expressly prohibited access to, rectification or erasure of their data, or the law so provides.

9.1. Exceptions

The Firm is always obliged to provide information and grant access to the data requested, except where a law expressly provides otherwise. Erasure does not apply, among other cases, where processing is necessary to comply with a legal obligation or perform a contract, or for the establishment, exercise or defense of an administrative or judicial claim. Where data is covered by professional secrecy or forms part of a legal services engagement, the exercise of these rights is also subject to section 2.5.

9.2. Request formalities

Send us a written request to the email address or postal address in section 10, stating your identity and that of your representative or agent, if acting through one, with authentication of your identity; a postal address, email address or equivalent means for us to send our reply; and the data or processing in respect of which you are exercising the right. For rectification, state the precise changes requested; for erasure or objection, the grounds relied on and the supporting documents. For the right of access, your identification is sufficient.

9.3. Response times

We will acknowledge receipt of your request and respond in writing no later than thirty calendar days from its receipt, a period that may be extended once by up to thirty calendar days, of which you will be informed. We will reply to the postal or email address you have provided and keep proof of the dispatch, its date and its full content. If we refuse your request in whole or in part, we will give you the reasons and inform you that you have thirty business days to file a complaint with the Agency.

Where a request for temporary blocking is made together with a request for rectification, erasure or objection, we will respond within two business days of receipt, during which time we will not process the data concerned.

9.4. Complaint to the Agency

If we refuse your request or fail to respond within the legal time limit, you may file a complaint with the Personal Data Protection Agency within thirty business days of receiving the refusal or of the expiry of our time limit to respond, in accordance with Articles 11 and 41 of the Law.

10. Contact

For any question about this Policy, to exercise your rights or to request information on the safeguards for an international transfer, you may write to info@santacruzip.cl, visit us at Av. Andrés Bello 2233, Office 501, Providencia, Santiago, Chile, or call +56 2 3245 4500.

11. Validity and version

This Policy is version 1.0, approved on [date] and in force as of [date]. It remains available at www.santacruzip.cl, with its version number and date, in accordance with Article 14 ter(a) of the Law. Subsequent versions will be identified by their own number and date, and the version in force will always be the one published on the Site.

12. Amendments

This Policy may be amended to reflect regulatory changes, instructions from the Agency or changes in the operation of the Site. Any amendment will be published on the Site with a new version number and date, and will apply from its publication.

Since processing associated with the Site is not based on consent as its main legal basis, publishing a new version does not require your renewed acceptance. Where a change is substantial and affects processing that is based on your consent —non-essential cookies and technologies, or commercial communications—, we will inform you and request your new consent before applying it.

13. Governing law and dispute resolution

This Policy and the processing it describes are governed by Chilean law, in particular Law No. 19,628 on the Protection of Private Life, as amended by Law No. 21,719, which regulates the protection and processing of personal data and creates the Personal Data Protection Agency.

Data subjects' complaints regarding the exercise of their rights are heard by the Agency under the administrative protection procedure in Article 41 of the Law. Final or concluding decisions of the Agency, and administrative acts that halt the procedure, may be challenged through a claim of illegality before the Santiago Court of Appeals or the Court of Appeals for the claimant's domicile, at the claimant's choice, within fifteen business days of notification of the contested decision, in accordance with Article 43 of the Law. This is without prejudice to any actions available before the ordinary courts of justice.