Personal Data Protection and Privacy Policy

Pinax Pocket Mentor is a platform developed and operated by xpertIA SpA (hereinafter, the “Company”), a stock company (sociedad por acciones), Chilean Tax ID (RUT) No. 77.922.445-7, legally represented by María Fernanda Castillo Vargas and Ignacio Alexis Zambrano Carrillo, domiciled at Avenida Javiera Carrera No. 045, apartment 401, Tower 3, commune of Temuco, La Araucanía Region, Chile.

xpertIA SpA is a company dedicated to the design, development and operation of technology solutions combining artificial intelligence and advanced analytics. This Policy specifically governs the Pinax Pocket Mentor product, an artificial intelligence mentor with persistent memory across sessions, aimed at accompanying founders of technology-based companies throughout their business validation and development process, whether they access on behalf of their own startup, company or SME, or by authorization of an accelerator, investment fund or other entrepreneurship-support organization.

xpertIA SpA is committed to safeguarding the personal data collected through the Platform, and declares that it strictly complies with the provisions of Law No. 19.628 on the protection of personal data, its subsequent amendments and other legal and regulatory rules applicable in the Republic of Chile. Likewise, and in preparation for the entry into force on December 1, 2026 of Law No. 21.719, which Regulates the Protection and Processing of Personal Data and creates the Personal Data Protection Agency (hereinafter, the “Agency”), xpertIA has been progressively adopting the standards enshrined in that law, several of which are already reflected in the principles and mechanisms described in this Policy.

By virtue of the foregoing, the Company makes this Personal Data Protection and Privacy Policy available to users, which governs the processing of the information collected through the Platform. Its purpose is to provide the data subject with clear, understandable and unequivocal access regarding the information collected, the purpose of its processing, the actions carried out with it, and the rights they hold under current regulations.

When registering as a User of xpertIA, you will be required to expressly accept this Personal Data Protection and Privacy Policy, which will be fully binding from that moment. Acceptance of this Policy authorizes xpertIA to process your personal data and the data you enter into the Platform in accordance with the purposes and lawful bases detailed in section 5 below. Such acceptance does not constitute an undifferentiated authorization for any and all processing: the processing necessary to provide the service, the processing required by legal obligations and the processing that requires your specific and separate consent —such as the sending of promotional communications or content— are each governed by the lawful basis applicable to them.

Failure to accept prevents the use of the Platform. Likewise, xpertIA may require acceptance of new versions of this Policy in the event of substantial modifications.

For the purposes of this Policy, the following definitions apply:

3.1. Authorization or consent of the personal data subject or their representative: the free, specific, informed and unequivocal expression of the will of the personal data subject or their representative, by which either of them, through a declaration or a clear affirmative action, expresses their agreement to the processing of the personal data concerning them.

3.2. Notice: any verbal or written communication generated by the Controller of personal data processing, informing about the purpose of the data processing, the type of data being processed, the recipients of the information, the data retention period and the way to exercise the rights held by personal data subjects.

3.3. Personal Data: any information relating to identified or identifiable natural persons. Examples of personal data include: name, identity card, place of birth, marital status, age, place of residence, employment or profession, among others.

3.4. Sensitive Personal Data: personal data referring to the physical or moral characteristics of persons or to facts or circumstances of their private life or intimacy, revealing ethnic or racial origin, political, trade union or guild affiliation, socioeconomic situation, ideological or philosophical convictions, religious beliefs, habits, data relating to health, the human biological profile, biometric data, and information relating to the sex life, sexual orientation and gender identity of a natural person.

3.5. Specially protected data: categories of personal data requiring special technical and organizational safeguards due to their criticality. By way of example, these include health data, due to their intimate nature and potential impact on the dignity of the data subject, and data relating to children under fourteen years of age, among others.

3.6. Data processing: any operation or set of operations, manual or automated, performed on personal data or sets of personal data, such as collection, recording, organization, structuring, storage, use, communication by transmission, erasure, destruction, etc. This list is not exhaustive.

3.7. Databases: any structured or unstructured set of personal data that can be accessed according to specific criteria, whether centralized, decentralized or dispersed on a functional or geographical basis.

3.8. Controller of Personal Data processing or simply Controller: any natural or legal person, public or private, who decides on the purposes and means of the processing of personal data, regardless of whether the data is processed directly by them or through a third-party agent or processor.

3.9. Processor or Agent: the natural or legal person assigned to carry out personal data processing operations on behalf of the data controller. xpertIA acts as such for these purposes.

3.10. Data subject: any natural person, identified or identifiable, to whom the personal data concerns or refers.

3.11. Third party: any natural or legal person, public authority, service or body other than the data subject or their representative, the controller or the processor, and the persons who for any circumstance access the personal data.

3.12. Recipient: any natural or legal person, public authority, service or other body, other than the data subject or their representative, to whom the personal data is communicated. Public authorities that may receive personal data in the framework of a specific investigation covered by current regulations and laws will not be considered recipients.

3.13. Pseudonymization: the process by which, in the processing of personal data, the identity of the data subject is prevented from being directly attributable without additional information. This additional information is kept separate and protected by technical and organizational measures, ensuring that the personal data cannot be associated with an identified or identifiable natural person without the use of this additional information.

3.14. Anonymization: the irreversible procedure by virtue of which personal data can no longer be linked or associated with a specific person, nor allow their identification, because the link with the information that links, associates or identifies that person has been destroyed or eliminated. Anonymized data ceases to be personal data.

3.15. Confidential financial or strategic data: data referring to economic projections, business metrics, investment, shareholdings or other strategic aspects related to identifiable natural persons, the disclosure of which could affect economic rights or legitimate expectations of privacy.

3.16. Institution: the startup, company, SME, accelerator, investment fund, incubator or other organization that subscribes to the Pinax Pocket Mentor service and authorizes the access of one or more founders to the Platform.

3.17. Data Protection Officer: the person that xpertIA designates or considers designating as a point of contact in matters of personal data protection, both before data subjects and before the Agency, in accordance with the criteria of Law No. 21.719.

3.18. Personal Data Protection Agency or Agency: the autonomous public-law body created by Law No. 21.719, responsible for overseeing and enforcing personal data protection regulations in Chile.

In the processing of personal data, xpertIA will be governed by the following principles, in accordance with the provisions of Law 19.628 and its subsequent amendments:

4.1. Principle of lawfulness and fairness: The processing referred to in this policy is a regulated activity that must comply with the rules and rights contemplated in the Political Constitution of the Republic and the provisions of Law No. 19.628, and its subsequent amendments, so the data will only be processed lawfully and fairly.

4.2. Principle of purpose: Personal data will be collected for specific, explicit and lawful purposes, and its processing will be limited to the fulfillment of those purposes; therefore, personal data is not processed for purposes other than those informed at the time of collection, except for legal exceptions.

xpertIA will retain personal data only for the time necessary to fulfill the purpose, or as established by law.

4.3. Principle of proportionality: The personal data processed will be strictly limited to that which is necessary, adequate and relevant in relation to the purposes of the processing.

4.4. Principle of quality: The personal data processed must be accurate, complete, current and relevant in relation to its origin and the purposes of the processing.

4.5. Principle of accountability: xpertIA, insofar as it carries out personal data processing operations, is legally responsible for compliance with the principles contained in this policy, and with the obligations and duties in accordance with the law.

4.6. Principle of security: In the processing of personal data, xpertIA guarantees adequate security standards, protecting it against unauthorized or unlawful processing, and against its loss, leakage, accidental damage or destruction. The security measures will be appropriate and consistent with the processing to be carried out and with the nature of the data.

4.7. Principle of transparency and information: xpertIA will provide the respective data subject with all the information necessary for the exercise of the rights established by Law 19.628, including information about this policy, as well as xpertIA’s practices regarding the processing of personal data, which, in any case, will be permanently accessible and available to any interested party in a precise, clear, unequivocal and free manner. xpertIA will adopt adequate and timely measures to facilitate the respective data subject’s access to all necessary information.

4.8. Principle of confidentiality: xpertIA will maintain secrecy or confidentiality regarding the personal data it learns of in the course of processing, establishing adequate controls and measures to preserve such secrecy or confidentiality. This duty will survive even after the relationship with the data subject has ended.

4.9. Guiding principles for the use of artificial intelligence: The Company incorporates Artificial Intelligence technologies (hereinafter “AI”) in Pinax Pocket Mentor for the purpose of accompanying the founder’s validation and development process, calibrating their position with respect to a venture-building framework and generating recommendations, without in any case replacing their judgment or adopting decisions with legal effects on them.

In its development and use of these technologies, xpertIA is guided by the principles established in Chile’s National Artificial Intelligence Policy, which include, among others, respect for fundamental rights, algorithmic transparency, security, sustainability and the promotion of individual and collective well-being.

xpertIA recognizes these principles as ethical and technical references that contribute to the responsible design of its digital tools, and undertakes to periodically review its practices to ensure their consistency with these standards and with Law No. 21.719, to the extent of its technical capabilities.

The personal data you enter into the Platform is not used by xpertIA to train or retrain third-party foundational models. Its processing by the artificial intelligence providers that xpertIA uses is governed by the commercial terms signed with each of them, which exclude such use. xpertIA may use anonymized or de-identified data, which has lost its character as personal data, for research purposes and to improve its own models and functionalities.

xpertIA processes the personal data of the data subjects indicated below, in accordance with the respective lawful bases:

5.1. Founder account data: when a founder accesses Pinax Pocket Mentor as an authorized User, personal data and credentials associated with their access profile are requested and stored, such as:

• Full name.
• Email address.
• Profile photograph, when available through the authentication provider.

The lawful basis for the processing of this data is the consent given by each founder when creating their account and accepting the Terms and Conditions and this Privacy Policy, in accordance with the provisions of article 4 of Law 19.628 and, once in force, Law No. 21.719.

5.2. Mentoring process data: during the use of the Platform, the founder enters, and the Platform generates, data associated with their validation and development process, such as:

• The content of their conversations with the artificial intelligence mentor.
• Information about their venture, including name, description, technology, development stage and milestones, and —when the founder chooses to enter it— financing or economic projection data.
• Names and roles of other people on their founding team, when the founder incorporates them as part of their profile.
• Recommendations, decisions, progress, risks, hypotheses and commitments recorded throughout their mentoring process.
• Claims and evidence gathered during the Platform’s audit and calibration processes with respect to their venture-building framework.

The lawful basis for this processing is the performance of the service contract signed between the Institution and xpertIA, and the personal acceptance of these instruments by each founder as indicated in the Terms and Conditions.

5.3. Third-party data entered by the founder: when the founder enters into the Platform information referring to other natural persons —for example, members of their founding team—, they will be responsible for having a lawful basis to share such information, under the terms indicated in the Terms and Conditions.

5.4. Automated support indicators (triage signals): when a founder accesses the Platform by authorization of an Institution, the latter may view, through an administration panel, certain indicators generated automatically from the content of the founder’s conversations with the mentor, the information about their venture and the gaps that the Platform detects between what the founder declares and the evidence gathered during their process. These indicators are expressed in general status categories —for example, whether the process is progressing normally, shows signs of stagnation, or presents relevant gaps between what has been declared and the available evidence— and do not constitute a score or numerical rating of the founder. They are continuously recalculated as the founder contributes new information or evidence to the Platform, so that they reflect at all times the most recent state of their process, and they are retained for as long as the mentoring information that gives rise to them is retained, in accordance with section 12 below.

The sole purpose of these indicators is to support the accompaniment, follow-up and prioritization of the attention that the Institution provides to the founders it has authorized. They do not constitute, and may not be used as: (a) an assessment of the founder’s personal merit; (b) investment advice; (c) a recommendation to grant or deny financing; (d) a criterion for determining the founder’s admission to, exclusion from or continuity in a program; or (e) an exclusive or determining criterion for adopting any decision that produces legal effects on the founder or significantly affects them. The founder may always correct the information giving rise to these indicators, submit additional evidence, challenge a classification with which they disagree and request human review, in accordance with the rights indicated in section 11 below.

5.5. Technical and usage data: the Platform automatically records technical and telemetry information associated with each session and interaction, such as user and workspace identifiers, type of event recorded, and service quality metrics. This information does not include the content of conversations and is processed for security, traceability and continuous service improvement purposes.

5.6. Persons who may access mentoring process information and the indicators: within the Institution, the only persons who may access the information of a founder’s mentoring process —including the content of their conversations, any financing information they may have entered and the indicators referred to in section 5.4 above— are the founder themselves, with respect to their own information; the Institution’s administrators (owners), insofar as they manage the contractual relationship and the founders’ access; and the analysts or mentors designated by the Institution, exclusively with respect to the founders assigned to them. xpertIA’s technical staff only accesses this information in exceptional and duly audited cases, for support, maintenance or security purposes. The read-only (viewer) profiles that the Institution enables for other users do not have access to the content of conversations, to financing information, or to the founder’s indicators or triage signals.

xpertIA collects personal data through the following mechanisms:

6.1. Automatic mechanisms: The Platform automatically records certain user activities in order to guarantee traceability, security, performance monitoring and usage analysis. Through this means, information related to the devices used is also collected, such as operating system, browser or application type, connection characteristics, among others.

Likewise, xpertIA may use its own or third-party technologies to establish patterns of activity, browsing or audience within the Platform, without this implying the direct identification of natural persons. This information is collected exclusively for statistical, continuous improvement and quality assurance purposes.

6.2. Institutional access mechanisms: a founder’s access to Pinax Pocket Mentor is enabled by the Institution that contracts the service, which authorizes their entry through an invitation —by email or quick-access link— or, when the founder accesses on behalf of their own startup, company or SME, through the subscription process described in the Terms and Conditions.

Each founder’s authentication is carried out through an identity provider —email and password, or Google account—, which validates their identity and enables their access to the Platform under their own personal account.

During normal use of the Platform, the founder may complete, update or enter new personal data of their own or of third parties linked to their project, in accordance with the functionalities described in section 5 above.

6.3. Automated processing of personal data and algorithmic transparency: In the course of its operation, Pinax Pocket Mentor generates automatic indicators on the progress of the founder’s mentoring process, including general status classifications and gaps between what the founder declares and the evidence gathered by the Platform. These systems are designed to support the mentoring process and, where appropriate, inform the Institution, without replacing the founder’s judgment or generating, by themselves, legal effects on them.

The operational logic of these systems is based on algorithmic models developed by xpertIA and on third-party language models described in section 9 below, whose structure and operation are protected by intellectual property rights and technical confidentiality safeguards.

xpertIA reviews the risks associated with this automated processing and undertakes to carry out formal impact assessments in accordance with section 10 of this Policy, additionally collaborating with the Institution in the event that it decides to carry out its own assessment, by providing general technical background, provided that this does not violate its confidentiality duties or affect its intellectual property.

6.4. No automated individual decisions with legal effects are adopted: xpertIA does not make automated individual decisions that produce legal effects or equivalent consequences on founders. The automated processing functionalities available on the Platform are aimed exclusively at accompanying the mentoring process, without in any case replacing the founder’s judgment or final responsibility regarding the decisions of their venture.

The founder may, at any time, request human review of any indicator or evaluation generated by the Platform regarding their process, in accordance with the right indicated in section 11 below. When a decision that produces legal effects on the founder or significantly affects them must be adopted taking this information into account, the Terms and Conditions applicable to the Institution require that such decision be adopted through an effective human evaluation, which weighs information independent of the indicators referred to in section 5.4 and allows the founder to present their defense.

In those cases where we use the personal data collected through the Platform, we inform you that such processing will be carried out solely and exclusively for the following purposes:

7.1. Personal data of the founder (User):

• To provide the Platform’s own services, executing the contract signed between the Institution and xpertIA, and the founder’s personal acceptance of the Terms and Conditions and this Policy.
• To allow the creation, administration and management of the founder’s account within the Platform.
• To operate the artificial intelligence mentor: maintain memory of the mentoring process across sessions, calibrate the founder’s position with respect to their venture-building framework, and generate recommendations, briefings and reference content.
• To search for and present to the founder external knowledge sources —scientific articles, patents or other public information— relevant to their process, when the founder requests it or the Platform deems it relevant.
• To manage requests, answer queries and provide technical support.
• To provide functionality, analyze performance, correct errors and improve the security, usability and effectiveness of the Platform.
• To compile usage and internal traffic statistics, without individually identifying founders.
• To prevent fraud, misuse or security breaches.
• To comply with applicable legal or regulatory obligations.

7.2. Personal data of third parties entered by the founder:

• To record and contextualize the information of the founding team and the project for the purposes of the mentoring process.
• To generate recommendations and reference content that take into account the composition and experience of the team, when such information has been entered by the founder.

7.3. Indicators communicated to the Institution:

• To allow the Institution to supervise, at a general level, the progress of the mentoring process of the founders it has authorized, for support purposes inherent to its relationship with those founders.

These signals are used exclusively to support the accompaniment, follow-up and prioritization of the support that the Institution provides to its founders, and are neither designed nor authorized to adopt or recommend decisions on financing, investment, selection, exclusion, continuity, sanctions or contractual conditions. The detail of the uses that the Institution undertakes not to make of these indicators is set out in the Terms and Conditions governing its access to the Platform.

In this regard, xpertIA may carry out any operation or set of operations —automated or not— that allow it to collect, store, record, organize, elaborate, select, extract, compare, interconnect, dissociate, communicate, assign, transfer, transmit or delete the personal data indicated, or use it in any other way that is necessary to fulfill the purposes described above.

Notwithstanding the foregoing, xpertIA may use, as it deems appropriate, the data and information listed below:

• Information collected through automatic mechanisms that does not contain personal data of founders;
• Merely statistical anonymized data;
• Data of founders and of third parties entered by them that has been duly de-identified, so that the information cannot be associated with a specific or identifiable person;
• In general, anonymous or anonymized data that cannot be considered "personal" in accordance with national legislation.

In all cases, xpertIA undertakes not to process personal data for purposes other than those described here, unless there is a legal basis enabling it or additional informed consent from the data subject. Likewise, data that is transformed into statistical, anonymized or de-identified inputs will not be considered personal under current Chilean legislation and may be used freely by xpertIA, provided that it does not allow the direct or indirect identification of the data subjects.

8.1. Duty of confidentiality

xpertIA will maintain strict confidentiality regarding the personal data processed on the Platform and will not disclose it to third parties, except in the cases authorized by the data subject, contemplated in this Policy, or required by law.

xpertIA will not transfer or allow access to personal data by third parties outside its operation, except where there are contractual relationships involving services necessary for the fulfillment of the purposes described in section 7. In such cases, xpertIA will require such third parties to assume equivalent contractual obligations regarding confidentiality and security, and will remain liable to Users.

Likewise, if xpertIA transfers assets, merges, spins off or reorganizes part of its corporate structure, it may share personal data with the entities involved, provided that they undertake to respect this Policy and give continuity to the services offered.

xpertIA may also communicate personal data when expressly required by a competent administrative or judicial authority, limiting itself to providing the information strictly necessary to comply with such legal requirement.

8.2. Respect for the principle of purpose

xpertIA will use personal data only for the purposes established in this Policy, in accordance with the principles of lawfulness, proportionality and fairness, without prejudice to the expressly provided legal exceptions.

8.3. Security and diligence in storage and transmission

xpertIA declares that it has implemented technical, administrative and organizational measures aimed at safeguarding the security of the personal data processed through its Platform, in accordance with reasonable and current industry standards.

These measures are designed to prevent unauthorized access, loss, leakage, misuse or alteration of data, both at rest and in transit. They include encryption protocols, access controls, operation traceability and periodic security reviews.

xpertIA maintains traceability mechanisms that make it possible to identify which users access, modify or consult information in each module of the Platform, as a complementary security and internal control measure.

These measures are adopted considering the state of the art, the nature of the data processed, the risks associated with the processing, and the type of technology used, including those involving artificial intelligence components.

Access to personal data is limited to authorized personnel who require such information for operational, technical support or maintenance purposes, who are subject to strict confidentiality duties.

In the event of detecting a security breach compromising personal data, xpertIA will promptly investigate the facts and, when there is a reasonable risk to the rights of data subjects, will notify the Agency within 72 hours of becoming aware of the incident, or within the period established at the time by the applicable regulations. When the risk to the affected data subjects is high, xpertIA will notify them directly and without undue delay, informing them of the nature of the incident, the data involved and the measures adopted.

When personal data is no longer necessary to fulfill its purpose, it will be deleted or anonymized, as indicated in the section on data retention.

8.4. Response to the exercise of data subjects’ rights

With respect to the data of their own account and that generated in the course of their mentoring process —including the content of their conversations, their venture profile, and the recommendations, decisions and other elements described in section 5 above—, the founder may direct their requests for access, rectification, cancellation, opposition, portability or limitation of processing directly to xpertIA, in accordance with the procedure indicated in the Contact section of this Policy. For the data of their account, xpertIA additionally makes its own export and deletion mechanisms available to them, and is moving toward a self-service interface that will allow these rights to be exercised directly from the Platform.

With respect to the information of the institutional workspace —including decisions that correspond exclusively to the Institution, such as the continuity of the founder’s access to the Platform or the use the Institution makes of the indicators indicated in section 5.4—, xpertIA acts as data processor on the instruction of the Institution, which is the controller of such processing. In these cases, xpertIA may redirect the founder’s request to the respective Institution, without prejudice to collaborating technically with it so that the right can be exercised expeditiously.

In summary, xpertIA acts as data controller with respect to the founder’s account data and their direct relationship with xpertIA, and as data processor with respect to the institutional workspace data it processes on the instruction of the Institution. With respect to the classifications, categories and indicators generated by the Platform itself —including the triage signals referred to in section 5.4—, the qualification of xpertIA as processor, joint controller or controller of part of that processing must be determined according to the specific elements of each case and with specialized legal advice, considering that xpertIA defines the logic, the categories, the functional purpose and the essential means of such processing; this qualification is not automatically presumed to be that of a mere processor. None of these distinctions limits xpertIA’s commitment to facilitating the timely exercise of data subjects’ rights.

For the provision of its services, Pinax Pocket Mentor uses technology infrastructure and artificial intelligence processing providers located outside Chile. Consequently, your personal data may be subject to international transfers, the details of which are provided below for transparency purposes:

• Language model providers: xpertIA uses artificial intelligence models from Mistral AI (France) and OpenAI (United States), and may use one or the other depending on availability, performance or cost. These providers process the content of the conversations and the context information necessary to generate the mentor’s responses, under the commercial terms signed with each of them, which exclude the use of such information to train their models.
• Storage and authentication infrastructure: Platform data is stored and backed up using Google Cloud / Firebase services.
• Technical observability tools: xpertIA uses Langfuse, hosted in its European Union cloud region, to technically review the operation of the artificial intelligence mentor, identify and correct errors, and improve service quality. The founder’s name and the name of their startup are masked before the information reaches this tool, so that the content reviewed for debugging purposes is not directly associated with their identity. This transfer is covered by the data processing agreement signed with that provider.
• External knowledge sources: when the founder requests it or the Platform identifies the relevance of external references, queries are made to public databases of scientific articles and patents (such as arXiv, Semantic Scholar and patent databases), sending only the relevant search terms and not the full content of the conversations.

These transfers are subject to the safeguard mechanisms required by applicable law, such as standard contractual clauses or other equivalent guarantees, as applicable to each provider and destination jurisdiction. xpertIA periodically reviews the data processing agreements signed with these providers, and will update this Policy if it incorporates new providers or modifies existing ones.

As part of its process of adaptation to Law No. 21.719, xpertIA is implementing an internal Record of Processing Activities, which will identify the purposes, categories of data and data subjects, recipients —including the international transfers described in the previous section— and retention periods applicable to each processing activity it carries out. xpertIA will also evaluate the appointment of a Data Protection Officer in accordance with the criteria established by that law, considering the nature and scale of its processing operations.

While that process is completed, any query, request or complaint related to the processing of personal data may be directed to the contact channel indicated in the Contact section of this Policy.

xpertIA periodically reviews the risks associated with the automated processing carried out by the Platform, and undertakes to carry out formal impact assessments with respect to those processing activities that, due to their nature or the category of data involved, entail a high risk to the rights of data subjects, in accordance with the standards of Law No. 21.719.

Any subject of personal data processed by xpertIA may, at any time, exercise the rights granted by Law No. 19.628 on the protection of personal data and its subsequent amendments, as well as, from its entry into force, by Law No. 21.719. By way of example, they may:

• Request access to information about the data relating to them, its origin and recipient, the purpose of its storage and the identification of the persons or bodies to which their data is regularly transmitted.
• Request that their personal data be rectified or modified when it is erroneous, inaccurate, misleading, incomplete or out of date, if applicable and so evidenced.
• Request the deletion, cancellation or temporary blocking of the data provided when they so wish, insofar as applicable in accordance with the law.
• Object to the use of their personal data for advertising, market research or opinion poll purposes.
• Revoke in writing the authorization given for the processing of their personal data in the cases where applicable.
• Request the portability of their personal data, that is, to obtain it in a structured and commonly used format to transmit it to another service provider.
• Request the limitation of the processing of their personal data while a pending rectification or opposition request is resolved.
• Not to be subject to decisions based solely on automated processing that produce legal effects on them, and to request human review of any indicator or evaluation generated by the Platform regarding their mentoring process.
• Challenge an inference, classification or indicator generated by the Platform regarding their process, submitting the background information or additional evidence they deem relevant.
• Request the temporary limitation of the processing or use of a specific indicator while a challenge or dispute raised by them is resolved, and be informed before such limitation is lifted.
• Receive a reasoned response to their requests for rectification, opposition, challenge or review.
• Resort to the ordinary courts of justice or, once it is fully operational, to the Agency, in the event that their request has been denied or they have not obtained a ruling in this regard.

To exercise your rights, you may contact xpertIA at the contact details set out below, in accordance with section 8.4 above.

xpertIA retains the personal data processed on the Platform only for the time necessary to fulfill the purposes for which it was collected, or for the period required by applicable laws, as appropriate. Once that period has ended, the data will be deleted in accordance with current provisions and adequate security standards.

In particular, xpertIA will retain the information associated with the mentoring process while the founder’s account and the Institution’s subscription remain in force, and for a reasonable additional period after their termination, in order to comply with legal obligations, resolve disputes or enforce the responsibilities arising from the provision of the service, after which such information will be deleted or anonymized.

12.1. Deletion of data from publicly accessible sources

Personal data obtained from publicly accessible sources will be deleted once it is no longer necessary in relation to the purpose for which it was collected. Likewise, this data will be updated in the event of changes of authorities, functions or other circumstances that prevent it from continuing to meet the quality standards required by the regulations.

You authorize XpertIA to assign, totally or partially, the legal relationships arising from the provision of the services, including the possibility that a third party continues to provide such services, assuming all the relevant rights and obligations.

xpertIA may also subcontract third parties for the execution of all or part of the services, ensuring that such persons maintain adequate levels of confidentiality, security and regulatory compliance in the processing of personal data.

With regard to the processing of such data, any assignment to third parties —whether by subcontracting or transfer of the contractual relationship— will be strictly limited to the purposes authorized by the data subject, or to those necessary for the fulfillment of the contractual relationship maintained with xpertIA. Any assignment of data will be formally documented, identifying the parties involved, the data subject to assignment, and the specific purposes of the processing.

Likewise, the third party receiving the personal data will assume the duty to process it exclusively for the established purposes and will acquire the status of data controller, in accordance with the applicable protection standards. xpertIA will maintain that status with respect to the processing it continues to carry out directly.

If you have any questions, complaints or observations about the way your data is processed, or if you wish to exercise the rights granted to you by the Political Constitution and/or the law on the protection of personal data, please contact xpertIA. Our contact details are:

• Email: info.xpertia@xpertialab.cl
• Postal address: Avenida Javiera Carrera No. 045, apartment 401, Tower 3, commune of Temuco, La Araucanía Region, Chile

For the exercise of rights, the request must meet the following formalities:

• a) Identification of the data subject and of their legal representative or agent, as applicable, without prejudice to the fact that xpertIA may require that their identity be authenticated by the means it deems appropriate.
• b) Indication of an address or an email address or other equivalent means for communicating the response.
• c) Identification of the personal data or of the specific processing with respect to which the corresponding right is exercised.

In rectification requests, the data subject must indicate the precise modifications or updates to be made and attach, where appropriate, the supporting background. In the case of deletion requests, the data subject must indicate the grounds invoked and attach the supporting background, if applicable. For opposition requests, the data subject must indicate the grounds invoked and briefly justify their request, attaching the background they deem appropriate. In the case of the right of access, reliable identification of the data subject will suffice.

This Personal Data Protection and Privacy Policy, in this version adapted to Pinax Pocket Mentor, is in force as of [date of publication of this version].

xpertIA may modify this Personal Data Protection and Privacy Policy, which will be binding on you only in the event that you expressly accept such modification. xpertIA will inform of such change on the Platform, its website: www.xpertialab.cl, or by email, as deemed most appropriate.

xpertIA will review and update this Policy periodically, especially in the event of relevant regulatory changes in the field of personal data protection or the use of artificial intelligence technologies applied to the processing of such data.

The interpretation and application of this Personal Data Protection and Privacy Policy is subject to Chilean law.

In the event of any difficulty arising from this Personal Data Protection and Privacy Policy regarding its existence, validity, enforceability, rescission, termination, interpretation, application, performance or execution, or for any other reason related to it, both xpertIA and the User will submit to the jurisdiction of the competent courts of the Republic of Chile.