Data-processing annex

Last update: 10 September 2026
Watch from: 1 December 2026
Version: 1.0
To whom it applies: Patients responsible for treatment

In summary

It is the contract that article 15 bis of Act No. 21.719 requires between the person responsible and the person responsible.
It is part of any subscription: it is not an annex that is negotiated only if the customer so requests.
Fixed object, duration, purpose, data types, categories of holders and obligations of both parties.
It includes assistance for rights, gaps and impact assessments, and subcommission rules.

This summary guides the reading and does not replace the text of the document.

01Subject matter, duration and purpose

Element	Content
Subject matter	Processing of personal data required to provide the services of the contracted platform
Duration	The validity of the subscription contract, plus the agreed repayment and termination periods
Nature and purpose	Collection, registration, standardization, storage, consultation, analysis, communication to the person responsible and suppression, for the sole purpose of providing the service
Data types	Identification and contact, operational identity, position and status telemetry, driving behavior, working hours, proof of execution, image and video, and, in the future, biometric data only if that feature comes to exist and the controller enables it after an impact assessment (today the platform does not process biometric data)
Categories of holders	Field drivers and workers of the person responsible, their management users, their customers and delivery recipients, and third parties caught by camera

Ley 21.719 · Article 15a

The processing on request must be included in a contract establishing the object, duration, purpose, type of data, categories of holders and the rights and obligations of the parties, with a view to prohibiting the use of data for a different purpose and to giving them away without authorization.

Official text of the rule

02Our obligations as the manager

1.To treat the data only in accordance with the documented instructions of the person responsible, unless a legal obligation requires otherwise, in which case we inform it before it is fulfilled if the law so permits.
2.To warn in writing and without execution when an instruction of the person responsible, in our view, violates the rules of data protection.
3.To ensure that those who access the data are subject to the duty of confidentiality that remains after the end of their link.
4.Implement security measures for the safety declaration and keep them up to date in accordance with the state of the technique.
5.To assist the person responsible in meeting the requests of the holders, providing the necessary information and extraction tools.
6.Assist him in his impact assessments and his relationship with the Agency when the treatment involves us.
7.Notify you of any gaps affecting your data within 24 hours of confirmation, with the information available at that time.
8.Make available to you the information necessary to demonstrate compliance with these obligations and to allow audits in the terms of the relevant section.
9.Delete or return the data at the end of the order, as instructed by the person responsible.

03Obligations of the person responsible

Determine the purposes and have a basis of legality for each.
Inform the holders and, where appropriate, obtain and manage their consent.
Configure the platform within what its legality base holds, including retention times.
To meet the requests of its owners, with our assistance.
Notify the Agency and the holders when a gap requires it.
Perform the impact assessment before activating high-risk functions, such as biometric identification.

04Subencargo

The person responsible generally authorizes the subcommission in respect of the suppliers published in the register of subordinators, subject to the 30-day notice procedure and the right of informed objection described in that document.

Every sub-manager is subject by contract to the same obligations that we assume here. We hold the person responsible for the treatment that any of them carries out.

05Audit

The person responsible can verify our compliance once a year, and also when a gap has occurred that affects their data. The verification can be done by means of a documented questionnaire, a review of our control reports or, if these means are insufficient, an agreed on-the-spot audit 30 days in advance.

The audit is carried out on a working time, without affecting the operation, by staff subject to confidentiality and without access to data from other customers. The costs are the responsible, unless the audit reveals a relevant non-compliance, in which case we assume them.

Status of this document

Text prepared by Drometra and pending review by external legal advice before its final publication. Its structure and content were built on the current Chilean legislation and on Law 21.719, which has been in force since 1 December 2026. It does not constitute legal advice for third parties.