Privacy Policy

1. Data controller

The controller of your personal data is Tecnologías Adauy Limitada, which operates under the name Mactec, RUT 77.880.841-2, a company incorporated in Chile, with its address at Av. Providencia 1208, oficina 207, Providencia, Santiago, Chile. Its legal representative is Matías Arturo Adauy Castro. Our data protection officer is Arturo Adauy, who oversees compliance with this Policy and handles requests from data subjects.

2. Channel for questions and requests

For any question about this Policy or to exercise your rights, write to us at contacto@mactec.cl, stating your name, your question or the right you wish to exercise, and a means of contact. Your request is handled by our data protection officer.

3. What data we process, about whom and for what purpose

We process only the data necessary for each purpose. Depending on your relationship with Mactec, we process the following data:

• Visitors to the mactec.ai website: IP address, browser and device type, pages visited, time spent and origin of the visit, collected through cookies and similar technologies, to operate the site, measure its use and improve it, measure the results of our ads and identify the companies that visit us, as explained in section 15.
• People who write to us through the mactec.ai website: name, email, phone number, company and the message you send in the contact form, to answer your inquiry and contact you about it. In the impact calculator, name, company, job title, email and the information about your company's processes that you enter, to generate the report with the support of an artificial intelligence service, send it to you and coordinate the consultancy if you request it.
• People who sign up for the waitlist of Habilitado, our accreditation platform for contractors and principal companies, at habilitado.co: only the email address, to let you know when the platform is available. We keep it for 2 years from the last interaction, like the prospect data in section 7.
• Business contacts and prospects: name, job title, company, professional email and phone number, public professional profile and history of our interactions, to offer our services to companies and follow up on the business relationship.
• Clients, their representatives and signatories: identification, contact, job title and electronic signature data, to enter into and perform contracts, invoice, collect payments and comply with tax obligations.
• Meeting participants: voice, image and content of the meeting, only when we record or transcribe it with the prior consent of the participants, to record the agreements, follow up on projects and have context if we resume contact with your company. Without consent, we do not record. The retention period is in section 7.
• People from our clients who ask us for support: name, phone number or email and the content of conversations by email, WhatsApp or our support system, to handle and follow up on their requests.
• Suppliers: identification, contact and bank account data, to manage purchases and payments and comply with tax obligations.
• Job applicants: identification and contact data, résumé, background and references, to assess their application and verify their background.
• Workers and service providers: identification data, including the RUT, contact, employment, social security and pay data and, where applicable, medical leave, to manage the employment or service relationship, pay remuneration and comply with legal obligations.
• People with access to our systems: accounts, permissions and activity logs and, on the personal devices they use for work, only the verification of authorized work software, to protect the information of Mactec and its clients. When the relationship ends, we close their accounts and keep a copy of their email and work files, to ensure operational continuity and for the possible defense of rights, for the period indicated in section 7.

Health data and data that reveal a person's socioeconomic situation, such as remuneration, are sensitive data. We only process them when the law allows it and with enhanced protection measures.

4. Lawful bases and legitimate interests

We process your data only when there is a lawful basis under the law:

• Consent: when you submit the contact form or the impact calculator, when you agree to us recording or transcribing a meeting and when you authorize us to keep your résumé after a selection process. We ask for consent that is free, informed, specific and unambiguous, and we record it.
• Performance of a contract or of pre-contractual measures you request: in the relationship with clients who are natural persons, with suppliers, workers and applicants, in support to our clients and when you sign up for the Habilitado waitlist.
• Compliance with legal obligations: labor, social security and tax obligations, and requests from authorities.
• Legitimate interest of Mactec, provided that your rights do not prevail: business-to-business prospecting, limited to minimal professional contact data and with an opt-out option in every mass communication; measuring the use of the site and of our ads and identifying the companies that visit us, through analytics, advertising and visitor identification cookies that you can reject at any time, as explained in section 15; the use of the contact data of the representatives, signatories and workers of client and supplier companies involved in a contract with us, only to enter into, perform and terminate it; the security of our systems and of the information our clients entrust to us; and safeguarding the email and work files of those who leave Mactec.
• Establishment, exercise or defense of rights: to keep the records of a relationship for as long as they may be needed in the event of a possible claim.
• Sensitive data of workers: in the field of employment and social security, in the cases permitted by law.

You may object at any time to processing based on our legitimate interest, as explained in section 9. In prospecting, anyone who asks not to receive further communications is excluded from future mailings.

5. Who we share your data with

Mactec does not sell, rent or trade your personal data. We only disclose it to:

• Technology and payment service providers that help us operate, contractually bound to protect the data: cloud, database and website hosting services; email, productivity and document storage; site analytics and advertising; artificial intelligence; client and document management; electronic signature; payments; prospecting and automation tools; messaging and support; credential management and software development.
• Public bodies, such as the Servicio de Impuestos Internos and social security institutions, and judicial or administrative authorities, when required by law.
• Third parties involved in a possible corporate reorganization, merger or acquisition, maintaining the protection standards of this Policy.

You can ask us for the up-to-date list of our providers through the channel in section 2.

6. International transfers

Some of our providers process data outside Chile:

• Brazil: the mactec.ai website and the impact calculator reports are hosted on Vercel servers in São Paulo.
• United States, mainly, and other countries where our providers operate under their data processing agreements: the mactec.ai website and the Habilitado waitlist, email and productivity, site analytics and advertising, meeting recording and transcription, client and document management, artificial intelligence, prospecting, electronic signature, automation, messaging, credential management and software development.
• Singapore: payments with PayPal, which processes the data as an independent controller.

When a provider processes data on our behalf, the transfer is covered by its data processing agreement, which includes contractual protection clauses, in accordance with article 27 of Law No. 19.628. Payment services, professional networks and advertising platforms process data as independent controllers, under their own policies. You can ask us for information about these safeguards through the channel in section 2.

7. Retention periods

We keep your data only for as long as necessary for the purpose for which we obtained it, or as required by law or a contract:

• Recordings and verbatim transcripts of meetings: in meetings with clients and prospects, up to 2 years from our last contact with the company, and the period starts again with each new contact; if a prospect signs a contract, the client rule applies. In an internal meeting about a client or prospect, the same period as that company; in an internal meeting that does not concern any company, 2 years from the meeting. In job interviews, which we only record if the applicant agrees, up to 1 year from the decision. When the period expires, a responsible person at Mactec reviews and authorizes deletion; nothing is deleted automatically. We keep the written summary of the meeting for as long as the contractual relationship lasts and up to 5 years after it ends; if the meeting was with a prospect that did not lead to a contract, we keep it as a record of the agreements and review it once a year; if it was an interview with an applicant who was not selected, 1 year from the decision; and if it was internal, 5 years from the meeting or from the closing of the project it relates to.
• Business contacts, prospects and inquiries received through the site that do not lead to a contract: 2 years from the last interaction.
• Clients, their representatives and signatories: for the term of the contract and 5 years after it ends. Tax documents, 6 years, as required by tax law.
• Applicants not selected: we delete their data when the process closes, except the recording and summary of their interview, which we keep for 1 year from the decision, and unless they authorize us to keep their résumé for future processes, in which case we keep it for up to 2 years.
• Workers and service providers: during the relationship and 5 years after it ends, except for documents that labor, social security or tax regulations require to be kept longer.
• Backup of the email and work files of former workers: 2 years from the end of the relationship.
• Suppliers: during the relationship and 6 years afterwards, as required by tax law.
• Support conversations: for as long as the contract with the client lasts and 2 years afterwards.
• Access and security logs of our infrastructure on Google Cloud and of our applications: up to 400 days for infrastructure administration logs and up to 90 days for application logs.
• Site browsing data: up to 14 months in Google Analytics, which afterwards keeps only aggregated statistics.

Recorded meetings. When we record or transcribe a meeting, we announce it in the invitation, with its purpose (recording the agreements and having context if we resume contact) and its retention period, and at the start, and we only record if the participants agree. If anyone objects, it is not recorded or transcribed. The periods are those in the first line of this section. If there is a claim, we keep what is necessary until it is resolved and the actions that may arise from it are time-barred.

Once the period has expired, we securely delete or anonymize the data, including backup copies where applicable. Anonymized information is no longer personal data.

8. Source of the data

Most of the data is provided by you. When that is not the case, it comes from:

• Commercial databases of professional contacts, such as Apollo.io, and professional networks, such as LinkedIn, in the case of business prospecting.
• The company you work for, when you are its representative or contact with Mactec.
• The references you provide in your application.
• Social security institutions, in personnel management.
• Our own systems, which generate access and activity logs.
• The site's cookies and similar technologies, as described in section 15.

9. Your rights

As a data subject you have the right to:

• Access: know whether we process your data, which data, for what purpose and with whom we share it.
• Rectification: correct inaccurate, outdated or incomplete data.
• Erasure: ask us to delete your data when it is no longer necessary, is processed without a legal basis or you withdraw your consent.
• Objection: object to our processing of your data, especially for prospecting or commercial purposes or when the processing is based on our legitimate interest.
• Portability: receive the data you provided to us in a structured, commonly used format, and ask us to transmit it to another controller, where applicable.
• Blocking: ask for the temporary suspension of the processing of your data while we resolve a request for rectification, erasure or objection.

To exercise them, write to us through the channel in section 2, stating your name, the right you wish to exercise and a means of contact. We may ask you to prove your identity, to protect your data. We will respond within the period set by law.

10. Right to file a complaint with the Agencia de Protección de Datos Personales

If we do not respond to your request within the legal period or you are not satisfied with our response, you may file a complaint with the Agencia de Protección de Datos Personales, in accordance with Law No. 19.628.

11. Withdrawal of consent

When we process your data based on your consent, you may withdraw it at any time and without giving a reason, through the channel in section 2 or by a means similar to the one you used to give it. Withdrawal does not affect processing carried out before you withdraw it.

12. Automated decisions

Mactec does not make decisions based solely on the automated processing of your data, including profiling, that produce legal effects concerning you or significantly affect you.

13. Security of your data

We apply technical and organizational measures proportionate to the risk to protect your data against unauthorized access, loss, alteration or improper disclosure. These include: classification of personal data as confidential information, access control with least privilege and two-factor authentication, encryption of communications, access logging, confidentiality duties for our staff, internal information security policies and an incident management procedure. If a security breach affecting your data occurs, we manage it and report it to the Agencia de Protección de Datos Personales and, where applicable, to the affected persons, in the manner and within the time limits required by law.

14. Data we process on behalf of our clients

When we develop, host or operate platforms and automations for our clients, we process the personal data contained in those platforms on behalf of the client. In those cases, the client is the controller and Mactec acts as processor. That infrastructure, such as databases (MongoDB Atlas), servers (Google Cloud) and web hosting (Vercel), is mainly in São Paulo, Brazil, and in some projects in the United States. As processor:

• We process the data only according to the client's instructions and to provide the contracted service, without using it for our own purposes or disclosing it to third parties without their authorization.
• We apply security measures and confidentiality duties, and we only engage other providers with the client's authorization.
• We inform the client of security breaches affecting their data, so that they can fulfill their obligations.
• When the service ends, we return or delete the data as instructed by the client.

If your data is on the platform of one of our clients, we recommend that you exercise your rights directly with that company, under its own privacy policy. If you write to us, we will forward your request to the client acting as controller and support it in its response.

15. Cookies and similar technologies

Our site uses cookies and similar technologies, both our own and third-party, loaded through Google Tag Manager:

• Technical: necessary for the site to work.
• Analytics: Google Analytics, to measure the use of the site and improve it.
• Advertising: Google Ads, to measure the results of our ads.
• Identification of visiting companies: Apollo.io, to learn which companies visit the site and support our business prospecting.

Analytics, advertising and visitor identification cookies are activated when you enter the site. You can reject them in the cookie notice that appears on your first visit and change your choice at any time from the "Cookie settings" link in the footer. If you reject them, we stop using them. You can also configure your browser to reject or delete cookies; if you disable technical cookies, some features of the site may not work properly.

16. Minors

Our services are aimed at companies and professionals. We do not knowingly collect personal data from minors under the age of 14. If we detect that we have received information from a minor without the consent of the person exercising parental authority over them, we will delete it from our records.

17. Changes to this Policy

We may update this Policy to reflect legal or technical changes or changes in the way we provide our services. We will publish the current version on this same page, with its version number and update date. This version replaces version 2.0 of October 24, 2026. We recommend that you review it periodically.

18. Contact

If you have questions or comments about this Policy or about the processing of your data, write to us through the channel in section 2. We will handle your request within the time limits set by Chilean regulations.