Legal

Wiseplan Consultora, S.A.

Version 1 · Effective October 5, 2026 · Previous versions

1. About Us

Wiseplan Consultora SpA, RUT 76.425.812-6, with its registered office at Los Militares 5953, Office 1208, Las Condes, Santiago, provides human capital services: payroll management, recruitment and selection, labor law advisory services, and human resources consulting. In these services, personal data is an integral part of the work itself, and some of this data is sensitive.

This policy sets forth Wiseplan’s commitments to the individuals whose data it processes. It is governed by Law No. 19,628 and its amendments, particularly those introduced by Law No. 21,719, and has been approved by the company’s management.

2. Who it applies to

This applies to all individuals who work at Wiseplan or provide services to Wiseplan, regardless of their employment status, as well as to third parties that process data on behalf of Wiseplan, as required by contract. It covers all personal data processed by Wiseplan, in any format or through any channel, in Chile and in data flows with its affiliated entity in Peru.

3. Principles

All data processing carried out by Wiseplan is governed by the principles established by law:

4. When We Make Decisions and When We Act on Behalf of Others

• Wiseplan is responsible for the data of its employees, candidates in its recruitment processes, individuals registered in its talent pool, and its business contacts. In these cases, Wiseplan determines the purposes and means of data processing and is directly accountable to the individuals concerned.
• Wiseplan acts as a data processor when it administers compensation, provides legal advice on labor matters, or offers human resources consulting to its clients. In providing these services, it processes its clients’ employees’ data on their behalf and in accordance with their documented instructions. The client is the data controller for that data.

When acting as a data processor, Wiseplan does not use its clients’ data for its own purposes, commercial purposes, or product development; does not engage other vendors without the client’s authorization; notifies the client without undue delay of any security breaches; and returns or deletes the data upon termination of the service, as instructed by the client.

5. Lawfulness of Processing

• The legal basis is determined for each processing activity and is documented. Consent is one of the legal bases recognized by law, but not the only one.
• When data processing is based on consent, consent is specifically requested for each purpose. Accepting terms and conditions does not constitute consent to data processing.
• Consent is not required when the processing is based on a contract or a legal obligation.
• Wiseplan must be able to demonstrate the lawfulness of each processing activity and, where applicable, the consent that has been given.

6. Sensitive Data

Due to the nature of its services, Wiseplan processes health data (processing of medical leave requests), results of occupational psychological evaluations, biometric data (attendance tracking), and union membership data (collective bargaining advisory services). This data:

• are addressed solely on the basis of express legality;
• are accessible only to those who need them for their job;
• are not circulated through informal channels or stored on personal devices; and
• They are deleted once the purpose that justified their processing has been fulfilled.

Wiseplan does not request criminal background checks from candidates, except in cases where a regulation expressly authorizes it.

7. How We Report

Wiseplan informs individuals about the processing of their data through privacy notices tailored to the specific category of data subject. This site publishes notices for job applicants, individuals registered in the talent pool, and business contacts. Wiseplan employees and individuals whose references are verified during a selection process receive their notice directly at the time their data is collected.

Each notice is published along with its version number, effective date, and history. Any material changes are communicated to the affected individuals.

8. Your Rights

You may request access to your data, its correction, or its deletion; object to its processing; request its portability; and request its temporary blocking. You also have the rights set forth in Section 12 regarding automated decisions. Exercising these rights is free of charge.

• Channel: Please email datospersonales@wiseplan.cl.
• Response deadline: thirty calendar days from receipt of the request, extendable once for an equal period, with a reasoned notification.
• Temporary suspension: We will respond within two business days.
• Complaint: If Wiseplan rejects your request or fails to respond within the specified time frame, you may file a complaint with the Personal Data Protection Agency.

If your request concerns data that Wiseplan processes on behalf of a client, we will forward it to the responsible client within two business days of receipt, as it is the client’s responsibility to resolve the matter.

9. Information Security

Wiseplan implements technical and organizational measures to safeguard the confidentiality, integrity, availability, and resilience of information, with enhanced standards for sensitive data and compensation data. The key measures are described in the Public Summary of Security Measures, published on this site.

Before enabling an activity, system, or feature—including those that have already been contracted but not yet activated—we verify that it processes only the data that is strictly necessary.

Every security incident is logged. When Wiseplan is the data controller, it reports breaches to the Personal Data Protection Agency without undue delay and notifies the affected individuals when required by law. When acting as a data processor, it notifies the client without undue delay and cooperates with the client.

10. Suppliers

Wiseplan does not disclose personal data to a service provider without a data processing agreement that complies with legal requirements, following an assessment of the provider’s security and confidentiality safeguards. That agreement prohibits the service provider from using the data for its own purposes, regulates subcontracting, and covers all of the services it provides. Wiseplan also verifies the location of its technology providers’ infrastructure. Contracting an external service does not transfer Wiseplan’s responsibility to third parties.

11. International Transfers

Wiseplan transfers data outside of Chile only when it has a previously documented legal basis for doing so. Data flows with its affiliated entity in Peru, relating to recruitment processes for positions in that country, are governed by a contract between the two entities that includes appropriate safeguards. Candidates for job openings outside of Chile are informed of where their data will be sent in the job posting before they apply.

12. Automated Decisions and Artificial Intelligence

When automated data processing, including profiling, produces legal effects concerning you or significantly affects you, you have the right to be informed, to receive an explanation, to request human intervention, to express your point of view, and to request a review of the decision.

In the recruitment process, the decision to move forward with a candidate or not is always made by a person. When any of the channels through which Wiseplan receives applications incorporates AI-assisted features from its vendors, this is disclosed in the privacy notice for candidates. Wiseplan does not implement systems with automated components that affect individuals without a prior impact assessment, notification to the individuals involved, and human oversight.

13. Retention and Deletion

All data has a retention period, which is calculated from a specific date. Once the retention period expires, the data is deleted or anonymized across all storage media, including backups, in accordance with their rotation cycle. The main retention periods are:

When there is a claim or ongoing proceeding in which the data may serve as evidence, its deletion is suspended for the time strictly necessary, limited to the data that is essential.

14. Impact Assessments

Wiseplan conducts a preliminary assessment of the impact of processing activities that may pose a significant risk to individuals, particularly those involving large-scale processing of sensitive data, automated decision-making, new international data flows, vendors with broad access to its repositories, or biometric technologies.

15. Data Protection Officer

Wiseplan has appointed María de los Ángeles Maturana as its Data Protection Officer. You may contact her at datospersonales@wiseplan.cl. The Data Protection Officer acts independently in matters of data protection, is bound by a duty of confidentiality, oversees compliance with this policy, responds to inquiries from individuals, and cooperates with the Personal Data Protection Agency.

16. Our Team

Wiseplan employees process data only within the scope of their duties, maintain confidentiality regarding such data, and immediately report any incident or practice that violates this policy to the Data Protection Officer. Wiseplan maintains a data protection training program that includes an orientation upon hire and annual refresher training.

17. Review of This Policy

This policy is reviewed at least once a year and whenever there are changes to Wiseplan’s services, its data-access providers, applicable regulations, or the criteria established by the Personal Data Protection Agency. Any modifications are approved by management and published on this site along with the version number, effective date, and a history of previous versions.