Version of September 22, 2026. Applicable from its publication. The legal transition is detailed below.
This Policy explains how Carbon Real SpA processes the personal data of Users, of owners and their representatives, and of the contacts and workers linked to the use of the Platform, including property and project data when they allow a natural person to be identified, directly or indirectly. It also sets out the purposes of the processing, its lawful bases, the recipients of the data, the retention periods and the means available to exercise the rights that the law grants to data subjects.
This Policy is governed by Law N°19.628 on the Protection of Private Life, so that until November 30, 2026 the text of that law currently in force will apply, and from December 1, 2026 the amendments introduced by Law N°21.719 will be enforceable, including its new procedures, lawful bases and protection mechanisms. Although Carbon Real is already adopting the principles and safeguards of the reform, this early application will not alter the lawful bases or the rights, procedures and protection deadlines in force during the transition, so requests submitted before December 1, 2026 will be processed under the regulations in force on the date of their submission. In any case, the DRC or the corresponding Conservation instrument will be applied in a manner compatible with these mandatory rules.
For the purposes of this Policy, the following concepts will be used:
a) Personal data: any information linked or referring to an identified or identifiable natural person, including technical, economic or territorial information when it can reasonably be associated with that person.
b) Processing: any operation, manual or automated, performed on personal data, such as its collection, recording, organization, consultation, communication, storage or deletion.
c) Communication, assignment and international transfer: communication consists of disclosing data to third parties, assignment of handing them over to another controller, and international transfer of sending them to or making them available to a recipient located in another country or to an international organization, in accordance with the applicable regime.
d) Controller and processor: the controller is the party that decides the purposes and means of the processing, while the processor is the party that processes the data on behalf of the controller and in accordance with its instructions.
e) Anonymization and pseudonymization: anonymization irreversibly eliminates the reasonable possibility of identifying a person, while pseudonymization maintains that possibility through the use of additional information, which is why pseudonymized data retain their status as personal data.
a) To establish the rules for processing personal data related to the Platform, in accordance with the principles of lawfulness, purpose limitation, proportionality, quality, accountability, security, transparency and confidentiality.
b) To provide information and channels for exercising rights. Workers' data will also be processed in accordance with the notices and obligations specific to the employment relationship; this Policy only governs their relationship with the Platform. Each additional processing activity must be disclosed and have its own lawful basis.
Until November 30, 2026, the processing of personal data will require legal authorization or the express and informed consent of the data subject, given in writing or through an electronic medium that meets the legal requirements, while from December 1, 2026 the following may apply, depending on each purpose: consent, the need to enter into or perform a contract with the data subject, compliance with legal obligations, the defense of rights and the other bases provided for by law. In particular, legitimate interest may only be invoked from that date and provided that Carbon Real has previously justified the need for the processing and assessed its compatibility with the rights and freedoms of the data subject.
Carbon Real will document the lawful basis applicable to each purpose and to each category of data subject, bearing in mind that the existence of a DRC or the corresponding Conservation instrument does not authorize any use of data or replace consent where the law requires it. Likewise, the contract entered into with an owner or with a legal entity does not make its workers, representatives, neighbors or other third parties parties to that contract, so the processing of their data must be based on the lawful basis applicable to each of them.
When it is necessary to request the data subject's consent, Carbon Real will identify the data, the purpose, the recipients and the consequences of granting or refusing it, keeping evidence of a free, specific, informed and unambiguous expression of will, and each optional purpose will have a separate box that is unticked by default. Refusing processing for marketing, additional disclosure of personal data or optional analytics will not affect access to the features of the Platform or the rights arising from the DRC.
The data subject may withdraw their consent at any time, free of charge, without giving reasons and by means as simple as those used to grant it, including the email address protecciondatos@carbonreal.com, whereupon the processing that depends on that consent will cease, without affecting the lawfulness of the processing carried out previously. Withdrawal will not extend to data that Carbon Real must process under another lawful basis, such as the performance of the DRC, compliance with legal obligations or the defense of rights, which will be retained only to the extent necessary for those purposes and only for as long as they justify, informing the data subject of the basis and scope of such retention. In no case will reading this Policy or accepting the Terms and Conditions constitute a general authorization for processing.
The data controller is Carbon Real SpA, RUT 77.598.057-5, domiciled at Av. Apoquindo N° 7935, 9th floor, Tower A, Las Condes, Santiago, Chile; legal representative: Felipe Andrés Escalona Espinoza. Providers that process data on its behalf will act as processors under a contract and documented instructions, with obligations of confidentiality, security, assistance in the exercise of rights and return or deletion at the end of the service. Any sub-processing will require the specific written authorization required by law.
Providers that process data on behalf of Carbon Real will act as data processors, under a contract and in accordance with documented instructions, being subject to obligations of confidentiality and security, of assistance in handling data subjects' requests and of return or deletion of the data at the end of the service, and Carbon Real's specific written authorization will also be required for any sub-processing, in accordance with the law.
Data subjects may send their questions and requests regarding the protection of personal data to the email address protecciondatos@carbonreal.com, the operational channel enabled for this purpose.
Account and representation data: name, email, telephone, organization and role, as well as identity documents or powers of attorney, the latter only when necessary to verify the User's identity or authority or to comply with a legal obligation. Mandatory fields will be limited to the data strictly necessary for the requested function.
Bank details: name and RUT of the account holder, bank, account type and account number into which the payments due under the DRC or equivalent legal instrument will be deposited, which will be recorded or modified only by the account holder or by their duly authorized representative, after enhanced verification of their identity, and will be processed exclusively for the management of those payments, with restricted access and security measures appropriate to their nature.
Communications and support: questions, requests to exercise rights and the information necessary to handle them.
Ownership and representation records: those provided by the data subject, their authorized representatives or lawful sources, such as public registries, to evidence ownership of the property or the authority of whoever acts on their behalf.
Property and project data: identification and location of the property, cartography, orthophotos, LiDAR data, station measurements and technical or contractual documents prepared by Carbon Real or by third parties on its behalf, to the extent that they are necessary for the project and allow a natural person to be identified. Economic and payment data will be limited to those that must be displayed or managed under the DRC or equivalent legal instrument and the permissions granted to the User.
Carbon Real will inform the data subject of the source of data that have not been obtained directly from them, and the fact that they come from a publicly accessible source does not exempt it from personal data protection obligations.
Technical access and security data: IP address, device type, operating system and session or event logs, limited to what is necessary to authenticate the User, prevent improper access and diagnose failures.
Usage data: features used and operational events necessary to maintain the service, while optional analytics and tracking for advertising purposes will be subject to prior information and separate consent where applicable.
Cookies and equivalent technologies: strictly necessary cookies will be limited to enabling access to and the secure operation of the Platform, and optional cookies will remain disabled until the corresponding authorization is obtained, offering accessible options to accept them, reject them and withdraw the preferences given. Carbon Real will disclose the cookies and equivalent tools actually used, together with their purpose, provider and duration.
Geolocation: the Platform does not access the location of the User's device, without prejudice to processing the property coordinates that are necessary for the project. If a feature requiring it were incorporated in the future, Carbon Real will first disclose the type of data, its purpose, duration, any communications to third parties and the data subject's rights, requesting the corresponding authorization.
Each purpose will use only the data that are adequate and necessary for its fulfillment, on the lawful basis applicable on the date of the processing, so that the bases of contractual performance and legitimate interest described below will only be invoked from December 1, 2026 and in accordance with their legal requirements, with section 2 governing the previous period. In any case, consent will be requested separately where applicable.
The purposes of the processing are the following:
a) Provision of the service and performance of the project: creating and managing accounts, verifying the identity and representation of Users, enabling access, showing project records and progress and performing the obligations of the DRC or equivalent legal instrument. From the entry into force of the reform, the applicable basis will be the need to perform the contract with respect to the data subject who is a party to it, or the specific basis applicable to representatives, contacts and workers.
b) Service communications and support: handling questions and sending the necessary contractual, operational or security notices, on the basis of the performance of the contract or compliance with a legal obligation, as appropriate. Optional surveys and promotional messages will be distinguished from these communications and will require separate authorization.
c) Management of economic obligations and payments: managing the charges or payments that actually exist under the DRC or other applicable contracts, including the recording and validation of the bank account into which payments will be deposited, and supporting their fulfillment, on the basis of the performance of the contract, compliance with a legal obligation or the exercise and defense of rights, as applicable. The destination account for payments may only be recorded or modified by the account holder or by their duly authorized representative, after enhanced verification of their identity, and deductions for operating expenses or other deductions will be applied exclusively under the terms agreed in the DRC, with their details reported in the respective settlement. This purpose will respect the legal limits on economic information and collection, and may not give rise to additional charges or deductions.
d) Security and regulatory compliance: detecting incidents, preventing improper access or fraud and responding to legally valid requests, on the basis of compliance with a legal obligation, where one exists, or of legitimate interest duly assessed from the entry into force of the reform.
e) Technical publication and optional uses: publishing orthophotos, LiDAR data, measurements, the location of properties and scientific results, within the powers granted by the DRC and in compliance with the law, and Carbon Real may use, in accordance with its rights, its own environmental data that do not identify individuals. When the publication includes personal data, it will require a specific lawful basis, and ownership of the measurements does not replace that requirement, while marketing aimed at individuals, voluntary surveys and other optional processing will require separate and revocable consent.
Individual decisions based solely on automated processing, including profiling, that produce legal effects or significantly affect the data subject must meet the legal conditions and disclose their existence, logic and consequences, guaranteeing the data subject the right to obtain an explanation, request human intervention, express their point of view and request their review.
A. Processors: Carbon Real may communicate data to hosting, support and technology security providers, and to other providers strictly necessary for the disclosed purposes, who will act subject to limited access and to Carbon Real's instructions, under a contract that will govern, at least, its purpose and duration, the purposes and categories of data processed, the applicable instructions, the security measures, incident management and notification, the conditions for sub-processing and the return or deletion of the data at the end of the service. Contracting services abroad will also be subject to section 11.
B. Other recipients: data may be communicated to the competent authorities when there is a legal obligation or a valid request, as well as to measurement, validation, verification, certification, audit or registry entities when their involvement is provided for in the project and there is a lawful basis for it. In each case, only the data necessary for the respective submission will be delivered, distinguishing whether the recipient acts as a processor or as an independent controller and informing the data subject of that status.
C. Public: visitors to the Platform may access the orthophotos, LiDAR data, measurements and location of the properties that Carbon Real legitimately publishes, bearing in mind that information openly available on the Internet can be consulted from different countries. Unless specifically authorized, private documents, contact details, signatures, personal identifiers and other information unrelated to the purpose of the disclosure will be excluded from publication, and any publication that allows a person to be identified will require its own lawful basis and information about its scope. Public access and the international hosting of data will be analyzed separately in accordance with this Policy.
Carbon Real will retain the legal responsibilities incumbent upon it for the selection of its processors, the lawfulness of data communications, the instructions given and the adoption of the required protection measures.
The data subject may exercise their rights free of charge before Carbon Real, with the rights and procedures established in the text of Law N°19.628 then in force governing until November 30, 2026, and the amended regime applying from December 1, 2026, with the legal scope and requirements indicated below. In no case will Carbon Real require waivers or make the DRC payments conditional on the exercise of these rights.
a) Access: obtain confirmation of whether their data are being processed, a copy of them and information about their source, the purposes and lawful bases of the processing, its recipients, the retention period and, where applicable, the automated decisions affecting them.
b) Rectification: correct or complete inaccurate, outdated or incomplete data, with Carbon Real communicating those corrections to the recipients where required by law.
c) Erasure or cancellation: request the deletion of their data when a legal ground applies. If certain data must be retained to comply with a legal obligation, perform the contract or defend rights, Carbon Real will disclose the basis that justifies it, limiting its use to the remaining purpose and applying the relevant restrictions.
d) Objection: request the cessation of processing in the cases provided for by law, including direct marketing and, from the entry into force of the reform, processing based on legitimate interest, with the corresponding legal scope.
e) Portability: from December 1, 2026, receive in a structured and commonly used electronic format the data that the data subject has provided to Carbon Real, provided that the processing is carried out by automated means and is based on their consent, and request their direct transmission to another controller where technically feasible. This right does not extend to data generated by Carbon Real or to data processed on the basis of another lawful basis.
f) Blocking: from the entry into force of the reform, request the temporary suspension of processing while a request for rectification, erasure or objection is resolved, and in the other cases provided for by law, with processing during that period limited to the storage of the data and to legally permitted operations.
g) Automated decisions: exercise the rights of information, explanation, human intervention, review and objection applicable under article 8 bis of the amended law.
To exercise these rights, the data subject must write to protecciondatos@carbonreal.com, stating their identity, the means by which they wish to receive the response, the right they are exercising and the data or processing involved, with only the information necessary to verify their identity or representation being requested. Carbon Real will acknowledge receipt of the request, keep a record of it and respond with reasons.
Until November 30, 2026, if Carbon Real does not respond to the request within two business days or denies it, the data subject may bring the judicial action provided for in article 16 of Law N°19.628 currently in force, in accordance with its requirements, with this deadline and the current protection remaining in force throughout the transition period.
From December 1, 2026, Carbon Real will respond within 30 calendar days from receipt of the request, a period that may be extended only once by up to another 30 calendar days, informing the data subject, except in the case of a reasoned request for temporary blocking, which will be resolved within two business days, with the processing it covers being suspended in the meantime. The total or partial denial of a request will be reasoned and will inform the data subject of their right to file a complaint with the Personal Data Protection Agency within 30 business days, a complaint that may also be filed in the absence of a response within the legal deadline, in accordance with the procedure established in article 11 of the amended law.
Account data will be retained while the account is in use and for the additional time necessary to address justified liabilities, while the records of the DRC or the corresponding legal instrument, of the project and of the transactions will be retained in accordance with their purpose, legal duties and the applicable periods for the exercise or defense of rights, and the mere duration of the DRC or the corresponding legal instrument does not justify the indiscriminate retention of all the data. Security logs will be kept for periods proportionate to the risk they are intended to cover, and consents will be kept to evidence their granting or withdrawal.
During the retention period, access to the data will be restricted to the persons and purposes that justify it, and the data may be blocked when only an obligation to retain them remains. Once the purpose and any other basis justifying their retention have ceased, the data will be securely deleted or anonymized, which will include the instructions given to processors for their return or destruction and the deletion of backups in accordance with a controlled cycle.
Carbon Real will adopt technical and organizational measures proportionate to the nature of the data, the purposes and the risks of the processing, applying the principles of data protection by design and by default. These measures will include the management of access and permissions, confidentiality duties, the safeguarding of credentials, the protection of transmissions and storage according to risk, backups, vulnerability management and an incident response procedure, with their effectiveness verified periodically and remaining enforceable with respect to processors and throughout the data retention period.
Security incidents will be recorded, assessed and managed without undue delay, and from the entry into force of the reform, Carbon Real will report to the Personal Data Protection Agency any breaches that create a reasonable risk to the rights and freedoms of data subjects, also notifying those affected in the cases required by article 14 sexies of the amended law, in clear language and through expeditious means, without prejudice to any other applicable legal obligations.
Carbon Real will disclose the international data transfers it actually carries out, indicating their purposes, recipients, destination countries and the applicable protection mechanism. From December 1, 2026, regular transfers, including data hosting or remote access to data from another country, must be covered by one of the conditions provided for in articles 27 and 28 of the amended Law N°19.628, that is, a recognized adequate level of protection, appropriate safeguards or another legally authorized mechanism, while the exceptions provided for specific and non-regular transfers, including the data subject's consent, will only apply where appropriate and will not replace the legal basis required for regular hosting abroad. Consequently, accepting the Terms and Conditions or using the Platform will not constitute general consent to transfer data to any country.
This Policy will remain permanently accessible, indicating its date and version, and any relevant changes will be communicated before they apply through the Platform and, where appropriate, through the registered email address. Any new purpose or extension of the processing that requires consent will be subject to a specific decision by the data subject, and no update will affect acquired rights, the contractual precedence of the DRC or the equivalent legal instrument within the legal framework, or non-waivable rights regarding personal data protection.
Controller: Carbon Real SpA, RUT 77.598.057-5. Legal representative: Felipe Andrés Escalona Espinoza. Address: Av. Apoquindo N° 7935, Tower A, 9th floor, Las Condes, Santiago, Chile. Email for data protection and exercise of rights: protecciondatos@carbonreal.com. General contact: webmaster@carbonreal.com. These channels will remain available if the account is suspended or closed.
