Version 1.0 — last updated: {{ TODO publication date }}
This policy describes how we process personal data within the ICO service (Organizational Connection Index). It is governed by Chilean Law 19.628 on the Protection of Private Life and, once it takes effect in December 2026, by Law 21.719.
1. Who is responsible for your data
The data controller is:
- Legal name: {{ TODO full legal name of Ampliando Círculos }}
- Tax ID (RUT): {{ TODO RUT }}
- Address: {{ TODO business address }}
- Contact for data matters: {{ TODO datos@ico.cl }}
2. What data we process
We process three categories of personal data:
Business contact data. Name, role, phone number and company of the people who act as counterpart in a commercial relationship with us. Collected during meetings, proposals, contracts and client onboarding.
Responses to the ICO instrument. When a company contracts the diagnostic, its employees answer a 19-question instrument. The responses make it possible to build the map of the real collaboration network, but the deliverables that the client receives are always aggregated at the area level. The output delivered to the client never identifies individual responses: the client sees how an area answered, not what a specific person answered.
Web navigation and analytics data. Cookies and aggregated site-usage metrics. {{ TODO confirm active analytics tools, or state that no third-party analytics are used }}.
3. Why we process the data
We process personal data for the following purposes:
- To deliver the ICO diagnostic service to the client that contracts it.
- Contractual and operational communication (coordination, support, report delivery).
- Product improvement (aggregated, non-identifiable analysis of how the instrument behaves).
- Compliance with legal and accounting obligations.
We do not process data for advertising profiling, nor for automated decisions with legal effects on individuals.
4. Legal basis for processing
- Business contact data: performance of the contract with the B2B client and legitimate interest in managing the commercial relationship.
- Responses to the ICO instrument: consent of the participant (informed at the start of the questionnaire) and execution of the B2B client’s mandate.
- Web analytics data: legitimate interest in operating and improving the site. Where applicable, prior user consent.
5. How long we keep the data
- Business contact data: during the commercial relationship and for {{ TODO reasonable post-term period, e.g. 5 years }} afterwards, for accounting and back-up purposes.
- Individual responses to the ICO instrument: kept during processing of the diagnostic and for {{ TODO period after report delivery, e.g. 90 days }} after the executive report is delivered. After that, they are irreversibly destroyed or anonymized. Only the aggregated deliverables remain (network map, dashboard, report), which no longer contain information identifiable at the person level.
- Web analytics data: according to the retention periods of the analytics provider in use.
6. Who we share the data with
We do not sell or transfer personal data for commercial purposes.
We share data with the technology providers strictly necessary to operate the service:
- Hosting and storage infrastructure: Google / Firebase (website and, where applicable, project storage). This implies an international data transfer to servers located outside Chile. The legal basis is operational necessity and, where applicable, consent.
- Email services: the corporate email provider from which we send communications.
- Web analytics tools: {{ TODO list if applicable, or state that none are used }}.
Each of these providers is subject to its own privacy policy and to contractual obligations to process the data only for the agreed purposes.
7. Your rights over your data
Under Chilean Law 19.628 and Law 21.719, you have the following rights regarding your personal data:
- Access: know what data of yours we process and how.
- Correction: correct inaccurate or incomplete data.
- Deletion: request that we delete your data when there is no longer a legal basis to process it.
- Objection: object to processing on legitimate grounds.
- Portability: receive your data in a structured, commonly used format (applicable under Law 21.719).
8. How to exercise your rights
To exercise any of the rights above, send us an email to {{ TODO datos@ico.cl }} stating:
- Company legal name and tax ID.
- Contact person and reply email.
- Type of right you are exercising.
- Specific description of your request.
We will respond within a maximum of 15 business days. If we need more time due to the complexity of the request, we will let you know with reasons.
9. Data security
We apply reasonable technical and organizational measures to protect the personal data we process: access restricted by person and purpose, encryption in transit, periodic backups, and access-revocation processes when a team member leaves the project. No security measure is absolute; any incident that may affect your data will be notified in line with applicable regulations.
10. Cookies and web analytics
{{ TODO this section depends on which analytics tools are active on the site. Options:
- If no third-party analytics: “This site currently does not use analytics or third-party cookies. Only strictly necessary cookies for site operation are used.”
- If Google Analytics or similar: list tools, purpose, opt-out mechanism, retention periods. }}
11. Changes to this policy
We may update this policy to reflect changes in our practices or in regulations. When we make a significant change, we will update the date at the top of the document and, where appropriate, notify active commercial contacts.
12. Contact and supervisory authority
For any question about this policy or about the processing of your data, write to us at {{ TODO datos@ico.cl }}.
Under Law 21.719 you may also file complaints before the Personal Data Protection Agency (once operational) under the terms set out in that law.