Personal data processing policy

Law 21.719 · version 1.3 · September 11, 2026

Version 1.3 · adopted on September 11, 2026

NeumaDiesel SpA (“NeumaDiesel”, “we”) is the data controller for the personal data processed through this website, the careers section and the intranet used by our staff.

This policy is published under Article 14 ter of Law No. 19.628, as amended by Law No. 21.719. It describes what we process, why, on which legal basis, for how long, with whom we share it, and how you can exercise your rights.

1. Controller

Controller: NeumaDiesel SpA, doing business as NeumaDiesel.

Postal address: Ruta D43 #701 Block 3 Oficina 2, Centro Empresarial Coquimbo, Región de Coquimbo, Chile.

Email for data-subject requests: contacto@neumadiesel.com. Phone: +56 2 3263 7480. You may also use the form in the “Exercise your rights” section of this page.

Requests are received by the company’s current legal representative. No data-protection compliance officer has been appointed yet. If one is designated, this policy will be updated.

2. What we process and why

We only collect data that is needed for the purpose you requested: answering an inquiry, assessing a job application, or letting authorized staff use the intranet. We do not sell personal data and we do not use contact or application data for marketing.

The table below is our record of processing activities for these digital channels. Other paper or on-site processes (contracts, payroll, occupational health) follow internal labor and tax rules and are outside this website.

Record of processing activities

Digital channels of the website and intranet. Source: current systems · policy version 1.3.

Website inquiries and quotations

Data subjects: People who write through the contact form.
Data: First name, last name, email, phone (optional), company (optional), subject and message.
Purpose and legal basis: To answer the inquiry or quotation requested by the data subject. Not used for marketing. Art. 13 (c) of Law 19.628 (pre-contractual steps at the data subject’s request).
Recipients: NeumaDiesel commercial staff. Processor: email service (Amazon SES).
Retention: For as long as needed to reply and at most 12 months after the last contact, unless a legal duty applies. Not stored in our own database: it transits by email.
Transfers: Email is sent via Amazon SES. The processor’s servers may be outside Chile (United States).

Job applications

Data subjects: People who apply to a vacancy published on the site.
Data: Name, email, phone (optional), expected salary, cover letter (optional) and CV (PDF or Word). The CV may contain other data the applicant includes in the file.
Purpose and legal basis: To assess the application for the specific vacancy and contact the applicant if the profile matches. Art. 13 (c) to identify and assess the application. Expected salary may be sensitive socioeconomic data (Arts. 2 (g) and 16) and is processed only with express consent (specific, unticked checkbox). The CV is covered by the same form notice.
Recipients: HR staff with ADMIN or RECRUITER role. Processors: file storage (Amazon S3) and email (Amazon SES).
Retention: For the selection process of that vacancy. Closing the offer does not delete the data: it only stops new applications. Unsuccessful applications and CVs are deleted automatically within 12 months after closure, unless hired, a legal duty applies, or claims need to be established or defended (Art. 14 (d)).
Transfers: CVs are stored in Amazon S3 (intended region: United States, us-east-1). Notifications are sent via Amazon SES.

Staff access to the intranet

Data subjects: Employees and contractors enabled by an administrator.
Data: Corporate email, name, role, account status and last login date.
Purpose and legal basis: To authenticate and authorize access to the internal panel (job offers and applications). Art. 13 (c) (performance of an employment or service contract) and Art. 13 (b) when access control is required by law.
Recipients: Intranet administrators. Identity processor: Microsoft Entra ID.
Retention: While the person is enabled and, after deactivation, for as long as labor, tax or security duties require.
Transfers: Authentication runs through Microsoft. Account data is stored in Chile or in the infrastructure hired for the intranet.

Site security and session

Data subjects: Contact-form visitors, intranet users and, in a limited way, anyone who loads the map on the contact page.
Data: Intranet session cookie (httpOnly JWT), Cloudflare Turnstile anti-bot token and technical data Google Maps may process to show the map.
Purpose and legal basis: To protect the form against automated submissions, keep the HR session and show the office location. Art. 13 (d) (legitimate interest in site security) for Turnstile and the session. The map is loaded to show the office location; it is not used for advertising.
Recipients: Cloudflare (Turnstile) and Google (Maps). The session cookie is not shared with marketing third parties.
Retention: The intranet session lasts 8 hours. Turnstile does not keep an account of the visitor on our side. We do not use analytics or marketing cookies.
Transfers: Cloudflare and Google may process data outside Chile. The current site does not use Google Analytics or advertising pixels.

3. Legal bases

Answering a contact or quotation request and assessing a job application are based on Article 13 (c): pre-contractual steps at your request. You do not have to “accept privacy” as a condition to send a message whose only purpose is that we reply.

Expected salary and any sensitive data you include in a CV (health, union membership, socioeconomic situation and similar categories in Article 2 (g)) require express consent under Article 16. The application form uses a specific, unticked checkbox for salary expectation and another for data contained in the CV. You may withdraw that consent without affecting the lawfulness of the assessment already carried out.

Staff intranet accounts are based on the employment or service relationship (Article 13 (c)). Turnstile and the session cookie are based on our legitimate interest in security (Article 13 (d)).

4. Recipients and processors

Inside the company, only people who need the data for the stated purpose can access it (sales for contact messages; HR for applications).

Processors acting on our instructions: Amazon Web Services (email via SES and CV storage in S3), Microsoft (Entra ID for staff login) and Cloudflare (Turnstile). Google may process technical data if you load the map on the contact page.

5. International transfers

CVs and some emails are processed on Amazon Web Services infrastructure. The configured region for CVs is us-east-1 (United States). Microsoft and Cloudflare may also process data outside Chile.

The United States is not listed as providing an adequate level of protection equivalent to Chilean law. We rely on the provider’s security measures (private bucket, encryption at rest, access control, signed download URLs) and on the service agreements in force with each processor. If those guarantees change, we will update this policy.

6. Retention

Contact messages: kept in the mailbox for as long as needed to reply, up to 12 months after the last contact, unless a legal duty applies. They are not stored in our own database.

Job applications: kept during the selection process. Closing the vacancy stops new applications and does not delete the file. Unsuccessful applications and CVs are deleted automatically within 12 months after closure (Article 14 (d)), unless you are hired or we must keep them to establish or defend a claim.

Keeping an application for other future vacancies is a different purpose. We will only do that with specific consent, which is not requested today.

7. Security

We apply technical and organizational measures according to the type of data: HTTPS, access limited by role, httpOnly session cookie, private S3 bucket with SSE-AES256 encryption, CV downloads through short-lived signed URLs, file type and size limits, and Turnstile on the contact and rights forms.

If a security incident causes accidental or unlawful destruction, leak, loss, alteration, disclosure or unauthorized access, and there is a reasonable risk to your rights, we will report it to the Agency by the most expeditious means and without undue delay (Article 14 sexies). We keep an internal record of the nature of the incident, its effects, the categories and approximate number of people affected, and the measures taken.

If the incident involves sensitive data (for example CVs that may include health or union membership, or expected salary as socioeconomic data), data of children under 14, or economic, financial, banking or commercial data, we will also notify each affected person in clear language: which data, possible consequences and the measures adopted. If individual notice is not possible, we will publish a notice in a nationwide mass medium.

Exercise your rights

You may request access, rectification, erasure, objection, portability and temporary blocking of your personal data, and you may withdraw consent where processing is based on consent. These rights are personal and cannot be waived.

How to submit a request: send it to contacto@neumadiesel.com or use the form below. Include your identification, an email to receive the answer, which right you exercise and which data or processing it concerns. For rectification, erasure or objection, please state the change or ground.

We will acknowledge receipt and decide within 30 calendar days. That period may be extended once by another 30 calendar days. We will answer in writing to the email you give us and keep proof of the reply.

If we refuse or do not answer on time, you may lodge a complaint with the Agencia de Protección de Datos Personales within 30 business days.

This form is the electronic channel under Article 11. You can also write to contacto@neumadiesel.com. The request is free of charge.

Also by email: contacto@neumadiesel.com

9. Automated decisions

We do not make decisions with legal or similarly significant effects based solely on automated processing. Job applications are reviewed by people in HR.

10. Cookies

The public site does not use analytics or advertising cookies. The intranet sets a strictly necessary session cookie (intranet_session, 8 hours, httpOnly). Cloudflare Turnstile and the Google Maps embed may set their own cookies. Details are in the processing table under “Site security and session”.

11. Updates

This is version 1.3, dated September 11, 2026. Material changes will be published on this page with a new version number. The date and version of the policy shown when you send a form will be the reference for that processing.

This policy describes the processing that NeumaDiesel has adopted for its digital channels. Legal texts should be reviewed by counsel before relying on them in a dispute.

Call Us

Certifications