Personal data processing
This site offers Ley 21.719 compliance services. It would be inconsistent not to explain, in the same detail we require of a client, what data we collect here, what for, for how long and how rights over it are exercised.
The data controller is PIMX ARCSEC SpA, Chilean tax ID 78.491.219-1, a company incorporated in Chile and domiciled in Santiago, trading under the PIMX ArcSec brand.
Any question about this policy or about the data processed should be sent to contacto@pimx.cl. No data protection officer has been formally appointed: given the size of the practice, the controller handles requests personally.
Only what the person voluntarily types into the contact form. This site does not build profiles, does not buy databases and does not obtain information from third parties.
| Dato | Required | Why it is asked |
|---|---|---|
| Name | Sí | To address the reply to a person and not to an inbox. |
| Sí | It is the channel used to reply. | |
| Materia | Sí | It allows a useful rather than generic reply. |
| Background | Sí | The context of the enquiry, written by the sender. |
| Organisation | No | It helps size the scope. It may be omitted. |
| Phone | No | Only if the person prefers to be called. |
Do not send sensitive data. The background field is free text: describing the situation is enough. Do not include credentials, health data, information about your own clients or technical evidence at this first stage. If an engagement requires handling that kind of information, a secure channel and a confidentiality agreement are arranged beforehand.
The server also records the IP address and the time of submission while processing the request. This is a technical detail unavoidable in any internet communication and is used only to prevent automated abuse of the form.
About the tools section. The tools page shows the footprint of your own connection: IP address, network operator and approximate city-level location. That data is computed on the spot, returned only to your screen and is not stored, not tied to any cookie and not linked to another visit. The rest of what you see there — operating system, browser, languages, screen — is computed by your own browser and never leaves your machine. The cookie checker does not store the domain you look up either.
To answer the enquiry and, where appropriate, prepare and send a service proposal. Nothing else.
They are not used to send advertising, newsletters or unsolicited communications. They are not transferred, sold or shared with third parties for commercial purposes. If they were ever to be used for anything beyond the above, fresh and specific consent would be requested for that purpose.
Anyone requesting the sample report receives it by email. The request is recorded — that is why the report is not published as an open download.
Processing rests on the free, informed and specific consent of the person, given by ticking the box on the form before sending it. Without that box ticked the form does not submit.
Consent may be withdrawn at any time by writing to contacto@pimx.cl, with no need to give a reason. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Where a contractual service relationship exists, processing of the data needed to perform it rests on that contract, and retention periods become those set by the applicable regulations.
Twelve months from the last contact, if the enquiry does not lead to a service relationship. Once that period is over, the message is deleted.
If the enquiry does lead to an engagement, the data is kept for the duration of the relationship and afterwards for the period required by Chilean tax and contract law, after which it is deleted or anonymised.
Deletion may be requested before those periods at any time, and is carried out unless a legal retention obligation prevents it — in which case that obligation is disclosed.
No third party receives this data for its own purposes. Two infrastructure providers are involved, acting on the controller's behalf and only to make delivery possible:
| Proveedor | Role | Location |
|---|---|---|
| Cloudflare | Site hosting and form processing | Distributed infrastructure, outside Chile |
| Mailbox where the message arrives | Outside Chile |
International transfer. By using those services, data is processed and stored on servers located outside Chile. Both providers offer contractual guarantees of protection equivalent to those required by Chilean and European rules. It is stated here because this is information the data subject is entitled to know before writing, not after.
This site sets no cookies. Neither first-party nor third-party. It also uses no browser local storage, tracking pixels, heatmaps or analytics tools. There is no cookie banner because there is nothing to consent to.
Fonts are served from this same domain instead of being loaded from an external service. That is deliberate: loading them from a third party would send every visitor's IP address to that third party without anyone authorising it, which would be hard to defend on a site that sells Ley 21.719 compliance.
If any cookie or measurement tool is added in future, the corresponding preference centre will be published before it is installed, and this section will be updated with the detail of each one.
The same ones recommended to clients, applied to this site:
No measure eliminates risk entirely. Should a breach occur that significantly affects people's rights, the Agency and the affected data subjects will be notified as the law requires.
Ley 21.719 grants every person rights over their personal data. They are exercised free of charge by writing to contacto@pimx.cl with the subject line "Solicitud ARSOP", stating which right is being exercised.
| Derecho | What it lets you request |
|---|---|
| Access | To know what data about you exists, where it came from and what it is used for. |
| Rectification | To correct data that is inaccurate, outdated or incomplete. |
| Erasure | To delete the data when it is no longer needed or consent is withdrawn. |
| Objection | To object to a particular processing on legitimate grounds. |
| Portability | To receive the data in a structured, commonly used format. |
The reply is delivered within the legal deadlines. Proof of identity will only be requested where strictly necessary to avoid handing data to the wrong person, and that verification is not used for any other purpose.
If the answer to a request is unsatisfactory, or if the processing is believed to breach the rules, a complaint may be filed with the Personal Data Protection Agency, the supervisory body created by Ley 21.719.
That right is independent: there is no need to complain to the controller first, although it is usually quicker to try.
Any change is published at this same address, with the version number and effective date visible at the top of the document. Previous versions are kept and may be requested by email.
If a change were to substantially affect the purpose of processing or widen the data collected, fresh consent will be requested before applying it. It will not be treated as accepted merely by continuing to browse.