What data of yours Kapa21 processes, and what you can do about it.

TROY BIT SPA, RUT 78.004.889-1, registered at Vergara 196, Concón, Valparaíso Region, Chile.

For anything concerning your personal data, including exercising your rights, write to misdatos@contacto.kapa21.cl. That is the address kept operational to receive and answer those requests.

Kapa21 has not yet appointed a data protection officer. Until it does, requests are handled through that same address.

If you only visit the site

An analytics identifier and browsing data —pages viewed, where the visit came from, device type— are processed for the purpose of measuring use of the site. The IP address is truncated before being stored.

The basis is your consent, requested on arrival and withdrawable at any time. If you do not give it, analytics do not load and the site works exactly the same.

If you create an account

• Identification — full name, RUT, phone and email. To identify you as the data subject, meet know-your-customer requirements and communicate with you.
• Acceptance of terms — which version you accepted, when, and from which IP address. So that the exact text you accepted can be evidenced.
• Transaction data — balances, movements and receipts. To provide the service and keep the accounting record.

The basis is performance of the contract you accept on registering and, where applicable, compliance with legal obligations, principally tax and anti-money-laundering.

About your financial situation

Chilean law treats socio-economic situation as sensitive data. Any processing that classifies clients by their balance will require your express and specific consent, which will be requested separately and not inside the general terms. Kapa21 does not carry out that classification today.

If that changes, this policy will be updated before it begins and will state the logic applied and the consequences envisaged for you.

In that case you will have the right to an explanation, to human intervention, to express your point of view, and to request a review of the decision.

• Supabase — database and authentication.
• Vercel — hosting and running the site.
• Google Analytics — usage measurement, only if you consent.

All three host the information outside Chile, so there is an international transfer of data.

On the level of protection, plainly: the Personal Data Protection Agency has not yet published the list of countries with an adequate level, nor its model clauses, because it is still being constituted. Kapa21 cannot claim today that these transfers carry the safeguards the law will require, and is working on putting them in place. We would rather say so than treat as done something that is not.

It is kept while the relationship exists and, afterwards, for the periods the law requires — principally tax and anti-money-laundering. Once those periods are met, it is deleted or anonymised.

Two records are immutable by design: the accounting record and the audit log. They cannot be altered or deleted, because their value lies precisely in nobody being able to rewrite them. If you request erasure, you will be told exactly what is deleted, what is anonymised, and what must be kept by legal obligation.

Kapa21 does not yet have a retention policy with periods by data type. It is pending and will be published on this same page.

• Access — to know whether Kapa21 processes data about you, what it is, where it came from, what it is used for, who receives it and for how long.
• Rectification — to correct data that is wrong, out of date or incomplete.
• Erasure — to ask for it to be deleted, in the cases the law provides for.
• Objection — to ask that a particular processing not be carried out.
• Portability — to receive a copy in a structured, commonly used electronic format, and to have it transmitted to another controller.
• Blocking — to temporarily suspend a processing while your rectification, erasure or objection request is resolved.

Access, rectification, erasure and objection are free of charge. If you gave consent for something, you can withdraw it at any time, without giving a reason and by the same means you gave it; withdrawing it does not affect the lawfulness of processing carried out beforehand.

How to exercise them, and within what deadline

Write to misdatos@contacto.kapa21.cl stating which right you are exercising and over what data. Kapa21 responds within 30 calendar days, extendable once by a further 30. A temporary blocking request is answered within 2 business days.

There is no screen yet for exercising these rights on your own. The law requires Kapa21 to implement one and it is being built. Meanwhile the channel is email, and the deadlines run all the same.

If Kapa21 rejects your request or fails to answer in time, you may complain to the Personal Data Protection Agency.

Each person and each company can only see their own data, and that separation is verified by automated tests that run on every change.

The accounting record cannot be modified from a client account. Whoever operates the platform is subject to second-factor authentication and separation of duties.

In the event of a security breach posing a reasonable risk to your rights, Kapa21 will notify the Agency without undue delay and will notify you, stating what data was affected and what was done about it.