Personal data processing policy

Controller: NeumaDiesel Servicios Industriales SpA, Chilean tax ID (RUT) 76.676.209-3, doing business as NeumaDiesel.

Representante legal: Mayerlyng Aguilera Sanchez. Gerente general: Cristóbal Oyarzun Gonzalez.

Postal address: Ruta D43 #701 Block 3 Oficina 2, Centro Empresarial Coquimbo, Región de Coquimbo, Chile.

Email for data-subject requests: contacto@neumadiesel.com. Phone: +56 2 3263 7480. You may also use the form in the “Exercise your rights” section of this page. Incoming messages are identified, routed and logged internally so we can answer within the legal time limit.

No data-protection officer has been appointed. Law 21.719 does not require every company to designate one. If we adopt a voluntary infringement-prevention model (Article 49), this policy will be updated.

We only collect data that is needed for the purpose you requested: answering an inquiry, assessing a job application, or letting authorized staff use the intranet. We do not sell personal data and we do not use contact or application data for marketing.

The table below is our record of processing activities for these digital channels.

Answering a contact or quotation request and assessing a job application are based on Article 13 (c): pre-contractual steps at your request. You do not have to “accept privacy” as a condition to send a message whose only purpose is that we reply.

Expected salary is optional. It is personal data and is used only to assess this vacancy, not to infer your socioeconomic situation. A specific, unticked checkbox records that use. We do not treat every salary expectation as sensitive data under Article 2 (g). You may withdraw that authorization without preventing assessment of the rest of your file (Article 13 (c)).

The CV is processed under Article 13 (c) insofar as it is needed to assess the role. We ask you not to include unnecessary sensitive data (Article 2 (g)). There is no generic authorization to process sensitive data in the CV. If you include any, HR will not use it for the hiring decision and may remove it from the selection file.

Staff intranet accounts are based on the employment or service relationship (Article 13 (c)). Turnstile and the session cookie are based on our legitimate interest in security (Article 13 (d)).

Inside the company, only people who need the data for the stated purpose can access it (sales for contact messages; HR for applications).

Providers that process data on our instructions (processors, Article 15 bis): Amazon Web Services (email via SES and CV storage in S3) and Microsoft (Entra ID for staff login). The applicable contracts and data-processing addenda are under review so they meet Articles 15 bis, 27 and 28.

Cloudflare Turnstile and Google Maps are third-party services that may process technical data when you use those features. They are not automatically classified as our processors; they may act as independent controllers of some technical data under their own terms.

CVs are stored in Amazon S3 in region us-east-1 (United States). Email via SES and authentication via Microsoft may also involve processing outside Chile. Cloudflare may process Turnstile data outside Chile.

The United States is not listed as providing an adequate level of protection equivalent to Chilean law. Ongoing storage of CVs in that infrastructure is not based on your consent or on Article 13 (c) alone. We rely on the provider’s security measures and on contractual safeguards (Articles 27 and 28), which we are documenting with each provider. If those guarantees change, we will update this policy.

Contact messages: they are not stored in our own database; they transit through the mailbox. They are kept only to complete the commercial follow-up of that inquiry or quotation (clarifications, sending the quote, closing that request), for up to 12 months after the last contact on that request. They are not used for marketing or for other matters. After that period the message must be deleted from the mailbox, unless a legal duty or the establishment or defence of a claim (Article 13 (e)) requires a longer, documented and minimized retention.

Job applications: kept during the selection process for that vacancy. Closing the vacancy stops new applications and does not delete the file at once. Unsuccessful applications and CVs are deleted automatically 12 months after closure. That period was adopted by Recruitment so we can still contact remaining candidates for the same vacancy if the selected person does not take the role, answer questions about that process, and establish or defend a claim related to the selection (Article 13 (e)), using only the data already collected. It is not a talent pool and is not used for other vacancies (Article 14 (d)).

If you are hired, the purpose and legal bases change. Only data needed to perform the employment relationship or to meet legal duties of the employer are moved to the personnel file. Information that belongs only to the selection process is deleted from the recruitment system when it is no longer needed.

We apply technical and organizational measures according to the type of data: HTTPS, access limited by role, httpOnly session cookie, private S3 bucket with SSE-AES256 encryption, CV downloads through short-lived signed URLs, file type and size limits, and Turnstile on the contact and rights forms.

If a security incident causes accidental or unlawful destruction, leak, loss, alteration, disclosure or unauthorized access, and there is a reasonable risk to your rights, we will report it to the Agency by the most expeditious means and without undue delay (Article 14 sexies). We keep an internal record of the nature of the incident, its effects, the categories and approximate number of people affected, and the measures taken.

The law does not set a general 72-hour deadline. Seventy-two hours is only an internal maximum for escalation. We will notify the Agency sooner if we already have enough information. We will also notify each affected person, in clear language, when the incident involves sensitive data, data of children under 14, or economic, financial, banking or commercial data. If individual notice is not possible, we will publish a notice in a nationwide mass medium.

We do not make decisions with legal or similarly significant effects based solely on automated processing. Job applications are reviewed by people in HR.

The public site does not use analytics or advertising cookies. The intranet sets a strictly necessary session cookie (intranet_session, 8 hours, httpOnly). Cloudflare Turnstile may set its own cookies when you submit a form. The Google Maps embed loads only if you choose to show the map. Details are in the processing table under “Site security and session”.

This is version 1.4, dated September 15, 2026. Material changes will be published on this page with a new version number. The date and version of the policy shown when you send a form will be the reference for that processing.