PRIVACY POLICY

Last updated: 07.09.2026

1. Data Controller

KOLBYS
Owner / Legal Name: Kristina Kolb
RUT: 29.097.959-5
Address: Santiago, Chile
Email: clientes@kolbys.cl
Website: kolbys.cl

KOLBYS is responsible for the processing of personal data that it receives and processes directly for its own commercial, administrative and service-related purposes, in accordance with applicable Chilean law.

In certain projects, particularly where KOLBYS analyzes information or evidence provided by a client, KOLBYS may act on behalf of that client and in accordance with its instructions, depending on the nature of the processing and the conditions agreed for the project.

Where appropriate, responsibilities relating to the processing of personal data may additionally be established through a contract, confidentiality agreement, data processing agreement or other applicable instrument.

2. Principles Applicable to Data Processing

KOLBYS seeks to process personal data lawfully, fairly and transparently, limiting processing to specified purposes and to information reasonably necessary for those purposes.

In accordance with applicable law, KOLBYS takes particular account of the principles of purpose limitation, proportionality, data quality, accountability, security, transparency and confidentiality.

3. What Information May We Process?

Depending on how you communicate with us, the commercial relationship or the service contracted, we may receive or process information such as:

• First and last name.

• Company or organization.

• Position or role.

• Email address.

• Telephone number or WhatsApp contact details.

• Information relating to a company, establishment, operation, service or project.

• Information necessary to prepare a proposal or coordinate a project.

• Evaluations, audits, reports and forms.

• Customer feedback, comments, complaints, surveys and results relating to customer experience.

• Service-related communications, including emails, chats or interaction records where they legitimately form part of the project.

• Photographs, videos, screenshots or other visual documentation.

• Information relating to Customer Journeys, touchpoints, service standards, procedures or evaluation criteria.

• Any other information provided voluntarily or lawfully in connection with an enquiry, commercial relationship or contracted service.

KOLBYS seeks to limit processing to data that is adequate, relevant and necessary for the corresponding purpose.

4. How Do We Obtain Information?

Information may be obtained through:

• Direct communications by email.

• WhatsApp or other communication channels made available by KOLBYS.

• Meetings and commercial communications.

• Requests for proposals.

• Communications relating to projects or contracted services.

• Clients providing information, documentation or evidence for an evaluation.

• Collaborators or providers authorized by a client.

• Information lawfully generated during evaluations or interactions within the scope of a project.

• Publicly accessible sources where their use is lawful and relevant.

The KOLBYS website currently does not use its own contact form.

5. Purposes of Processing

Where applicable, information may be processed to:

• Respond to enquiries.

• Maintain contact with prospective and existing clients.

• Understand the needs, objectives and scope of potential projects.

• Prepare commercial proposals.

• Coordinate meetings, projects and services.

• Perform contracted services.

• Conduct evaluations and analyses within the agreed scope.

• Prepare reports, findings, conclusions and recommendations.

• Maintain project-related communications.

• Manage commercial, contractual, administrative and accounting matters.

• Maintain and improve our services, processes and methodologies.

• Protect our rights and legitimate interests where applicable.

• Comply with legal obligations or valid requests from competent authorities.

Personal data will not deliberately be used for purposes incompatible with those for which it was obtained unless there is a legal basis permitting such processing.

6. Legal Bases for Processing

Depending on the nature of the relationship and the applicable law, the processing of personal data may be based, among other legally recognized grounds, on:

• The data subject's consent where required.

• Taking pre-contractual steps requested by the data subject.

• Entering into or performing a contract.

• Compliance with legal obligations.

• The pursuit of legitimate interests of KOLBYS or third parties, where permitted by law and where such interests are not overridden by the rights and freedoms of the data subject.

• Other grounds expressly recognized by applicable law.

Where processing is based on consent and applicable law provides a right to withdraw it, the data subject may withdraw such consent without affecting the lawfulness of processing carried out before its withdrawal.

7. Confidentiality and Discretion

Confidentiality and discretion are fundamental principles of KOLBYS.

Information provided by prospective clients, clients, collaborators or third parties will be handled according to its nature, applicable law and the conditions relevant to each relationship or project.

Service and customer experience evaluations, Mystery Client, Customer Journey, Scenario Testing, Remote Service Evaluation and other projects may involve commercial, operational, strategic or internal information, as well as information relating to customers, employees or other third parties.

KOLBYS seeks to limit access to such information to persons who need to know it in order to carry out the project or fulfil a legitimate purpose related to it.

Applicable confidentiality obligations will continue to be respected after the relationship or project has ended where appropriate.

Where the nature or scope of a project requires it, additional confidentiality obligations may be established between the parties.

8. Evaluations and Remote Service Evaluation

Depending on the project, KOLBYS may conduct or analyze evaluations using methods and sources such as:

• Mystery Client.

• Observation.

• Interactions with touchpoints.

• Customer Journey.

• Scenario Testing.

• Service and customer experience evaluations.

• Review of existing audits or evaluations.

• Audit reports and evaluation forms.

• Mystery Shopping results.

• Customer feedback, surveys, comments and complaints.

• Email or chat communications.

• Call records or recordings where their processing is lawful and they form part of the agreed scope.

• Photographs, videos and screenshots.

• Documentation relating to standards, processes and services.

• Other evidence lawfully available for the project.

In Remote Service Evaluation projects, KOLBYS may receive information previously collected by the client, its collaborators or authorized providers.

KOLBYS will analyze such information solely within the agreed scope and in accordance with the instructions applicable to the project.

Results may be incorporated into analyses, reports, conclusions and recommendations prepared for the client.

Where appropriate, KOLBYS seeks to avoid the unnecessary inclusion or disclosure of personal data in the results and may apply data minimization, anonymization or pseudonymization measures where appropriate.

9. Third-Party Information and Client Responsibility

Projects may include information relating to employees, customers, suppliers or other third parties.

Where a client provides KOLBYS with personal data or evidence containing personal data, the client must, where applicable, have the necessary authorizations, legal grounds, authority or other conditions required to collect, use and share such information for the purposes of the project.

This is particularly relevant to call recordings, private communications, images, videos, employee information, identifiable feedback and other evidence that may contain personal data.

KOLBYS may request that certain information be anonymized, pseudonymized, minimized or excluded where it is not necessary for the evaluation.

The specific allocation of responsibilities between KOLBYS and the client may be established contractually according to the nature of the project and applicable law.

10. Sensitive Personal Data and Unnecessary Data

KOLBYS does not seek to deliberately collect sensitive personal data that is not necessary for the provision of its services.

Clients should not provide sensitive data, medical information, biometric data, information relating to minors or other specially protected categories unless there is a legitimate need related to the project and the applicable legal requirements are satisfied.

If KOLBYS receives information of this nature that is not necessary for the project, it may request its deletion, replacement, anonymization or minimization.

11. Service Providers and Disclosure of Information to Third Parties

KOLBYS does not sell or commercially trade personal data.

Information may be disclosed or made available to third parties where this is lawful and reasonably necessary to:

• Perform a contracted service.

• Use technology, hosting, communication, storage or administrative providers necessary for our operations.

• Coordinate authorized activities within a project.

• Comply with legal obligations.

• Respond to valid requests from competent authorities.

• Establish, exercise or defend legal rights where applicable.

Where third parties process personal data on behalf of KOLBYS, KOLBYS seeks to ensure that such processing is limited to the relevant purposes and is subject to appropriate confidentiality, security and data protection conditions.

12. International Projects and International Data Transfers

KOLBYS is established in Chile and may provide certain services to clients or analyze experiences relating to other markets.

An international project does not necessarily imply a permanent physical or operational presence of KOLBYS in the corresponding country.

Where a project involves an international transfer of personal data, KOLBYS seeks to ensure that the transfer is carried out in accordance with applicable law.

Where required, international transfers may rely on legally recognized mechanisms such as:

• Transfers to countries or organizations providing an adequate level of protection.

• Contractual clauses or other instruments providing appropriate safeguards.

• Certification mechanisms or other instruments recognized by applicable law.

• Explicit consent for a specific transfer where legally appropriate.

• The necessity of the transfer for entering into or performing certain contracts or other circumstances permitted by law.

Where KOLBYS acts on behalf of a client, the conditions relating to international transfers may be established in the relevant contract or data processing agreement.

Where required by applicable law, KOLBYS will provide information concerning the existence of international transfers and the applicable safeguards or legal grounds.

13. Information Security

KOLBYS adopts and seeks to maintain reasonable technical and organizational measures appropriate to the nature of the information and the risks associated with its processing.

Depending on the circumstances, these measures may include:

• Restricting access to information on a need-to-know basis.

• Confidentiality measures.

• Use of appropriate technology and service providers.

• Reasonable management of document storage and access.

• Data minimization where appropriate.

• Deletion, anonymization or restriction of information when it is no longer required.

• Measures intended to prevent unauthorized access, alteration, loss, disclosure or processing.

No electronic transmission or storage system can guarantee absolute security.

Where a security incident involving personal data occurs, KOLBYS will take appropriate reasonable measures and make any communications or notifications required under applicable law.

14. Data Retention

KOLBYS will retain personal data only for as long as reasonably necessary for the purposes for which it was processed and in accordance with applicable law.

Specific retention periods may vary depending on the nature of the information, the project and applicable obligations.

Information may be retained for as long as necessary to:

• Respond to enquiries or negotiations.

• Perform and document a contracted service.

• Maintain a commercial or professional relationship.

• Manage contractual, administrative, accounting or tax obligations.

• Comply with legal obligations.

• Establish, exercise or defend legal rights.

Where data is no longer required and there is no basis for its continued retention, KOLBYS will seek to delete or anonymize it according to the nature of the information and applicable law.

15. Rights of Data Subjects

Individuals whose personal data is processed by KOLBYS may exercise the rights recognized under applicable law.

Depending on the circumstances and subject to applicable legal requirements, these rights may include:

• Access: to know whether KOLBYS processes personal data concerning you and to access the relevant information.

• Rectification: to request correction of inaccurate, outdated or incomplete data.

• Deletion: to request deletion of data where legally applicable.

• Objection: to object to certain processing in the circumstances provided by law.

• Portability: to request data in a format enabling its transfer where the legal requirements are met.

• Blocking: to request the temporary blocking of certain processing where this right applies.

To exercise a right or make an enquiry relating to your personal data, please contact:

clientes@kolbys.cl

KOLBYS may request information reasonably necessary to verify the identity of the applicant and properly process the request.

Rights will be handled within the time limits and in accordance with the procedures established by applicable law.

Where the regime established by Chilean Law No. 21.719 applies, the data subject may apply to the competent Chilean data protection authority in the cases and under the conditions established by law.

16. Commercial Communications

KOLBYS may send commercial communications or communications relating to its services where there is a legitimate basis for doing so and in accordance with applicable law.

Individuals may request that KOLBYS stop sending commercial communications using the method indicated in the communication or by contacting:

clientes@kolbys.cl

A request to stop receiving commercial communications will not affect communications necessary to perform a contract, respond to an enquiry or manage an existing relationship.

17. Website, Framer Analytics and Cookies

The KOLBYS website is created and hosted using the Framer platform.

Framer may provide technical functions necessary to host and operate the website.

KOLBYS may use Framer's integrated analytics functionality. According to information published by Framer, its integrated analytics system uses a privacy-focused approach, does not use cookies or persistent identifiers to individually identify visitors, and presents aggregated information about website usage.

KOLBYS does not currently use, on its own initiative, personalized advertising tools or third-party marketing tracking scripts on this website unless expressly stated otherwise in this Policy.

If KOLBYS introduces third-party tools or content in the future that use cookies, pixels, persistent identifiers or other non-essential technologies — for example, external analytics, advertising, marketing or embedded content services — this Policy will be updated and, where appropriate, information and consent mechanisms will be implemented in accordance with applicable law.

The use of external links, including a link to LinkedIn, does not in itself mean that KOLBYS installs tracking technologies from that platform on the visitor's device. When accessing an external website, the practices and policies of the respective provider will apply.

18. Third-Party Websites and Services

The website may contain links to external websites or services, including LinkedIn and other third-party platforms.

When accessing such services, the privacy policies, cookie policies and terms of the respective provider may apply.

KOLBYS does not control the privacy practices, security or content of external websites or services and recommends reviewing their respective policies.

19. Changes to Our Services or Technology

If KOLBYS introduces new forms, booking systems, communication platforms, analytics tools, storage services, integrations, advertising pixels or other technologies that materially change the processing of personal data, this Policy may be updated to reflect those changes.

Where applicable law requires consent or another additional measure before carrying out new processing, KOLBYS will take the corresponding measures.

20. Updates to This Privacy Policy

KOLBYS may update this Privacy Policy where necessary due to legal, regulatory, technological, operational or service-related changes.

The current version will be available on this website and will indicate the date of its latest update.

Material changes will be communicated or made subject to consent where required by applicable law.

21. Contact

For questions concerning this Privacy Policy, the processing of personal data or the exercise of your rights:

KOLBYS
Owner / Legal Name: Kristina Kolb
Address: Santiago, Chile
Email: clientes@kolbys.cl
Website: kolbys.cl