October 2026
Your privacy is important to us. This Privacy Policy describes how GRUPO YYA SpA ('Bakslash', 'we' or 'us'), RUT 77.201.229-2, located at Cerro el Plomo 5931, office 1213, Las Condes, Santiago, Chile, collects, uses, stores and protects your personal data. Chilean Law N° 19.628 currently applies. This policy already meets the requirements of Law N° 21.719, which amends it and takes effect on December 1, 2026.
The data controller for your personal data is GRUPO YYA SpA, RUT 77.201.229-2. For privacy inquiries or to exercise your rights, contact us at: arco@bakslash.com or hola@bakslash.com. Address: Cerro el Plomo 5931, office 1213, Las Condes, Santiago, Chile.
We collect the following personal data depending on your channel of contact: (a) Contact form: first name, last name, email, phone, company (optional), project description. (b) Quotation form: email, name, company. (c) Analytics and cookies (with prior consent): anonymized IP address, pages visited, time on site, interaction events. The analytics provider (Google Analytics 4) infers the visitor's approximate geolocation (country and region) from the IP address for statistical purposes; this data is not used to identify you individually (Art. 16 sexies, Law 21.719). (d) WhatsApp Business: phone number and exchanged messages. (e) Contracted clients: RUT (if applicable), billing address, project information. We do not collect sensitive data (racial origin, health, sexual orientation, beliefs, biometric data) in the ordinary course of our business.
We process your data for the following purposes and legal bases: (1) Responding to inquiries and quotations — Legal basis: consent given in the form. (2) Active client management and billing — Legal basis: performance of contract. (3) Sending related commercial communications — Legal basis: legitimate interest (communications related to contracted or consulted services). (4) Website usage analysis — Legal basis: consent via cookie banner (only if 'Analytics' category is accepted). (5) Tax obligations compliance — Legal basis: legal obligation. Data collected will NOT be used for purposes other than those declared without a new legal basis.
We retain your data for the following periods: Leads and unconverted prospects: 2 years from last contact. Contracted clients: 5 years from the end of the business relationship. Analytics data: 14 months (GA4 standard). Email logs: 2 years. Leads who exercised the right of opposition: identifiable data deleted within 30 days. After these periods, data is permanently deleted or anonymized.
We use three categories of cookies: (1) Essential: necessary for site functionality (session, language preferences). Always active. (2) Analytics (require consent): Google Analytics 4, Umami — measure site behavior in anonymized form. These tools process the IP address to infer the visitor's approximate geolocation (country/region) for statistical purposes; data is not used to identify you individually (Art. 16 sexies, Law 21.719). (3) Marketing (require consent): Google Tag Manager cookies for advertising segmentation. You can manage your preferences at any time via the cookie banner. See our Cookie Policy for more details.
You have the following rights over your personal data under Law 21.719: (1) Access: know what data we hold about you. (2) Rectification: correct inaccurate, outdated or incomplete data. (3) Erasure: delete your data when no longer necessary or when you withdraw consent. (4) Opposition: object to certain processing, such as commercial communications, and to decisions based solely on automated processing, including profiling (Art. 8 bis). (5) Portability: receive your data in a structured format (JSON/CSV). (6) Temporary blocking: suspend processing while we resolve your rectification, erasure or opposition request. To exercise any of these rights, complete our form at /derechos-datos or email us at arco@bakslash.com. Response time: 30 calendar days from receipt (extendable by an additional 30 days). Temporary blocking requests are responded to within 2 business days. These are the deadlines set by Art. 11 of Law 21.719, and we already apply them before the law takes effect. From that date, if you don't receive a response, you will be able to file a complaint with the Data Protection Agency. Exercising your rights is free of charge.
We share data with the following providers acting as processors on our behalf: Supabase Inc. (USA) — CRM database and leads storage. Resend Inc. (USA) — transactional email delivery. Google LLC (USA) — Google Analytics 4 for web traffic analysis (consent required). Meta Platforms Inc. (USA) — WhatsApp Business API for communications. These providers only have access to data necessary to provide the service and are contractually obligated to maintain confidentiality.
Our main providers have servers in the United States. These international transfers are carried out with adequate safeguards, through contractual clauses with each provider (Art. 27 letter b of Law 21.719): Supabase: Data Processing Agreement, with contractual clauses also covering its provider AWS. Google: data processing terms accepted in Google Admin, with contractual clauses. Resend: Data Processing Agreement available upon request. Meta (WhatsApp): WhatsApp Business API terms, with contractual clauses. You have the right to obtain information about the safeguards applicable to these transfers by contacting arco@bakslash.com.
We implement technical and organizational measures to protect your data: encryption in transit (HTTPS/TLS) and at rest (AES-256 in Supabase), access control with Row Level Security (RLS) policies, authentication for the admin panel, audit log of accesses to personal data, and a protocol to report security breaches through the fastest available means and without undue delay, as required by Art. 14 sexies of Law 21.719.
Our services are not directed to individuals under 14 years of age. We do not knowingly collect data from minors. If you believe a minor has provided their data without authorization, contact us at arco@bakslash.com to delete it immediately.
We may update this Privacy Policy to reflect changes in our practices or applicable law. Previous versions are archived and available upon request. The current version will always be published on this page with the date of last update. If the changes are significant, we will notify affected data subjects by email.
For any questions about this Policy, to exercise your rights, or to report a security breach: Email: arco@bakslash.com | Form: /derechos-datos | Address: Cerro el Plomo 5931, office 1213, Las Condes, Santiago, Chile. Response time: 30 calendar days (extendable +30 days). Temporary blocking: 2 business days. Once Law 21.719 takes effect, if the response is unsatisfactory you will be able to file a complaint with the Chilean Data Protection Agency, which is still being constituted.