1. BACKGROUND

DCV Asesorías y Servicios S.A. recognizes the personal data of its employees, clients, and suppliers as one of the company’s most important assets. Therefore, it considers the proper processing of personal data to be essential, handling such data diligently, responsibly, transparently, and in compliance with applicable regulations.

2. PURPOSE

The purpose of this policy is to establish the concepts, guiding principles, and guidelines for the access, processing, and proper protection of the personal data referred to above.

The proper handling of this information, both internally and externally, must be understood by all employees, suppliers, and other third parties who access personal data provided by DCV Asesorías y Servicios S.A. ensuring that it is used responsibly and preventing situations that may result in non-compliance with legal obligations regarding personal data protection, thereby safeguarding such data.

3. SCOPE

This policy shall apply to all personal data processing activities carried out by DCV Asesorías y Servicios S.A., as well as to all its employees, suppliers, and other third parties who use or process personal data in connection with their business relationship with the company, regardless of their geographic location and in accordance with applicable regulations.

4. CONTROL AND SANCTIONS

Failure to comply with the provisions of this policy shall be considered a breach and may be subject to sanctions according to its severity, following an assessment of the intent, impact, and damage caused to DCV Asesorías y Servicios S.A.

5. RELATED DOCUMENTS

• Internal Regulations on Order, Hygiene, and Safet
• Personal Data Protection Law (Law No. 19,628)
• Information Security and Cybersecurity Policy

6. DEFINITIONS

Personal Data: Any information relating to an identified or identifiable natural person. A person shall be considered identifiable if their identity can be determined, directly or indirectly, in particular by means of one or more identifiers
Sensitive Personal Data: Data relating to the physical or moral characteristics of individuals, or to facts or circumstances concerning their private life or intimacy, such as personal habits, racial origin, ideologies, beliefs, political opinions, religious convictions, physical or mental health status, sexual life, among others.
Consent: Any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, expressed through a statement or a clear affirmative action, by which the data subject, their legal representative, or authorized agent, as applicable, authorizes the processing of personal data concerning them.
Personal Data Processing: Technical procedures, whether automated or not, that allow the collection, storage, recording, organization, preparation, selection, extraction, comparison, interconnection, dissociation, communication, assignment, transfer, transmission, or deletion of personal data, or its use in any other manner.
Data Controller: A natural or legal person, whether private or public, who determines the purposes and means of processing personal data, regardless of whether the data is processed directly by them or through a third-party agent.
Data Processor: A natural or legal person who processes personal data on behalf of the Data Controller.
Data Subject: An identified or identifiable natural person to whom the personal data relates.
ARSOPB Rights: Rights granted by law to data subjects to protect their personal data against one or more data controllers processing their data. These rights include access, rectification, erasure, objection, portability, and blocking.

 

7. POLICY

7.1 Principles

DCV Asesorías y Servicios S.A. shall process information and personal data under its responsibility in accordance with the following data protection principles:

7.1.1 Lawfulness and Fairness Principle

Personal data shall be processed in compliance with applicable regulations and based on one of the lawful grounds authorizing its processing in accordance with the Law.
Where the data subject’s consent is required, such consent must be freely given, prior, explicit, informed, and unambiguous.

7.1.2 Purpose Limitation Principle

Personal data shall be collected for specific, explicit, lawful, and informed purposes. Processing shall be limited to fulfilling those purposes.

7.1.3 Proportionality Principle

Only personal data that is necessary, adequate, and relevant for the purposes of the processing shall be processed.

7.1.4 Data Quality Principle

Personal data must be accurate, complete, up to date, and relevant in relation to its origin and the purposes of processing.

7.1.5 Accountability Principle

In carrying out personal data processing, DCV Asesorías y Servicios S.A. assumes legal responsibility for complying with the principles, obligations, and duties established by law.

7.1.6 Security Principle

Technical and organizational security measures shall be implemented to protect personal data against unauthorized or unlawful processing, as well as against alteration, loss, leakage, accidental damage, or destruction. Security measures must be appropriate to the processing activities and the nature of the data.

7.1.7 Transparency and Information Principle

All information necessary for data subjects to exercise their legal rights shall be made available. Personal data processing policies and practices shall be accessible and available to interested parties in a precise, clear, unambiguous, and free manner.

7.1.8 Confidentiality Principle

Any person with access to personal data must maintain secrecy and confidentiality regarding such data. DCV Asesorías y Servicios S.A., as Data Controller, shall establish appropriate controls and measures to preserve this principle. This obligation shall remain in force even after the relationship with the data subject has ended.

7.2 Data Retention Limitation

Personal data shall be retained only for as long as necessary to fulfill the purpose of processing, contractual obligations, legal requirements, instructions from competent authorities, or exceptions established by law.

7.3 Data Subject Rights

DCV Asesorías y Servicios S.A. shall adopt measures to ensure the proper exercise, where applicable, of data subjects’ rights of access, rectification, erasure, objection, portability, and blocking with respect to their personal data

7.4 Data Transfer and Disclosure

Personal data may be transferred to third parties providing services to DCV Asesorías y Servicios S.A., to the extent permitted by the lawful bases established by law or authorized by the data subject. Such third parties shall act as data processors, processing data on behalf of and in accordance with DCV’s instructions, and shall comply with confidentiality and security obligations as well as the principles governing personal data processing and protection established by applicable regulations, this policy, and any applicable contractual instruments.

DCV Asesorías y Servicios S.A.may also transfer or disclose personal data to legally authorized authorities or entities within the scope of their powers when required by applicable regulations or by an order issued by a competent authority.

7.5 Awareness and Training

DCV Asesorías y Servicios S.A. shall promote an organizational culture focused on personal data protection through training and awareness activities for its employees and through the dissemination of this policy.

Appropriate means shall be provided to ensure that employees involved in personal data processing are informed of their duties and obligations, as well as of the risks associated with information processing.

7.6 Review and Audit

This policy, as well as the technical and organizational measures adopted by DCV Asesorías y Servicios S.A. for the processing and protection of personal data, shall be reviewed periodically and whenever significant changes occur in applicable regulations, organizational structure, business processes, or technologies used in personal data processing.

Based on the results of internal or external reviews of the effectiveness of implemented controls, DCV Asesorías y Servicios S.A. shall define and execute continuous improvement plans to strengthen personal data protection.

7.7 Risk Analysis and Impact Assessment

DCV Asesorías y Servicios S.A. shall identify, assess, and manage risks associated with personal data processing, considering the nature, context, scope, purpose, and likelihood of events that may affect data subjects’ rights, as well as the confidentiality, integrity, and availability of information.
Where the nature of the processing may entail a high risk to data subjects’ rights, DCV Asesorías y Servicios S.A. shall conduct a Personal Data Protection Impact Assessment (DPIA), either before or during the design of the processing activity, in order to identify specific risks and establish appropriate mitigation measures.
These assessments shall be updated whenever significant changes occur in applicable regulations, organizational structure, business processes, or technologies used.

7.8 Record of Processing Activities (RAT)

DCV Asesorías y Servicios S.A. shall maintain an up-to-date Record of Processing Activities (ROPA) available for internal control, compliance purposes, and the handling of requests from data subjects or competent authorities, where applicable.
The various responsible departments involved in personal data processing shall provide the necessary information in a timely manner for the creation, maintenance, and updating of the ROPA, in accordance with the guidelines established by DCV Asesorías y Servicios S.A..

8. ROLES AND RESPONSIBILITIES

8.1 Data Protection Committee

This committee shall act within the framework of compliance with applicable personal data protection laws and regulations and shall perform the following functions:

• • Ensure compliance with the Personal Data Protection Policy and related regulations.
• • Propose amendments and ongoing updates to the Personal Data Protection Policy.
• • Establish criteria for risk analysis procedures and propose acceptable risk levels for personal data security.
• • Approve standards and procedures to ensure the security of personal data.
• • Promote resources and initiatives for awareness and training regarding personal data security.
• • Analyze reports concerning risk assessments, audits, projects, and initiatives or improvement actions related to security.
• • Review information regarding personal data security incidents.

8.2 Personal Data Controller

DCV Asesorías y Servicios S.A.
Tax ID (RUT): 77.198.108-9
Address: Avenida Apoquindo 4001, Floor 12, Las Condes, Chile
Correo: [email protected]

• • Respond to inquiries and requests from data subjects regarding the exercise of their rights.
  • Maintain communication with the Personal Data Protection Authority.
  • Inform and advise management and employees regarding obligations arising from the application of personal data protection laws.
  • Monitor compliance with Personal Data Protection Law and the assignment of responsibilities to employees involved in data processing activities.

8.3 Employees’ Obligations

All DCV Asesorías y Servicios S.A. employees who, in the course of their duties, access or process personal data must strictly comply with this policy, applicable regulations, and internal instructions issued by the organization concerning personal data protection.

• • Conduct themselves in accordance with the Personal Data Protection Policy.
• • Remain vigilant and report any situation that may involve non-compliance with this policy or applicable personal data protection regulations.
• • Maintain secrecy and confidentiality regarding any personal data accessed as part of their assigned duties and responsibilities.
• • Participate in awareness and training activities relating to the processing and protection of personal data.

8.4 Obligations of Suppliers and Other Third Parties

All suppliers and other third parties who, within the framework of their relationship with DCV Asesorías y Servicios S.A., access or process personal data provided by DCV Asesorías y Servicios S.A. are required to comply with this policy and with the contractual clauses agreed upon with DCV Asesorías y Servicios S.A.