Privacy policy
DRAFT FOR CLIENT AND CHILEAN LEGAL REVIEW. DO NOT PUBLISH. Prepared on 21 October 2026. All [CONFIRM] items must be resolved. This is not a compliance certification.
1. Controller and scope
This notice concerns the Bustos Tax & Legal website. Controller: [CONFIRM legal entity name, Chilean tax identification number (RUT) and registered address]. The office address displayed is San Sebastián 2807 Of. 815, Las Condes, Santiago de Chile; it is not assumed to be the registered address. Public inquiry email: info@bustostaxandlegal.com. [CONFIRM whether this mailbox will also handle personal data requests, or provide an approved channel].
The beta is a demonstration for approval only. It does not accept inquiries or send email. Do not enter real personal data during review.
2. Data and intended purposes
The planned form requires a name and email address; phone number, subject and message are optional. It includes an initially unchecked authorization box. The proposed purpose is to manage and answer the inquiry, not to subscribe users to advertising. Do not submit sensitive information, case files or confidential information about others. [CONFIRM necessity of each field, purposes and legal basis for each processing activity before activation].
Fluent Forms stores responses and technical metadata: IP address, browser, device and source URL. Hosting may generate technical logs [CONFIRM content, purpose, access and retention]. Automatic entry deletion is not configured.
3. Recipients, providers and transfers
Planned notifications go to info@bustostaxandlegal.com with a blind copy to gtorres@marketing-branding.com, as instructed by the developer. BCC does not anonymize data or eliminate processing. [CONFIRM controller authorization, purpose, Marketing Branding’s role and access, confidentiality and retention of that copy].
WordPress, Fluent Forms, Polylang and Secure Custom Fields are installed software, not evidence of an externally hosted service. [CONFIRM actual hosting, email/SMTP, support and backup providers, processing countries, contracts, recipients and legal basis/mechanisms for international transfers]. No unconfirmed provider is named here.
4. Retention and security
[CONFIRM retention criteria and periods for inquiries, emails, logs and backups, applicable legal obligations, responsible personnel and deletion procedure]. No period is inferred. Before operation, verify HTTPS, restricted access, backups and restoration, incident records and authorized deletion. Absolute security is not guaranteed.
5. Cookies and external services
Fonts are hosted locally. Local review identified no third-party analytics or advertising; this is not an audit of final hosting. WordPress may use technical authentication cookies for administrators. [CONFIRM actual cookies/local storage inventory, purposes and durations on the final domain].
Some pages request thumbnails from img.youtube.com before video playback, disclosing at least connection data to that provider. Activating a video loads the YouTube player. YouTube, LinkedIn, Google Maps and WhatsApp links lead to external services following user action and are subject to their own policies. [CONFIRM assessment of these services and transfers, and whether local thumbnails, prior blocking or preferences are required]. No consent manager has been installed: a banner without effective blocking does not resolve thumbnail requests.
6. Rights and requests
Under the current Chilean Law No. 19,628 regime, individuals may request information about their data, correction and, where applicable, deletion or blocking on statutory terms. Requests: [CONFIRM channel, responsible staff, proportionate identity verification and procedure]. No unvalidated response deadline is stated.
7. Current law and transition
On 21 October 2026, Law No. 19,628 applies under the pre-reform regime. Article 4 requires express written authorization where no statutory authorization or applicable exception exists; Chilean counsel must assess the basis and electronic evidence in this case. A checkbox alone does not establish compliance with all duties.
Law No. 21,719 is scheduled to enter into force on 1 December 2026. Before that date or any later publication, review the consolidated law and adapt transparency, legal bases, rights (including objection and portability where applicable), security, transfers and dealings with the Personal Data Protection Agency. These future arrangements are not presented as already operational. English/German versions alone do not determine GDPR applicability. [CONFIRM territorial scope if services are offered to or individuals are monitored in other jurisdictions].
8. Approval and updates
[CONFIRM effective date, version, legal approval and ES/EN/DE equivalence]. Sources: Law No. 19,628 as applicable at preparation and Law No. 21,719. Check amendments and applicable rules at the actual publication date.