Privacy Policy

1. Object and Scope

This Policy informs how Prored Zona Norte Ltda. (“ProredZN”) processes personal data collected through its website, digital forms, and online channels directed to clients, potential clients, suppliers, contractors, job applicants, whistleblowers, community members, and other visitors.

This Policy refers exclusively to processing carried out through the website and its digital channels. Labor, operational, occupational health, surveillance, accreditation, and internal management processing are further regulated by specific policies, contracts, and notices.

The Policy is issued considering Law No. 19.628, in force at the time of its approval, and is prepared for Law No. 21.719, whose entry into force is scheduled for December 1, 2026, without prejudice to legislative modifications approved before that date. ProredZN will apply current regulations at all times.

2. Data Controller and Contact

Data Controller: Prored Zona Norte Ltda., RUT 76.681.721-1, domiciled at Simón Bolívar 202, office 606, Iquique, Chile.
Data Protection Delegate: Cristóbal Palomer.
Contact channel and exercise of rights: cristobal.palomer@proredzn.com, indicating "Personal Data Protection" in the subject line.

3. Data Collected Through the Website

ProredZN only collects the necessary data for each channel. Depending on the interaction, it may process the following categories:

• Navigation and security: IP address, date and time of access, technical identifiers, browser type, device, activity logs, and data necessary to prevent incidents and protect the site.
• Commercial contact and inquiries: name, company, position, email, phone, message content, and necessary background information to respond to inquiries, quotes, or service requests.
• Job application: identification, contact data, resume, experience, education, availability, and other background information the applicant chooses to provide to participate in a selection process.
• Ethics and Whistleblowing Channel: identification (if the report is not anonymous), contact data, reported facts, documents, and other background provided to manage the case. The channel can accept anonymous reports.
• Cookies and similar technologies: preferences, online identifiers, session information, usage measurement, and other technical data, according to the technologies effectively enabled on the site.

Forms will indicate mandatory and optional fields. The data subject must not enter sensitive data, identity documents, medical information, passwords, bank details, or other unsolicited information in general contact forms.

4. Sources and Purposes

Data comes directly from the data subject, their representative, the company they belong to, technological providers operating the digital channels, or technical logs generated by site usage. When information comes from another source, ProredZN will apply the corresponding information obligations.

The purposes of the processing are:

• to receive and respond to inquiries, information requests, and quotes
• to manage communications related to services, contracts, or commercial relationships
• to receive and process job applications
• to receive, register, investigate, and close complaints or reports made through the corresponding channel
• to maintain the security, availability, and functioning of the site and prevent fraud, abuse, unauthorized access, and incidents
• to create usage statistics and improve digital channels, when an applicable legal basis exists
• to send commercial communications when a valid legal basis exists and the data subject has not requested suspension
• to comply with legal obligations, authority requirements, and exercise or defend rights

5. Legal Basis

ProredZN will apply the appropriate legal basis for each processing:

• Pre-contractual measures or contract: to respond to inquiries, prepare quotes, manage applications, and execute contractual relationships.
• Legal obligation: to address legal obligations, authority requirements, and regulated procedures, including those applicable to the whistleblowing channel.
• Legitimate interest: to protect the site, its systems, people, and information; prevent fraud and abuse; manage security and improve services, provided the rights and freedoms of the data subject do not prevail.
• Consent: when required for a specific, optional, and separate purpose, including non-essential cookies or communications requiring authorization. Consent may be withdrawn at any time.
• Exercise or defense of rights: to formulate, exercise, or defend rights before courts, authorities, administrative procedures, or investigations.

Data will not be used for purposes incompatible with those informed at the time of collection, unless a new valid legal basis exists and the corresponding information is provided.

6. Recipients and Providers

Data may be communicated, only when necessary for the informed purposes, to the following categories of recipients:

• authorized ProredZN personnel who need to access the information
• clients, potential clients, suppliers, contractors, or principals, when communication is necessary to respond to a request or execute a contractual relationship
• providers of hosting, email, forms, storage, technology support, security, analytics, recruitment, or whistleblowing channel management
• advisors, auditors, and third parties subject to confidentiality duties
• courts, public bodies, and authorities, when there is a legal obligation or authorization

ProredZN does not sell personal data. Providers processing data on behalf of ProredZN must act according to instructions, purposes, and security measures defined contractually. The updated list of providers used in digital channels will be managed by ProredZN and may be informed to the data subject when appropriate.

7. International Transfers and Access

Some technology providers may store data or access it remotely from outside Chile. The use of encryption does not mean, by itself, that there is no international storage, access, or transfer. ProredZN will identify the providers, countries, data categories, and applicable legal mechanisms in its processing registry. International transfers will only be carried out when a valid legal basis exists and the enforceable mechanism under current legislation is met.

8. Cookies and Similar Technologies

The site may use essential cookies for its operation, security, and session management. It may also use analytical, customization, or advertising cookies, only when enabled and the corresponding legal basis exists. When non-essential cookies are used, the site will inform their categories, purposes, providers, duration, and configuration options. The data subject may accept, reject, or modify their preferences when the mechanism is enabled. Withdrawing consent will not affect the lawfulness of processing carried out beforehand. The cookies and technologies effectively used must be detailed in a notice or configuration panel accessible from the website.

9. Retention

Data will be kept for the time necessary to fulfill the informed purpose, manage the corresponding relationship, comply with legal obligations, address audits or investigations, and exercise or defend rights. When the purpose disappears and there is no other basis justifying retention, data will be deleted, anonymized, or blocked as appropriate.

• Inquiries and quotes: for the time necessary to respond and manage the request, and subsequently, only when a relationship, legal obligation, or need to defend rights exists.
• Job applications: during the selection process and, for future opportunities, during the informed and authorized period when applicable.
• Reports/Complaints: during the receipt, investigation, and closure of the case, and for the period necessary for legal obligations, audits, or defense of rights, with restricted access.
• Technical logs and cookies: during the period defined for the corresponding security, operation, measurement, or preference purpose.

Specific timeframes per channel and category must be maintained in ProredZN's retention matrix and reflected in specific notices when appropriate.

10. Security and Incidents

ProredZN will apply technical and organizational measures proportionate to the risk, including, when appropriate, access control, authentication, encryption, backups, activity logs, provider management, confidentiality, training, and periodic reviews. If a loss, leak, unauthorized access, alteration, destruction, or improper communication of data occurs, ProredZN will evaluate the incident, adopt containment measures, and make communications to data subjects or authorities when required by current legislation.

11. Exercise of your ARSOP Rights

The data subject may exercise free of charge, according to current legislation and applicable conditions, the following ARSOP rights:

• A - Access: to know if ProredZN processes personal data concerning them, to know what they are, their origin, purpose, recipients, and retention period.
• R - Rectification: to request the correction of inaccurate, incomplete, or outdated data.
• S - Suppression (Deletion): to request the deletion of their data when a legal cause exists and there is no obligation or ground justifying its retention.
• O - Opposition: to object to specific processing, especially when based on legitimate interest or carried out exclusively for direct marketing purposes.
• P - Portability: to request a copy of the personal data they have provided, in the cases and conditions established by law.

They may also request the temporary blocking of processing while a rectification, suppression, or opposition request is resolved, and withdraw their consent when the processing is based on it. Withdrawal will not affect the lawfulness of processing carried out beforehand.

The request must be sent to cristobal.palomer@proredzn.com and indicate the identity of the applicant, a means to receive a response, the processing or data involved, and the specific petition. ProredZN may apply reasonable and proportionate measures to verify identity, without indiscriminately requiring a copy of an identity document.

ProredZN will acknowledge receipt and respond within the deadlines established by current regulations. When Law No. 21.719 is applicable, the general deadline will be thirty consecutive days, extendable once for up to thirty consecutive days, with notice to the data subject. Any total or partial denial will be substantiated and communicate the available complaint mechanisms. The exercise of the rights of rectification, suppression, and opposition will be free of charge. Access and portability will be managed without undue obstacles, and direct costs may only be charged in cases permitted by law.

12. Commercial Communications

ProredZN may send commercial information related to its services when a valid legal basis exists. Each promotional communication must identify the sender and include an expedited mechanism to request the suspension of new mailings. The suspension request will be respected for future communications, without prejudice to messages strictly necessary to execute contracts, manage requests, or comply with legal obligations.

13. Whistleblowing Channel

The Whistleblowing and Ethics Channel is available at https://www.proredzn.com/denuncias.html. The channel may accept anonymous or identified reports and will be governed by its specific procedure for receipt, admissibility, investigation, confidentiality, protection against retaliation, retention, and closure. Matters subject to the Karin Law will be processed through the specific applicable mechanism. This Policy does not replace the notices or special protocols for such matters.

14. Minors and External Links

The site is not directed at minors and does not seek to deliberately collect their data. If, exceptionally, it were necessary to process information from a minor, the guarantees required by current regulations will be applied. The site may contain links to third-party pages or services. These third parties may have their own privacy policies, and ProredZN does not control the processing they carry out outside its systems.

15. Updates

This Policy will be permanently available on the website and will be reviewed when operations, forms, providers, technologies, cookies, purposes, risks, or applicable regulations change. Each version must indicate its update date.

16. Contact

Data Controller: Prored Zona Norte Ltda., RUT 76.681.721-1, Simón Bolívar 202, office 606, Iquique, Chile.
Data Protection Delegate and data subject requests: cristobal.palomer@proredzn.com