Privacy Policy

1. Who is responsible for your data

All personal data requests are handled at datos@herihe.digital. It is the single, monitored channel to exercise your rights, request deletion of your data, report an issue or file a complaint.

2. Our dual role: controller and processor

HERIHE DIGITAL LTDA. processes personal data in two distinct capacities, and that distinction determines who you should address:

When we act as a processor, we process data solely according to the client controller's documented instructions, we do not use it for our own purposes, and we do not combine it across different clients.

3. What data we process

3.1 Data you give us directly

• Full name, email address and phone number.
• Company name and job title.
• Any information you send through contact forms, WhatsApp, website chat or social media messaging.
• Billing details, where a commercial relationship exists.
• Credentials and authorizations you voluntarily connect (for example, OAuth access to Google Ads, Google Analytics, Search Console or Meta Business Manager). These are stored encrypted with restricted access.

3.2 Data from publicly available sources

• Business information published in directories and maps (for example, Google Maps) and in commercial registries.
• Information from public professional and business profiles.
• Information published on corporate websites.

This is professional contact data (corporate email, business phone, job title, company). We do not collect sensitive data from public sources.

3.3 Data collected automatically

• IP address and user agent.
• Browsing data: pages visited, traffic source, campaign parameters (UTM), cookies and similar identifiers.
• Interaction with our emails: delivery, opens and clicks.
• Consent and confirmation timestamps.

3.4 Data received from third-party platforms

When you interact with us through Meta (Facebook, Instagram, WhatsApp), Google, Apple or other platforms, we receive data from those platforms. The exact detail — what we receive, what for and how it is deleted — is in section 11.

4. Purposes and legal bases

5. Legitimate interest and B2B prospecting

For commercial communications addressed to professional business contacts we carry out a documented balancing test under Article 16 quinquies of Law 21.719. It is available on request at datos@herihe.digital.

The limits we impose on ourselves in this activity:

• Only professional contact data — never sensitive data or consumer data.
• Sends are segmented by industry and criteria, never indiscriminate blasts.
• One-click unsubscribe link in every send, and immediate cessation on any objection.
• Traceability of every contact's origin and a centralized suppression list, so an opt-out is never undone by a later import.
• Data received through Meta platform direct messaging is excluded from this activity (see section 11.1).

6. Who we share data with: processors and sub-processors

We share data with providers acting as processors or sub-processors, under our instructions and solely to deliver the service. We do not sell, license or transfer personal data to third parties for their own purposes.

This list is updated whenever our provider chain changes. The current detail per service is available on request.

7. International transfers

A significant part of our infrastructure and of the providers we use has servers outside Chile, primarily in the United States. In those cases we apply the safeguards required by Law 21.719 (Arts. 27–28) to ensure an adequate level of protection, and the equivalent safeguards required by the LGPD (Ch. V) and the GDPR (Ch. V), including standard contractual clauses where applicable.

If you are a data subject in the European Union or the European Economic Area, you may request a copy of the applicable transfer mechanism by writing to datos@herihe.digital.

8. Retention periods

Where the law requires us to keep data despite a deletion request, we document the specific legal obligation grounding that retention and tell you about it in our response.

9. Security

• Encryption in transit: HTTPS/TLS across sites and services; SSH for infrastructure operations.
• Credential encryption: tokens and secrets are stored encrypted, never in source code. Enforced by automated secret-detection tooling on every change.
• Access control: restricted to the technical staff assigned to each account, by role.
• Client isolation: each client has its own instance or database. One client's data is never combined with another's.
• Backups: encrypted backups of the central commercial database.
• Traceability: origin recorded for every contact, plus a centralized suppression list.
• Incident response: a formal breach notification plan, notifying the controller without undue delay and the authority within the applicable statutory deadlines.

10. Cookies and similar technologies

Our sites use cookies and similar identifiers for site functionality, analytics and advertising measurement.

Parties that may collect, receive or use data through these technologies: HERIHE DIGITAL LTDA., Google LLC (Google Analytics, Google Ads, Google Tag Manager) and Meta Platforms, Inc. (Meta pixel).

We use Google Analytics. You can read how Google collects and processes this data at “How Google uses information from sites or apps that use our services”. We do not pass information to Google that could be used or recognized as personally identifiable, hashed or otherwise.

Other than strictly necessary cookies, we only set cookies with your consent, requested via the banner on our site. We keep a record of the consent given. You can withdraw it at any time from the “Cookie preferences” link in the footer of each site, or by writing to datos@herihe.digital.

11. Third-party platform data

This section describes, platform by platform, what data we receive, what we use it for, where we store it, who we share it with and how it is deleted. We only process platform data for the purposes described here.

12. How to delete your data

What happens next

1. Acknowledgement within 48 hours, with a reference number for your request.
2. Identity verification. If you write from the same email address or number we have on file, that is enough. If not, we will ask for the minimum details needed to confirm it is you, without demanding unnecessary documents.
3. Execution. We delete your data from our central database and from any instance where it is held, keeping only the strict minimum in the suppression list (email and its hash) so we never contact you again.
4. Written response stating what was deleted, what was retained and why. If a legal obligation prevents us from deleting an item, we tell you which one.

Deadlines

An objection to direct marketing waits for no deadline: it is executed immediately (operationally, within 48 hours at most).

What we cannot delete

We retain data the law requires us to keep — chiefly billing records, for the statutory tax period — and the minimum needed to evidence that we handled your request. In those cases we tell you the specific obligation grounding the retention, and the data is blocked: it is not used for any other purpose.

Data we process on behalf of a client

If your data sits in a database we operate as a processor, the controller is our client. We forward your request without delay, assist them in responding within the legal deadline and, if they authorize us to, tell you which company it is so you can approach them directly.

13. Your rights by jurisdiction

Wherever you are, you can exercise your rights through the same channel: datos@herihe.digital. Exercising your rights is free of charge and we will not treat you worse for doing so.

13.1 Chile — Law 21.719

You have the rights of access, rectification, cancellation (erasure), objection, portability and blocking. The right to object to direct marketing is absolute and requires no justification.

• Response time: 15 business days from receipt of the request.
• Authority: Agencia de Protección de Datos Personales, where you may complain if you consider your request was not handled properly.
• Effective date: Law 21.719 takes effect around December 2026. We apply these standards already.

13.2 Brazil — LGPD (Law 13.709/2018)

You have the right to: confirmation that processing exists; access to your data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law; portability; deletion of data processed on the basis of your consent; information about the entities we share data with; information about the option not to consent and its consequences; withdrawal of consent; and review of automated decisions.

• Response time: immediately in simplified format, or up to 15 days for the full statement.
• Authority: ANPD — Autoridade Nacional de Proteção de Dados.
• Data protection officer channel: datos@herihe.digital.

13.3 European Union and EEA — GDPR

You have the rights of access (Art. 15), rectification (Art. 16), erasure or “to be forgotten” (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects (Art. 22). Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

• Response time: 1 month from receipt, extendable by up to 2 further months for complex requests, with notice of the reason within the first month.
• Authority: you may lodge a complaint with the supervisory authority of your Member State of residence, place of work or of the alleged infringement.
• Transfers: see section 7.

13.4 California — CCPA / CPRA

If you are a California resident, you have the right to: know what personal information we collect, use, disclose and from which sources; access a copy of it; correct inaccurate information; delete your personal information; opt out of the sale or sharing of personal information; limit the use and disclosure of sensitive personal information; and not be discriminated against for exercising any of these rights.

• We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not disclose it for cross-context behavioural advertising. That is why we do not publish a “Do Not Sell or Share My Personal Information” link: there is no sale or sharing to opt out of.
• Deadlines: we acknowledge receipt within 10 business days and respond within 45 calendar days, extendable by a further 45 days with notice of the reason.
• Authorized agent: you may designate an agent to exercise your rights; we will ask for proof of authorization and may ask you to verify your identity.

14. Artificial intelligence and automated decisions

We use third-party artificial intelligence systems — chiefly Anthropic and OpenAI — as supporting tools to draft content, analyse campaign data, transcribe meetings and run conversational agents. They act as our processors, under enterprise API terms that exclude the use of submitted content to train their models.

• Client meeting audio and video, and voice notes, are transcribed on our own infrastructure, without being sent to third-party transcription services.
• We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Every decision with material impact goes through human review.
• If we ever implement such a decision, we will disclose it in this policy, explain the logic involved and guarantee your right to obtain human intervention, express your point of view and contest the decision.

15. Minors

Our services are aimed at people over 18 and at professional business contacts. We do not knowingly collect data from minors. If you believe a minor has provided us with data, write to datos@herihe.digital and we will delete it.

16. Changes to this policy

We may update this policy to reflect legal, technical or business changes. The date of the last update appears at the top of the document. Material changes will be announced with reasonable notice through a prominent notice on the site and, where appropriate, by email.

If we need to process a type of platform data not described here, we will update this policy before accessing that data and, where the legal basis is consent, we will ask you for it again.

17. Contact and complaints

• Personal data: datos@herihe.digital
• Phone: +56 9 4043 5095
• Address: Cochrane 639, of. 54, Valparaíso, 2361806, Chile
• Website: https://herihe.digital/

If you consider that your request was not handled properly, you may complain to the authority in your jurisdiction: the Agencia de Protección de Datos Personales in Chile, the ANPD in Brazil, the supervisory authority of your Member State in the EU/EEA, or the California Attorney General.