Privacy policy
Translation for convenience. In case of discrepancy, the Spanish version prevails, except where the law of the user's country requires otherwise.
1. Who is responsible for your data #
- Controller
- INVERSIONES BUCARDO ZUNIGA LIMITADA
- Chilean tax ID (RUT)
- 78.123.772-8
- Privacy contact
- wbucardo@inversionesbucardozuniga.cl
In this policy, "the Holding", "we" or "us". This policy applies only to inversionesbucardozuniga.cl and to communications originating from it. Group companies (the "Companies") are independent controllers of the data they process on their own sites and services and have their own policies. If your request concerns a Company and you authorise us to do so, we will refer it to that Company, which will then be the controller of that processing (see §6).
2. Legal framework #
We process personal data under Chilean Law No. 19,628 on the Protection of Private Life, as amended by Law No. 21,719. From the publication of this policy we voluntarily apply the standards of Law No. 21,719. If you reside in a country covered by an annex in §14, that annex also applies, to the extent applicable and more favourable to you.
3. What data we process and why #
We collect the minimum necessary. We do not ask for sensitive data (health, racial or ethnic origin, political opinions, beliefs, sex life, biometric data, etc.) or personal financial data; please do not include them in your messages.
3.1. Contact form #
The form collects: name, email address, organisation, title (optional), country (optional), reason (the door chosen), message, language, and a record of your acceptance of this policy (version, date and time). Depending on the door chosen:
| Door | Purpose | Legal basis (Law 21,719) |
|---|---|---|
| Due diligence | Respond to enquiries from banks, auditors and counterparties in verification processes (KYC/KYB). Not a channel to offer or accept investments from the public | Pre-contractual steps at your request / legitimate interest in responding to enquiries |
| Carriers and commercial counterparties | Respond and, where appropriate, refer you to the relevant Company | Pre-contractual steps / legitimate interest |
| Founders and business owners | Respond to the request for a conversation. No commitment to assess or invest | Pre-contractual steps at your request |
| Authorities | Handle requests from competent regulators and public bodies | Compliance with a legal obligation |
| Press | Handle media requests | Legitimate interest in managing media relations |
| Senior talent | Consider you for current or future recruitment by the Holding or, with your authorisation, by the Companies | Consent (revocable) |
Information you send us: we do not sign confidentiality agreements at this stage. Do not send confidential information, trade secrets or third parties' personal data. If you do, we assume no confidentiality obligation beyond what the law imposes in respect of personal data.
Third-party data: if you provide data about other people (e.g. partners in your company), you represent that you are authorised to do so and have informed them of this policy.
3.2. Technical and security data #
| Data | Purpose | Legal basis |
|---|---|---|
| Irreversible salted SHA-256 hash of your IP address — we do not store the IP address in clear | Rate limiting and abuse prevention | Legitimate interest in the Site's security |
| Browser user agent, form source page, campaign (UTM) parameters if any | Security, fraud prevention and knowing how the enquiry reached us | Legitimate interest |
| Technical signals processed by Cloudflare Turnstile | Distinguish people from bots | Legitimate interest in security |
| Cookieless aggregate statistics (Plausible) | Measure Site usage | Legitimate interest; users are not identified |
| Hosting and database technical logs | Operations, security and diagnostics | Legitimate interest |
We carry out no advertising profiling and do not sell data. We make no decisions with legal or similarly significant effects based solely on automated processing.
3.3. Ethics and reporting channel #
Reports to the ethics channel are governed by the specific notice of that channel and its provider, with enhanced confidentiality and anonymity safeguards.
3.4. Impersonation reports #
Data you provide when reporting fraud is used only to investigate it, mitigate harm and, where appropriate, inform the authorities (basis: legitimate interest and, where applicable, compliance with a legal obligation).
4. Mandatory and optional data #
Fields marked as required are necessary for us to respond; without them we cannot process your request. Optional fields may be omitted without consequence.
5. Retention #
| Category | Period |
|---|---|
| Contact requests (all doors) | 24 months from receipt, then automatically deleted |
| Talent submissions | 24 months or until you withdraw consent, whichever is earlier |
| IP hash for rate limiting | 48 hours |
| Provider technical logs | In accordance with each provider's policy |
| Impersonation reports | As long as needed to handle the case |
| Records of rights requests | to evidence compliance |
We may retain data for longer only where required by law, for a pending claim, or for a subsequent contractual relationship (in which case the policy for that relationship applies). Once the period expires, data is deleted or irreversibly anonymised. Backups are overwritten on their cycle.
6. Who we share data with #
We do not sell, rent or transfer your data for commercial purposes.
6.1. Processors (providers processing data on our behalf, under contract, only on our instructions and with security measures):
| Provider | Service | Data processed | Data location |
|---|---|---|---|
| Lovable (Lovable Labs Incorporated) | Site build and hosting | Technical access logs | |
| Supabase, Inc. | Database and server functions (Edge Functions) | Form data, technical logs | |
| Resend (Plus Five Five, Inc.) | Sending notification emails | Name, organisation and door chosen | |
| Cloudflare, Inc. | DNS, network security, Turnstile | IP address and technical signals | Global network; headquartered in the USA |
| Plausible Insights OÜ | Cookieless analytics | Aggregate data, no personal identification |
6.2. Group Companies: we share your request with the relevant Company only when you ask us to or the request clearly concerns it (e.g. a commercial proposal for a Company, or a talent submission with your consent). That Company processes the data as an independent controller under its own policy.
6.3. Advisers and authorities: legal advisers, auditors or accountants bound by confidentiality, where necessary; and administrative or judicial authorities where required by law or a valid order.
6.4. Corporate transactions: in the event of a merger, demerger, sale or reorganisation, data may be transferred to the successor entity, which will be bound by this policy.
7. International transfers #
Some processors handle data outside Chile (mainly in the United States and the European Union). We make these transfers with the safeguards required by Law No. 21,719: to countries recognised as adequate by the Chilean Personal Data Protection Agency where such determinations exist, or through contractual clauses or other appropriate safeguards in each provider's data processing agreement (DPA). You may request information on these safeguards through the channel in §9.
8. Your rights #
Free of charge, you may exercise the following rights:
- Access: to know whether we process your data, which data, for what purpose, where it came from and to whom it was disclosed.
- Rectification: to correct inaccurate, outdated or incomplete data.
- Erasure: to ask us to delete your data when it is no longer necessary, has been processed unlawfully, you have withdrawn your consent, or on other legal grounds.
- Objection: to object to processing based on legitimate interest.
- Portability: to receive the data you gave us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller where technically feasible.
- Blocking (temporary suspension of processing) while a request for rectification, erasure or objection is being resolved.
- Not to be subject to decisions based solely on automated processing, including profiling.
- Withdraw your consent at any time, without retroactive effect.
9. How to exercise your rights #
- 1. Email wbucardo@inversionesbucardozuniga.cl or use the form at /en/contact, stating your name, the email address used in the form, the right you are exercising and the data concerned. If you act on behalf of someone else, attach proof of authority or representation.
- 2. We may request reasonable additional information solely to verify your identity (e.g. confirming from the same email address). We will not ask for a copy of your identity document unless strictly necessary.
- 3. We will respond within 30 calendar days, or within any shorter period required by the law of the applicable country under §14.
- 4. If you are not satisfied with the response, or do not receive it in time, you may complain to Chile's Personal Data Protection Agency or to the authority of your country (see §14).
10. Security #
We apply technical and organisational measures proportionate to the risk, including: encryption in transit (TLS) and at rest; form submission only through a server function with validation, rate limiting and anti-bot verification (no direct database access from the browser); role-based access control and Row Level Security in the database; access to data restricted to staff who need it, with multi-factor authentication; logging of status changes without copying personal data; separation of this Site from the Companies' systems; and automatic deletion when the retention period expires.
No system is completely secure. If a security breach affects your data, we will notify the competent authority and, where required, you, within the legal terms and time limits.
11. Minors #
The Site is intended for professionals and organisations. It is not directed at persons under 18, and we do not knowingly collect minors' data. If we learn that a minor has sent us data, we will delete it. If you are a parent or guardian and believe this has happened, contact us through the channel in §9.
12. Changes to this policy #
We may update this policy owing to legal changes or changes to the Site. We will publish the new version with its date. If a change materially affects processing based on your consent, we will inform you and, where required by law, seek new consent. We keep previous versions.
13. Contact #
wbucardo@inversionesbucardozuniga.cl
14. Country annexes #
The annexes in the Spanish version of this policy (A — Mexico; B — Colombia; C — Peru; D — Ecuador; E — United States; F — Other jurisdictions) apply equally to this English version. Where an annex is more protective than the master policy, the annex prevails. Key points:
- Mexico (LFPDPPP 2025): this policy is the comprehensive privacy notice; the primary purposes are responding to your request and, for the talent door, considering your application; we do not process your data for secondary purposes. ARCO rights via §9.
- Colombia (Law 1581/2012): ticking the acceptance box (never pre-ticked) constitutes prior, express and informed authorisation. Queries are answered within 10 business days (+5), claims within 15 business days (+8). Authority: Superintendence of Industry and Commerce (SIC).
- Peru (Law 29733; Regulation D.S. 016-2024-JUS): cross-border flow to the processors listed in §6.1; ARCO rights via §9. Authority: National Personal Data Protection Authority (ANPD).
- Ecuador (LOPDP 2021 and 2023 Regulation): rights include portability, suspension and not being subject to decisions based solely on automated assessments. Authority: Superintendence of Personal Data Protection.
- United States: we do not sell or share personal information (including that of consumers under 16) and use no sensitive personal information. We believe we do not currently meet the CCPA/CPRA thresholds or those of other comprehensive state privacy laws, but we honour the rights in §8 for all U.S. residents. The Site is not directed at children under 13.
- EU, UK and other jurisdictions: we recognise the rights in §8 under your applicable law, where it applies.