Privacy policy

1. Who is responsible for your data

Legal name

CP Data Optimum Chile S.A.

RUT (Chilean tax ID)

96.949.130-3

Registered address

Av. Kennedy 7440, Suite 923, Vitacura, Santiago, Chile [CONFIRM]

Legal representative

[CONFIRM: name]

Email for exercising your rights

[PENDING: a single mailbox for rights requests] · or online at Exercise my rights

Data protection officer

[PENDING: decide whether to appoint one; if so, title and email]

2. When we act on behalf of the event organizer

CPData plays two different roles, and it helps to know which one applies to you:

• Controller: for the data of people who visit this site, write to us, are clients or prospects, or use a platform account.
• Processor: for the data of people invited to our clients’ events. In that case, the company organizing the event makes the decisions.

When you receive an invitation, RSVP or check in at an event we manage, the organizing company decides how your data is used. CPData processes it on that company’s behalf, under contract, only for that event and following its instructions. The organizer’s name appears on every invitation. You can exercise your rights with that company or with us: if your request comes to us, we handle it together with the organizer.

3. What data we process and where it comes from

4. What we use it for and on what legal basis

We do not make decisions about you based solely on automated processing.

The guided assistant

The platform has an assistant that explains, by text and voice, how to use it. To understand your question and speak to you it uses OpenAI, acting as our processor. We send it only what is needed to answer you: your question, your voice if you use the microphone, and the screen you are on. We do not send your name or email, or data about people invited to events. If you type a national ID (RUT), an email or a phone number in your question, we mask it before sending and storing it.

Each question is logged under your name for 180 days; after that it is anonymized and only figures remain. The platform administrator sees how many questions each person asks and which guides they request, to improve the platform and offer help. We do not use this log to evaluate your performance or share it with your company. Using the assistant is optional; if you do not want your voice to leave our servers, you can type. If our server voice is unavailable, dictation is handled by your browser with its own speech recognition service.

Creating templates with AI

People who design communications on the platform can create templates from a brand image or PDF. To read the design, we send a reduced copy of that file, without metadata, to OpenAI, acting as our processor, without the name or email of the person who uploads it. We ask that the file contain no data about other people; if it does, we do not copy it into the result. We keep the file until the result is published or discarded, and for 7 days at most. OpenAI does not use these files to train its models and may keep them for up to 30 days to prevent abuse. [VALIDATE: lawyer]

5. Who we share it with

We do not sell or transfer personal data. Only the service providers who work for us see it, only to the extent necessary and under contract:

• Infrastructure and hosting: Linode (Akamai Technologies).
• Artificial intelligence for the guided assistant, AI Queries and template creation: OpenAI (OpenAI OpCo, LLC, United States), under its data processing agreement. It does not use this data to train its models.
• Email delivery: [PENDING: provider]
• WhatsApp messages, when the organizer uses them: WhatsApp Business, by Meta (Meta Platforms, Inc.), as our sub-processor.

When we act on an organizer’s behalf, guest data goes back to the company organizing the event. We disclose data to an authority only when a law or a court requires it.

6. International transfers

Our servers are located in [PENDING: country]. If a provider stores or accesses the data outside Chile, that is an international transfer, and we carry it out with the safeguards the law requires [PENDING: country with an adequate level of protection or contractual clauses, per provider; VALIDATE: lawyer].

Guided assistant questions and voice are processed in the United States by OpenAI. This transfer relies on OpenAI's data processing agreement, which requires it to process the data only on our instructions, with confidentiality and security, to notify us of any breach and to delete the data when the service ends, and on our own measures: only what is needed to answer leaves our servers, without your name or email, and we mask national IDs, emails and phone numbers before sending the question. OpenAI may keep this data for up to 30 days to prevent abuse. [VALIDATE: lawyer]

If the organizer uses WhatsApp to contact you, messages are sent from CPData's number through WhatsApp Business, a Meta service that processes them on our behalf on servers outside Chile, including the United States. We only send what is needed: your number, your first name, the event's name and date and your reply link. This transfer relies on Meta's data processing terms. WhatsApp also processes your account data under its own policy. We keep your replies as a record of your confirmation, and any text messages you send us for 30 days. You can stop receiving messages by replying STOP. [VALIDATE: lawyer]

7. How long we keep it

8. Your rights and how to exercise them

Regarding your personal data, you can request:

• Access
• Rectification
• Erasure
• Objection
• Portability
• Temporary blocking
• Not to be subject to decisions based solely on automated processing

We’ll ask you to verify your identity and will respond within 30 calendar days from the day we receive your request. We may extend that period once, by another 30 days, if the case warrants it, and we’ll let you know before the deadline. If you request rectification, erasure or objection, you can also ask for temporary blocking of your data: we stop using it as soon as we receive the request (we only keep it stored) and respond within 2 business days. If you were invited to an event, you can also contact the company organizing it.

If you’re not satisfied with our response, you can file a complaint with Chile’s Personal Data Protection Agency (Agencia de Protección de Datos Personales).

9. Security

We encrypt communications, grant access by user profile, require two-step verification for administrators and account executives, record actions in an audit log and back up daily. If a security breach affects you, we’ll notify you and report it to the authority in the cases the law requires. To sign you out when you’re not using the platform, we record only the time of your last interaction with it; we don’t record what you did or use it for any other purpose.

10. Cookies

This site only uses what is strictly necessary for it to work; it does not use analytics or advertising cookies. The public pages don’t store anything in your browser.

Only if you log in to the platform are technical items stored to keep your session open:

Since nothing is optional, we don’t show you a cookie banner. If we ever add an analytics tool, we’ll first update this policy and ask for your permission, with Reject and Accept options given equal weight.

11. Minors

This site is aimed at businesses. We do not knowingly collect data from children under 14 through it. If an organizer includes minors in an event, their data is processed according to the organizer’s instructions and the requirements of the law [VALIDATE: lawyer].

12. Changes to this policy

If we change it, we’ll publish the new version with its date and keep the previous ones. If the change affects something you consented to, we’ll ask for your consent again.