Privacy Policy

October 2026

1. About this Privacy Policy

Your privacy is important to us. This Privacy Policy describes how GRUPO YYA SpA ('Bakslash', 'we' or 'us'), RUT 77.201.229-2, located at Cerro el Plomo 5931, office 1213, Las Condes, Santiago, Chile, collects, uses, stores and protects your personal data. Chilean Law N° 19.628 currently applies. This policy already meets the requirements of Law N° 21.719, which amends it and takes effect on December 1, 2026.

2. Data Controller

The data controller for your personal data is GRUPO YYA SpA, RUT 77.201.229-2. For privacy inquiries or to exercise your rights, contact us at: arco@bakslash.com or hola@bakslash.com. Address: Cerro el Plomo 5931, office 1213, Las Condes, Santiago, Chile.

3. Personal Data We Collect

We collect the following personal data depending on your channel of contact: (a) Contact form: first name, last name, email, phone, company (optional), project description. (b) Quotation form: email, name, company. (c) Analytics and cookies (with prior consent): anonymized IP address, pages visited, time on site, interaction events. The analytics provider (Google Analytics 4) infers the visitor's approximate geolocation (country and region) from the IP address for statistical purposes; this data is not used to identify you individually (Art. 16 sexies, Law 21.719). (d) WhatsApp Business: phone number and exchanged messages. (e) Contracted clients: RUT (if applicable), billing address, project information. (f) Meeting scheduling (Calendly): name, email and the answers you give when booking a time. (g) Origin of your request: the page where you entered the site and, if you came from a campaign, its name (UTM parameters). If you also accepted marketing cookies, we store the ad click identifier from Google, Meta or TikTok with your request. We do not collect sensitive data (racial origin, health, sexual orientation, beliefs, biometric data) in the ordinary course of our business.

4. Purposes and Legal Basis for Processing

We process your data for the following purposes and legal bases: (1) Responding to inquiries and quotations, and arranging the meetings you book — Legal basis: consent given in the form or when booking the time. (2) Active client management and billing — Legal basis: performance of contract. (3) Sending related commercial communications — Legal basis: legitimate interest (communications related to contracted or consulted services). (4) Website usage analysis — Legal basis: consent via cookie banner (only if 'Analytics' category is accepted). (5) Tax obligations compliance — Legal basis: legal obligation. (6) Knowing which campaigns and ads generate inquiries — Legal basis: legitimate interest for the landing page and campaign; consent via the cookie banner ('Marketing' category) for the ad click identifier. Data collected will NOT be used for purposes other than those declared without a new legal basis.

5. Data Retention Periods

We retain your data for the following periods: Leads and unconverted prospects: 2 years from last contact. Contracted clients: 5 years from the end of the business relationship. Analytics data: 14 months (GA4 standard). Email logs: 2 years. Leads who exercised the right of opposition: identifiable data deleted within 30 days. After these periods, data is permanently deleted or anonymized.

6. Cookies and Tracking Technologies

We use three categories of cookies: (1) Essential: necessary for site functionality (session, language preferences). Always active. (2) Analytics (require consent): Google Analytics 4 and Microsoft Clarity, which measure how the site is used. Clarity records clicks, scrolling and movement in anonymous session recordings and masks the text you type in forms. These tools process the IP address to infer approximate geolocation (country/region) for statistical purposes; we do not use this data to identify you (Art. 16 sexies, Law 21.719). (3) Marketing (require consent): Google Ads, the Meta Pixel and the TikTok Pixel, which measure visits and contacts that come from ads and let us build ad audiences. We also use Ahrefs Web Analytics, which stores no cookies, does not identify you and only produces aggregate visit figures; that is why it runs even if you reject analytics cookies. You can change your preferences at any time from the cookie banner. Each cookie is listed in our Cookie Policy.

7. Your Rights as a Data Subject

You have the following rights over your personal data under Law 21.719: (1) Access: know what data we hold about you. (2) Rectification: correct inaccurate, outdated or incomplete data. (3) Erasure: delete your data when no longer necessary or when you withdraw consent. (4) Opposition: object to certain processing, such as commercial communications, and to decisions based solely on automated processing, including profiling (Art. 8 bis). (5) Portability: receive your data in a structured format (JSON/CSV). (6) Temporary blocking: suspend processing while we resolve your rectification, erasure or opposition request. To exercise any of these rights, complete our form at /derechos-datos or email us at arco@bakslash.com. Response time: 30 calendar days from receipt (extendable by an additional 30 days). Temporary blocking requests are responded to within 2 business days. These are the deadlines set by Art. 11 of Law 21.719, and we already apply them before the law takes effect. From that date, if you don't receive a response, you will be able to file a complaint with the Data Protection Agency. Exercising your rights is free of charge.

8. Processors and Service Providers

We share data with the following providers, acting as processors on our behalf: Supabase Inc. (USA) — CRM and contacts database. Resend Inc. (USA) — transactional email and notifications. Vercel Inc. (USA) — website hosting. Sanity Inc. (USA) — site content and email template management. Cloudflare Inc. (USA) — Turnstile, spam protection on forms. Calendly LLC (USA) — meeting scheduler embedded in the site; it receives your data only when you book a time. OpenRouter Inc. (USA) — processes WhatsApp messages with artificial intelligence to draft automatic replies. Meta Platforms Inc. (USA) — WhatsApp Business API for communications and Meta Pixel (marketing consent only). Google LLC (USA) — Google Analytics 4 and Google Ads (consent required). Microsoft Corporation (USA) — Microsoft Clarity (analytics consent only). TikTok Pte. Ltd. (Singapore) — TikTok Pixel (marketing consent only). Ahrefs Pte. Ltd. (Singapore) — cookieless aggregate visit statistics. These providers only access the data needed to provide the service and are contractually bound to keep it confidential.

9. International Data Transfers

Our providers have servers in the United States and, for TikTok and Ahrefs, also in Singapore. These international transfers are carried out with adequate safeguards, through contractual clauses with each provider (Art. 27 letter b of Law 21.719): Supabase: Data Processing Agreement, with contractual clauses also covering its provider AWS. Google: data processing terms accepted in Google Admin, with contractual clauses. Resend: Data Processing Agreement available upon request. Meta (WhatsApp and Pixel): WhatsApp Business API terms and Meta Business Tools terms, with contractual clauses. Microsoft (Clarity), TikTok, Vercel, Sanity, Cloudflare, Calendly, OpenRouter and Ahrefs: each provider's data processing terms. You have the right to obtain information about the safeguards applied to these transfers by writing to arco@bakslash.com.

10. Information Security

We implement technical and organizational measures to protect your data: encryption in transit (HTTPS/TLS) and at rest (AES-256 in Supabase), access control with Row Level Security (RLS) policies, authentication for the admin panel, audit log of accesses to personal data, and a protocol to report security breaches through the fastest available means and without undue delay, as required by Art. 14 sexies of Law 21.719.

11. Minors

Our services are not directed to individuals under 14 years of age. We do not knowingly collect data from minors. If you believe a minor has provided their data without authorization, contact us at arco@bakslash.com to delete it immediately.

12. Changes to this Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. Previous versions are archived and available upon request. The current version will always be published on this page with the date of last update. If the changes are significant, we will notify affected data subjects by email.

13. Contact and Exercise of Rights

For any questions about this Policy, to exercise your rights, or to report a security breach: Email: arco@bakslash.com | Form: /derechos-datos | Address: Cerro el Plomo 5931, office 1213, Las Condes, Santiago, Chile. Response time: 30 calendar days (extendable +30 days). Temporary blocking: 2 business days. Once Law 21.719 takes effect, if the response is unsatisfactory you will be able to file a complaint with the Chilean Data Protection Agency, which is still being constituted.