Privacy Policy

Language of this document. This is a courtesy translation into English of the Política de Privacidad of principiosvoluntarios.cl, in the version last updated on 4 October 2026, published in Spanish at principiosvoluntarios.cl/privacidad. Only the Spanish version is binding. In the event of any discrepancy, inconsistency or difference in interpretation between the two versions, the Spanish version prevails. This translation does not create, modify, add or remove any obligation, commitment or right of any person. References to and quotations from Chilean legislation and other legal instruments are unofficial translations. If the Spanish version is updated, the updated Spanish version prevails over this translation, even before this translation is updated. Consent given on the acceptance screen relates to the Spanish version.

This Privacy Policy describes how Fundación Empresas Indígenas, in its capacity as Executive Secretariat of the Chile Working Group on the Voluntary Principles on Security and Human Rights (hereinafter, ‘the Platform’), collects, uses and protects the personal data of its members, of its visitors and of the persons mentioned in the public news items that it monitors. Currently, this policy applies in accordance with Law No. 19,628 on the Protection of Private Life and, from 1 December 2026, in accordance with that same law with the amendments introduced to it by Law No. 21,719, which regulates the protection and processing of personal data.

As reference standards, and not as rules binding on the Foundation, this policy also takes into account ILO Convention 169, which binds the State of Chile, and the United Nations Guiding Principles on Business and Human Rights.

Until 30 November 2026, Law No. 19,628 is in force in its current wording; on 1 December 2026 the amendments introduced to it by Law No. 21,719 come into force. The articles cited are those of Law No. 19,628: where the reference is to the wording in force from 1 December 2026, established by Law No. 21,719, this is indicated, together with its equivalent currently in force where there is one.

This version corrects the version of 27 July 2026 in order to bring it into line with the law in force and with what the Platform actually does: it declares processing and recipients that already existed and that the previous version omitted, corrects the lawful bases invoked, withdraws commitments that the Platform did not fulfill and adds the right to suspend the processing of your data. As these are corrections required by law, it applies from its publication. If you accepted the previous version, you will be asked to accept this one at your next sign-in. Until you accept the current version, the Platform continues to operate as before: this version describes processing that was already taking place and that the previous version did not set out in detail. This refers to the processing of your data: the panel and its tools remain closed to you until you accept the current version, and in the meantime you continue to appear in the directory and to receive the usual emails, according to the preferences you have set. See sections 3 and 11.

1. Data controller

• Legal name: Fundación Empresas Indígenas
• RUT (Chilean tax ID number): 65.196.809-7
• Legal representative: Andrés Antivil Álvarez
• Address: Temuco, La Araucanía, Chile
• Role on the Platform: Executive Secretariat of the Chile Working Group
• Contact regarding personal data: contacto@principiosvoluntarios.cl
• Personal Data Protection Officer: Venancio Coñuepán Mesías, executive director, performs the functions of personal data protection officer; the Foundation’s board of directors will formalize his designation before 1 December 2026, the date from which Art. 50 is in force. It is his responsibility to supervise compliance with the data protection rules and to deal with the requests of data subjects. The designation is voluntary: from 1 December 2026, Art. 50 allows the controller to designate an officer and provides that the officer is to be designated by its highest governing or administrative authority, which in the Foundation is its board of directors. For any inquiry concerning personal data, write to contacto@principiosvoluntarios.cl.

2. Data we collect

We process the following categories of data:

3. Lawful basis and purposes

Until 30 November 2026, Law No. 19,628 permits the processing of personal data only where the law authorizes it or the data subject consents expressly and in writing (Art. 4). From 1 December 2026, the other bases of Art. 13 also apply. For each processing operation we indicate the current basis and the one that will apply from that date:

• Your record, your access and the Platform’s tools—directory, wall, direct messages, document library and the query assistant that answers questions about the framework of the Voluntary Principles, the news in the repository and the library documents. Currently: the express consent that you give in writing by accepting this policy at your first sign-in or, if you accepted an earlier version, at your next sign-in (Art. 4 of Law No. 19,628). Until you accept the current version, the Platform continues to operate as before: this version describes processing that was already taking place and that the previous version did not set out in detail. This refers to the processing of your data: the panel and its tools remain closed to you until you accept the current version, and in the meantime you continue to appear in the directory and to receive the usual emails, according to the preferences you have set. If you have never accepted any version of this policy, your situation is different. Until you accept it, we keep only the data with which your invitation was issued and the technical records of your access—the date and time of your last sign-in, the open session, the date on which you verified your email address with the access link and, if you sign in with Google or Microsoft, the link to that account (see 2.3)—as well as the abuse-control records described in section 6, in order to allow you that first access: you do not appear in the directory, other members cannot write to you and you do not receive emails from the Platform, except the access link that you yourself request. From 1 December 2026: the performance of the membership relationship and the Secretariat’s legitimate interest (Art. 13(c) and (d)).
• Coordination of the Group and weekly summary: coordinating meetings, distributing documents, publishing relevant news, sending the personalized weekly summary (briefing) according to your interest profile—which you can deactivate at any time—reviewing before they are sent the summaries that deal with Indigenous peoples, and reporting the participation of the Chile Working Group to the Voluntary Principles Initiative (VPI), in fulfillment of the Group’s mandate. Currently: the same consent (Art. 4 of Law No. 19,628). From 1 December 2026: the Secretariat’s legitimate interest (Art. 13(d)).
• News monitoring: collecting, classifying and summarizing news items already published by the media about the Voluntary Principles and human rights in the natural resources and energy sectors, and disseminating them to the Group and on the Platform’s site; they may contain data of the persons mentioned in them. The Foundation takes the view that collecting, summarizing and disseminating facts of general interest already published by the media is an exercise of the freedom to inform, and that this processing therefore falls outside the data protection law. Currently: Art. 1 of Law No. 19,628 exempts from that law processing carried out in the exercise of the freedoms to express opinions and to inform, ‘which [processing] shall be regulated by the law referred to in Article 19 No. 12 of the Political Constitution’, and the Foundation takes the view that this exclusion covers the entire activity of informing, including the archiving of the news and the Group’s querying of it. From 1 December 2026: the same exclusion, for processing carried out in the exercise of the freedoms to express opinions and to inform ‘regulated by the laws referred to in Article 19 No. 12 of the Political Constitution of the Republic’ (Art. 1, third paragraph, in the wording established by Law No. 21,719), whose second sentence subjects to the law the processing that the social communication media carry out for a purpose other than that of expressing opinions and informing; the Foundation takes the view that this limit also applies to it, and therefore, from that date, in order to maintain a searchable repository of that news and to query it using the assistant, it invokes in the alternative the Secretariat’s legitimate interest (Art. 13(d)), with the right of the person mentioned to object to that processing (Art. 8(a)).
• Ethnic origin, only if you choose to declare it: your express and specific consent, obtained separately with a box that is not pre-checked (currently, Arts. 4 and 10 of Law No. 19,628; from 1 December 2026, Arts. 12 and 16).
• Legal compliance when competent authorities so require (Public Prosecutor’s Office [Ministerio Público], National Human Rights Institute [INDH], courts): the authorization of the law itself (currently, Art. 4; from 1 December 2026, Art. 13(b)).
• Withdrawal of consent: Currently: Law No. 19,628 allows you to revoke in writing the consent you gave, without retroactive effect: the revocation does not affect the lawfulness of the processing carried out previously (Art. 4). As your acceptance of this policy is the condition for using the Platform, withdrawing it amounts to closing your account, which you can do from ‘Mi cuenta’ or by writing to contacto@principiosvoluntarios.cl; either of the two routes meets the requirement of doing so in writing (see section 6). From 1 December 2026: your record and your participation will no longer be based on consent but on the membership relationship and the Secretariat’s legitimate interest, so that the appropriate course will be to object to the processing based on legitimate interest (Art. 8(a)) or to request erasure (Art. 7), which, as regards membership, amounts to closing the account, by the same routes. Consent for the ethnic origin data is independent: you withdraw it yourself from ‘Mi cuenta’, the data is erased immediately and your participation in the Group does not change (currently, Arts. 4 and 10 of Law No. 19,628; from 1 December 2026, Art. 12, which allows it to be revoked at any time and without stating a reason, and Art. 16).

4. Processors and recipients of data

We share or transfer data to the following third parties:

• Voluntary Principles Initiative (VPI) — International Secretariat (voluntaryprinciples.org) — data recipient in its capacity as coordinator of the global network. The name, organization, pillar and role of the members of the Chile Working Group are shared as part of the annual participation report and of the coordination between national groups. Lawful basis: currently, your consent when accepting this policy (Art. 4 of Law No. 19,628); from 1 December 2026, the Secretariat’s legitimate interest linked to the Group’s mandate (Art. 13(d)). The communication is being formalized by means of a data communication agreement (see section 5). International contact: voluntaryprinciples.org/contact.
• Microsoft Azure (App Service, PostgreSQL and Blob Storage, in the Chile Central region) — computing and storage infrastructure. The Platform’s operational database is hosted in Chilean territory; see section 5 regarding the previous copy that remains in Brazil. There is a Data Processing Agreement (DPA) with Microsoft.
• Microsoft Entra ID — optional OAuth authentication provider. When the member chooses to sign in with their Microsoft account, the act of authentication is transferred to Microsoft. Of the profile data that Microsoft returns, the Platform keeps only the identifier of their account and the technical tokens of the link (see 2.3); their name and email address on the Platform are those in their record. No usage or content data of the Platform is transferred.
• Google LLC — optional OAuth authentication provider. When the member chooses to sign in with their Google account, the act of authentication is transferred to Google. Of the profile data that Google returns, the Platform keeps only the identifier of their account and the technical tokens of the link (see 2.3). Google LLC is subject to the EU-US Data Privacy Framework. No usage or content data of the Platform is transferred.
• Azure OpenAI Service — inference for: (i) the classification and automated summarization of news; (ii) the drafting of the personalized weekly summary (briefing), for which the model receives the selected news items and not your profile data; (iii) the operation of the query assistant, which processes the questions you put to it; and (iv) the semantic indexing (vectorization) of the text of the documents uploaded to the library, so that the assistant can cite them. This indexing covers all the library documents, including those with restricted visibility. The Platform’s Azure OpenAI resource is in the East US region (United States), where the indexing is processed; the language models involved in (i), (ii) and (iii) are deployed in Microsoft’s global deployment mode, in which the text sent may be processed in any Azure region in the world. It operates under Microsoft’s data processing agreement and does not use the data for model training.
• Azure Communication Services (United States; see section 5) — sending of transactional emails: sign-in link (magic link), account closure confirmation, notification of direct messages received, the weekly summary (briefing), notices of changes to the Terms of Use and to this policy, and, to administrators, security alerts and notices of weekly summaries pending review. The direct message notification email reproduces the full text of the message; that email remains in the recipient’s mailbox, with the email provider the recipient uses.
• Platform administrators — review, before they are sent, the weekly summaries that deal with Indigenous peoples, seeing the text of the summary together with the member’s name and email address (see 2.2).
• GitHub — version control of the source code, which does not contain members’ personal data. GitHub also runs the Platform’s scheduled tasks, including the daily purge of the database described in section 6, and for that purpose stores the database access credential as an encrypted secret.
• Competent authorities only where there is an express legal mandate (court order, reasoned ministerial request).

5. International transfer

The Platform’s operational database is hosted in Azure Chile Central. A previous copy remains stored in Azure Brazil South until its deletion is completed. The App Service and document storage are also hosted in Azure Chile Central.

The following international transfers also remain, limited to the data indicated:

• Voluntary Principles Initiative — International Secretariat (the Netherlands): name, organization, pillar and role of the members, for the annual participation report and the coordination between national groups. Lawful basis for the processing: currently, your consent when accepting this policy (Art. 4 of Law No. 19,628); from 1 December 2026, the Secretariat’s legitimate interest (Art. 13(d)). Transfer mechanism: currently being formalized by means of a data communication agreement with contractual clauses that has not yet been signed. From 1 December 2026, the transfer requires contractual clauses signed with the International Secretariat establishing adequate safeguards (Art. 27(b), from 1 December 2026); for this purpose there is a set of model contractual clauses approved by Exempt Resolution No. RAEX202503748 of the Undersecretariat of Economy and Smaller Enterprises (Subsecretaría de Economía y Empresas de Menor Tamaño), published in the Official Gazette (Diario Oficial) on 19 December 2025, which applies from its publication and until the Personal Data Protection Agency (Agencia de Protección de Datos Personales) exercises the power to approve model clauses and other legal instruments conferred on it by the second paragraph of Art. 28, from 1 December 2026 (Article Two of that resolution). If they have not been signed by that date, the Foundation will not send personal data to the International Secretariat until they are signed.
• Azure OpenAI Service (United States): the text of queries to the assistant, the content that is summarized or classified and the text fragments of the library documents that are semantically indexed. The indexing is processed in the United States; the language models that classify and summarize news, draft the weekly summary and respond to the assistant operate in Microsoft’s global deployment mode, in which the text may be processed in any Azure region in the world (see section 4). Currently, the transfer is carried out under the Standard Contractual Clauses included in Microsoft’s DPA. From 1 December 2026, the law requires the transfer to be covered by contractual clauses establishing adequate safeguards, in accordance with Art. 28 (Art. 27(b), from 1 December 2026), and the Foundation invokes those same clauses for that purpose. The data is not used for model training.
• Azure Communication Services (United States): the emails sent by the Platform, with their recipient’s email address and their content: the direct message notification carries the names of the sender and of the recipient and the full text of the message, and the weekly summary, the text of the summary (see section 4). The Platform’s Azure Communication Services resource has its data located in the United States. Currently, the transfer is carried out under Microsoft’s DPA and the Standard Contractual Clauses that it incorporates. From 1 December 2026, the law requires the transfer to be covered by contractual clauses establishing adequate safeguards, in accordance with Art. 28 (Art. 27(b), from 1 December 2026), and the Foundation invokes those same clauses for that purpose.
• Access providers (Google and Microsoft): only if you choose to sign in with your Google or Microsoft account, that provider receives the request to sign in to the Platform—that is, it knows that you access it and when—and processes it in its own services, which may be outside Chile. It does not receive usage or content data of the Platform (see section 4).

The transfers to Azure OpenAI (the United States and, for the language models, other Azure regions) and to Azure Communication Services (the United States) are covered by the Standard Contractual Clauses incorporated into Microsoft’s Data Processing Agreement, which from 1 December 2026 the Foundation invokes as contractual clauses with adequate safeguards in accordance with Art. 28 (Art. 27(b)). The transfer to the International Secretariat of the Voluntary Principles Initiative (the Netherlands) is in the process of being formalized by means of a data-sharing agreement; until it is signed, the transfer is limited to the strict minimum (name, organization, pillar and role) and, from 1 December 2026, it will not take place without signed clauses. Chile has not yet issued adequacy decisions in respect of any country: that power belongs to the Personal Data Protection Agency once Law No. 21,719 comes into force, on 1 December 2026 (Art. 28).

The emails sent by the Platform—including the direct message notification, which reproduces the text of the message—are delivered to each recipient’s email provider, which the Foundation does not control and which may host them outside Chile.

6. Retention periods and erasure

• Active account: for as long as the member is part of the Working Group.
• Account closure (right to erasure): when closure is requested—from your panel or by writing to the Secretariat, with the same result in both cases—we immediately erase your identification data (name, email address, organization, position, pillar, committee) and your ethnic origin if you had declared it, we close all your active sessions on all devices, we delete pending verification tokens and the links with Google or Microsoft, and we delete your interest profile and the briefings you received. Your account is pseudonymized (Art. 2(l), from 1 December 2026): the associated records no longer show your name and your email address, and could only be attributed to you again from the database’s automatic backups, which are kept for 7 days and then deleted. Until its deletion is completed, the previous copy in Azure Brazil South retains the data it contained. This is not an irreversible anonymization: the text of your posts, comments and messages is kept as it is, unless you ask for it to be deleted, and may contain data that identifies you. If the account corresponds to an invitation that was never used—with no sign-in, no acceptance of any version of this policy and no content—the Secretariat deletes it completely instead of pseudonymizing it.
• Contributions to the Group’s work: your posts and comments on the internal wall form part of the Working Group’s collective body of discussion. When closing your account, you choose expressly, with no option pre-selected, whether they are kept dissociated from your identity (pseudonymized) or deleted, and your choice is noted in the internal audit log. Currently: retention is based on that express choice of yours, and you may request deletion at any time. From 1 December 2026: retention is based on the Secretariat’s legitimate interest in preserving the continuity and memory of the Group’s collective work (Art. 13(d)), and you may object to it (Art. 8(a)). You may request the deletion of your posts and comments on the wall: when closing your account, by choosing that option, or afterwards, by writing to contacto@principiosvoluntarios.cl. We will proceed unless a legal obligation or one of the exceptions to the right to erasure established by law (currently, Art. 15 of Law No. 19,628; from 1 December 2026, Art. 7) requires their retention in a specific case.
• Direct messages: the messages you exchanged with other members are kept in their recipient’s inbox, because they are also that person’s data. When you close your account they no longer show your name, but their text is not deleted; the option to delete content when closing the account covers only your posts and comments on the wall. If you need a direct message to be deleted, write to us at contacto@principiosvoluntarios.cl.
• Documents and attachments: the documents you contributed to the library, and the fragments of their text indexed for the assistant, are kept as part of the Group’s collection; when you close your account they no longer show your name. If you ask for your content to be deleted when closing the account, we remove the attached file from your posts, but the file itself is not automatically deleted from storage: if you wish to have it deleted, or to have a library document deleted, write to us at contacto@principiosvoluntarios.cl.
• Audit log: we keep an internal record of relevant actions on data (including the account closure itself) in order to be able to demonstrate the lawfulness of the processing and to answer for it—principles of lawfulness and accountability established by Art. 3(a) and (e), from 1 December 2026—and for any defense against complaints. After pseudonymization, this log does not allow direct identification of the data subject.
• Verification tokens (magic link): valid for 15 minutes; deleted in the scheduled purge following their expiry.
• Expired sessions: deleted 30 days after their expiry.
• Abuse-control records (rate limiting): they contain a counter associated with a minimal identifier—depending on the case, your internal account identifier together with the type of action, the domain of your email address with the local part reduced to a hash, or your truncated IP address (IPv4 to /24, IPv6 to /48). They never store your full email address or your full IP address. They are purged daily and none is kept for more than 48 hours.
• Server technical logs: 3 days (retention configured in Azure App Service).
• Weekly summaries of anyone who has never accepted any version of this policy: they are not kept. The daily purge deletes the stored weekly summaries of every account that has never accepted any version of this policy.
• Unused invitations: an invitation that is not used within 30 days of being issued or reissued is automatically deleted in full, together with its pending access links; this is noted in the internal audit log with the identifier of the deleted record.
• Sensitive ethnic origin data: immediate deletion when you withdraw your consent from ‘Mi cuenta’ or ask the Secretariat to do so.

7. Your rights (ARCO+)

As the data subject, you may exercise the following rights:

• Access: to know what data we hold about you. You can download it yourself from your panel, in ‘Mi cuenta’; the download includes the direct messages you sent and received.
• Rectification: to correct inaccurate or out-of-date data. Your name, organization, position, pillar and committee can be edited directly in ‘Mi cuenta’. Your email address cannot be edited from ‘Mi cuenta’, because it is your access identifier: to rectify it, write to the Secretariat at contacto@principiosvoluntarios.cl.
• Erasure / Cancellation: to request deletion when the data is no longer necessary or you have withdrawn consent. You can close your account from ‘Mi cuenta’ (with the option of also deleting your posts and comments on the wall) or ask the Secretariat to do so, with the same result; see section 6.
• Objection: to object to specific processing. From ‘Mi cuenta’ you can object to appearing in the member directory, deactivate the weekly summary (briefing) and edit or empty your interest profile. Objection to appearing in the directory takes effect immediately; deactivation of the weekly summary, from the next mailing.
• Portability: to receive your data in a structured format (JSON), or a ZIP that also includes the documents you uploaded. Downloadable from ‘Mi cuenta’.
• Blocking (suspension of processing): to temporarily suspend the processing of your data (currently, Art. 12 of Law No. 19,628; from 1 December 2026, Art. 8 ter). You can activate and lift it yourself from ‘Mi cuenta’, with immediate effect, or ask the Secretariat to do so by writing to contacto@principiosvoluntarios.cl. While it is active, you do not appear in the member directory, you do not receive the weekly summary or the Platform’s bulk emails, and no one can choose you as the recipient of new direct messages. Blocking does not delete your data, which is kept, nor does it prevent you from signing in, viewing your data or downloading it. Nor does it withdraw what you have already contributed: your posts, comments and documents remain visible to members with your name, and existing direct message conversations are kept in both inboxes. Currently: Law No. 19,628 allows you to demand the blocking of the data you provided voluntarily when you do not wish to continue appearing in the relevant register, permanently or temporarily (Art. 12). From 1 December 2026, the law recognizes this right while a request of yours for rectification, erasure or objection is being resolved, and as an alternative to erasure in the cases of Art. 7 (Art. 8 ter); when blocking accompanies one of those requests, it must be requested on reasoned grounds, the law sets a period of two working days to respond to it and, until it is resolved, the data covered by the request cannot be processed (Art. 11, from 1 December 2026). Under both regimes, the Platform allows you to exercise it at any time.
• Automated decisions: from 1 December 2026, you have the right to object to and not to be subject to decisions based on the automated processing of your personal data, including profiling, that produces legal effects on you or significantly affects you; and, in all cases of decisions based on automated processing, to obtain an explanation, to human intervention, to express your point of view and to request a review of the decision (Art. 8 bis). The Platform does not make decisions of that kind about members. The use of AI is limited to classifying and summarizing the news items in the repository, drafting your weekly summary, indexing the library documents and answering your queries to the assistant, and none of those uses produces legal effects on you or significantly affects you: the one closest to you, the profiling for the weekly summary explained below, only decides which news items appear in your email, and when it is held for review, the person who decides whether it is sent is an administrator, not the system. Your posts and comments on the wall are not processed with AI. You can challenge a specific classification or request its human review by writing to us.
• Profiling for the weekly summary: we do carry out limited profiling to personalize the weekly summary (briefing). Each week we take the approved news items from the last seven days and assign each one a score that gives a 60% weight to its match with your interest profile—the proportion of the dimensions you declared (pillars and topics) that the news item satisfies—and a 40% weight to its age, with a higher score the more recent it is. The sectors you mark play no part in the score. Up to five news items with some match are selected; if none matches, or if you did not declare a profile, the three with the highest score are selected, which in that case are the most recent. A language model drafts the summary from those news items. If any of them deals with Indigenous peoples, the summary is held until an administrator reviews it (see 2.2). The consequence for you is which news items appear in your weekly email and, in that last case, whether the email is sent. You can edit or delete your interest profile and deactivate the weekly summary at any time from ‘Mi cuenta’.
• Complaint to the authority: until 30 November 2026, Law No. 19,628 is in force. If we do not issue a decision on your request within two working days, or we refuse it on a ground other than the security of the Nation or the national interest, you may apply to the civil court of first instance (juez de letras en lo civil) of the Foundation’s domicile, in accordance with Article 16 of that law. From 1 December 2026, with the entry into force of Law No. 21,719, you may lodge a complaint with the Personal Data Protection Agency within thirty working days from when you receive our negative response, in whole or in part, or from when the period we have to respond to you expires (Arts. 11 and 41).

You can exercise the rights of access, rectification (except for a change of email address), portability, objection, blocking and account closure directly from your panel, and they are carried out immediately. For any other request—or if you prefer assistance—write to us at contacto@principiosvoluntarios.cl; we acknowledge receipt and respond to you in writing. While Law No. 19,628 is in force, if we do not issue a decision within two working days you may apply to the court, as indicated above. From 1 December 2026, the legal period for us to issue a decision will be 30 calendar days, extendable once only by up to 30 further calendar days, of which we will inform you (Art. 11). The Foundation does not charge for the exercise of these rights.

8. Security

We apply reasonable technical and organizational measures: TLS encryption on all connections (HSTS preload), encryption at rest of the database, passwordless authentication by means of a single-use magic link (valid for 15 minutes) or by means of trusted OAuth providers (Google, Microsoft), role-based access control, rate limiting by IP and email, an audit log of administrators’ actions on member accounts (closure, deletion of invitations never used and suspension of processing) and of the review of weekly summaries, separation of environments. We carry out periodic security audits following the OWASP Top 10 framework.

9. Breach notification

From 1 December 2026, if we detect a breach of security measures affecting personal data, we will report it to the Personal Data Protection Agency, by the most expeditious means possible and without undue delay, where there is a reasonable risk to the rights and freedoms of data subjects, and we will also communicate it to the affected data subjects when it concerns sensitive data (such as ethnic origin), data relating to children under fourteen or data relating to obligations of an economic, financial, banking or commercial nature (Art. 14 sexies). In addition, as a voluntary commitment of the Foundation, from now on we will notify affected data subjects when a breach entails a high risk to their rights, even if it does not concern those categories of data. We also keep an internal register of breaches.

10. Minors

The Platform is not directed at persons under 18 years of age. We do not intentionally collect data from minors. If we detect that information about a minor has been collected without the authorization of a parent or guardian, we will proceed to delete it immediately.

11. Amendments

This policy may be updated. Each version is published on the Spanish page of this policy with its last-updated date. Amendments that alter the processing—new purposes, new recipients or changes to the lawful bases—will be notified to members by email at least 30 days before they come into force. Corrections required by law, or that bring the text into line with what the Platform actually does, apply from their publication and members are informed of them by email. The exception is anyone who has the processing of their data suspended (see section 7): while the suspension is active, they do not receive by email the notice of a new version. You will be asked to accept every new version of this policy or of the Terms of Use at your next sign-in to the Platform; what happens with this version until you accept it is explained at the beginning of this policy.