1. Data controller
The data controller for personal data collected through this website and the ARCO Legal Platform is:
- Legal name: ARCO Legal SpA (in incorporation)
- Address: Santiago, Chile
- Contact email: privacidad@arco.legal
For questions about the processing of your personal data you can contact us directly at the email indicated.
2. Data we process and its purposes
We process the following categories of personal data according to the purpose indicated:
| Category | Data | Purpose |
|---|---|---|
| Account data | Name, email address, role, company, company RUT | Onboarding, authentication and account management on the Platform |
| Usage data | IP address, access logs, pages visited, platform actions | Cybersecurity, fraud detection and service improvement |
| Communication data | Email, name, content of demo request | Responding to contact requests and scheduling demos |
| ARCO request data | Data of the data subject exercising their rights (managed by the customer) | Processed exclusively at the customer's instructions as data processor |
ARCO Legal does not process sensitive data according to Article 16 of Law 21719 (health data, ethnic origin, religious beliefs, biometric data, among others) in its relationship with customers and visitors.
3. Legal basis for processing
In accordance with Article 13 of Law 21719, the processing of your data is based on the following legal bases:
- Contract performance: account data and data needed to provide the service.
- Legitimate interest: security logs and usage analysis to improve the Platform, provided the data subject's interests do not prevail.
- Consent: marketing communications and non-essential cookies. You may withdraw your consent at any time.
- Legal obligation: audit records and document retention required by tax and regulatory rules.
4. Retention period
Personal data will be retained for the time strictly necessary to fulfill the purpose for which it was collected, and subsequently during the applicable statutory limitation periods:
- Account data: during the term of the contractual relationship and for a minimum of 5 additional years for tax and accounting purposes.
- Access and security logs: 12 months from generation.
- Contact communications: 2 years from the last interaction.
- ARCO request data (processor): as instructed by the customer data controller.
Once the periods expire, the data will be securely deleted or anonymized.
5. Recipients and sub-processors
ARCO Legal may share personal data with the following recipients, always under contractual agreements that guarantee the same level of protection required by the Law:
- Cloud infrastructure providers(processors): hosting, databases and transactional email.
- Analytics tools: anonymized usage metrics.
- Public authorities: when there is a legal obligation or court order.
6. International transfers
Some of our infrastructure providers may host data on servers located outside of Chile. In such cases, ARCO Legal ensures that such transfers are carried out in accordance with Article 26 of Law 21719, either because the destination country offers an adequate level of protection or by signing standard contractual clauses.
You can request information about destination countries and applicable safeguards by writing to privacidad@arco.legal.
7. Data security
We apply appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss or destruction, in accordance with Article 14 ter of Law 21719:
- In-transit encryption using TLS 1.2 or higher.
- At-rest encryption for sensitive data.
- Role-based access control and principle of least privilege.
- Periodic backups with integrity verification.
- Regular security audits and testing.
- Incident response plan.
In the event of a security breach affecting your data, we will notify the affected parties and the competent authority within the timeframes established by Law.
8. Minors
The ARCO Legal Platform is not intended for individuals under 14 years of age. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us data without parental consent, please contact us at privacidad@arco.legal so we can delete it.
9. Changes to this Policy
ARCO Legal may update this Policy periodically. We will notify significant changes by email or through a prominent notice on the site. The "last updated" date at the top of this page will always indicate the version in force.