Privacy and Personal Data Processing Policy

1. Data Controller

Regarding processing in which ACHALAI determines the purpose and essential means:

Controller: Diego Damián Freire

Legal Address: Av. Medrano 1940, Autonomous City of Buenos Aires, Republic of Argentina

Brand/Platform: ACHALAI

Privacy Contact: info@achalai.com

2. The Two Roles of ACHALAI

ACHALAI as Controller

ACHALAI acts as Controller with respect to data linked to:

• visitors to achalai.com;
• demo requests;
• commercial contacts;
• Authorized Users;
• account administration;
• support;
• communications;
• billing;
• proprietary security;
• consented website analytics.

ACHALAI as Processor

ACHALAI acts as Processor when it processes, on behalf of the Client, personal data uploaded to the Platform relating to its:

• employees;
• contractors;
• candidates, where a contracted feature includes them;
• collaborators;
• other Occupants.

Said processing is primarily governed by the DPA.

3. Information We May Collect as Controller

3.1. Demo and Contact Requests

We may process:

• first name;
• last name;
• corporate email;
• company;
• job title;
• message;
• information voluntarily included by the individual.

3.2. Account Data

We may process:

• first name;
• last name;
• corporate email;
• company;
• role;
• permissions;
• technical identifiers;
• access history;
• security information.

Passwords must not be stored in readable format by ACHALAI.

3.3. Commercial and Administrative Information

Where applicable:

• company;
• contacts;
• proposal;
• contracted plan;
• invoicing;
• tax identifiers provided to issue documentation;
• payment history.

3.4. Support and Communications

We may retain:

• requests;
• messages;
• emails;
• support logs;
• information necessary to resolve an incident.

3.5. Technical and Browsing Information

Depending on cookie preferences and technical settings:

• IP address;
• browser;
• device;
• pages visited;
• date and time;
• approximate traffic source;
• browsing events;
• technical security logs.

4. How We Obtain Data

We may obtain information:

• directly from the individual;
• from the Client that creates an account;
• from Authorized Users;
• through the technical operation of the Platform;
• through authorized cookies;
• from commercial communications;
• when necessary for a contractual relationship.

5. Purposes

We use data when necessary to:

• respond to inquiries;
• manage Demo requests;
• create and administer accounts;
• provide the Platform;
• authenticate users;
• provide support;
• manage security;
• issue commercial and tax documentation;
• manage the relationship with Clients;
• comply with legal obligations;
• prevent fraud or abuse;
• analyze the website when consent for analytics exists;
• communicate commercial news when sufficient legal basis exists.

6. Legal Basis

In Argentina, processing is carried out in accordance with Law No. 25.326 and supplementary regulations, including, as applicable:

• consent;
• contractual or professional relationship;
• compliance with legal obligations;
• other situations expressly authorized by applicable regulations.

When the General Data Protection Regulation of the European Union applies, processing will be based on the legal basis provided in Article 6 of the GDPR corresponding to each purpose.

Generic acceptance of this Policy shall not be used as a substitute for specific consent where legally required.

7. Mandatory and Optional Information

When data is essential to:

• register an account;
• provide a feature;
• respond to a request;
• issue an invoice;
• comply with a legal obligation,

the inability to provide it may prevent completion of that operation.

Optional fields will be identified or may be omitted without preventing the primary purpose.

8. Data Processed on Behalf of Clients

Companies using ACHALAI may upload information related to their Occupants.

Depending on the configuration, it may include:

• identification;
• contact information;
• area;
• location;
• position;
• hierarchical relationships;
• seniority;
• contractual information;
• compensation;
• benefits;
• performance;
• potential;
• succession;
• development;
• photographs;
• organizational information.

The Client determines what information it uses and for what purpose.

If an individual wishes to exercise rights regarding information uploaded by their employer or organization, they must primarily contact said organization.

ACHALAI will collaborate technically in accordance with the DPA.

9. Sensitive Data and Special Categories

ACHALAI does not generally require Clients to upload sensitive data.

The Client must avoid incorporating:

• health information;
• racial or ethnic origin;
• religion;
• political opinions;
• trade union membership;
• sexual life;
• genetic data;
• biometrics intended for unique identification;
• other specially protected categories,

unless there is a legitimate need, contractual authorization, and compliance with applicable legal requirements.

An ordinary photograph will not automatically be considered biometric data by ACHALAI unless processed through techniques designed to uniquely identify the individual.

10. Artificial Intelligence and Personal Data

ACHALAI distinguishes between:

Artificial Intelligence used during development

The process of building ACHALAI may use Artificial Intelligence tools as assistance for coding, design, documentation, testing, and improvement.

This does not authorize the use of Client Data or Occupant data in said tools.

Artificial Intelligence used within the product

If a feature of the Platform uses an external AI provider to process Client Data, ACHALAI must:

• identify that processing;
• incorporate it into the corresponding contractual framework;
• evaluate the provider;
• apply required legal safeguards;
• incorporate it as a subprocessor where applicable.

11. No General Model Training

Client Data and occupant data will not be used to train general Artificial Intelligence models, whether proprietary or third-party, without express contractual authorization from the Client and the existence of a valid legal basis.

12. Service Providers

ACHALAI uses technology providers to operate the website and Platform:

• Supabase Inc.: PostgreSQL database infrastructure, authentication, and secure storage.
• Vercel Inc.: Hosting, edge delivery, and web execution services.
• Resend Inc.: Delivery of transactional and authentication communications linked to the Platform (integrated via Supabase Auth).
• Google Workspace: Corporate email management and Provider communications.
• Google Analytics 4: Public website analytics measurement only when the visitor has granted consent.
• Web3Forms: Technical processing of the public demo request form.
• GitHub Inc.: Source code repository (does not process or store Occupant databases).

13. Sale of Data

ACHALAI does not sell, rent, or trade personal data to third parties for their own advertising purposes.

14. International Transfers

The use of technology providers may involve processing of information outside Argentina.

When an international transfer requires additional safeguards under applicable regulations, ACHALAI will use legally recognized mechanisms, such as:

• adequacy decisions;
• standard contractual clauses;
• data processing agreements;
• other permitted safeguards.

For transfers governed by Argentine legislation to jurisdictions not considered adequate, ACHALAI will adopt, where applicable, the mechanisms provided by the AAIP.

Acceptance of this Policy shall not be used as supposed consent of Client Occupants to legitimize international transfers carried out by the Platform in a general manner.

When the GDPR applies, onward transfers will be carried out in accordance with its Chapter V.

15. Security

ACHALAI applies reasonable and risk-proportionate technical and organizational security measures.

Concrete measures may evolve with the Platform.

Only those measures that can be technically verified will be published as implemented.

No technology can guarantee absolute security.

16. Retention

Data will be retained for the time necessary for the corresponding purpose and, subsequently, for the periods required by legal obligations or to address legitimate responsibilities.

Client Data is retained in accordance with:

• duration of the service;
• instructions from the Client;
• DPA;
• reasonable technical backup cycles.

17. Cookies

Cookies and similar technologies used by achalai.com are described in the Cookie Policy.

Non-essential analytical cookies are subject to visitor consent where applicable.

18. Rights in Argentina

Individuals may exercise the rights recognized by Personal Data Protection Law No. 25.326:

• Access: Right to request and obtain information about their personal data. The maximum statutory response deadline is ten (10) calendar days from reliable receipt.
• Rectification, Updating, and Suppression: Right to request modification, updating, or deletion of inaccurate, incomplete, or unlawfully processed data. The maximum statutory response deadline is five (5) business days from proof of the right.
• Confidentiality: Right to have processing carried out with strict confidentiality.

Requests may be sent to:

info@achalai.com

Reasonable information may be requested to prove the identity of the applicant and avoid disclosing data to unauthorized third parties.

Information required by Disposición DNPDP Nº 10/2008:

“The owner of personal data has the right to exercise the right of access thereto free of charge at intervals of not less than six months, unless a legitimate interest is proven to that effect pursuant to the provisions of Article 14, paragraph 3 of Law No. 25.326.”

“The Agency for Access to Public Information, in its capacity as the Supervisory Body of Law No. 25.326, has the attribution to address reports and claims filed in connection with non-compliance with the rules on personal data protection.”

19. Rights when the GDPR Applies

When the GDPR applies, individuals may exercise, as applicable:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• portability;
• withdrawal of consent where it is the basis used;
• complaint before a supervisory authority.

20. Automated Decision-Making

ACHALAI is designed as a decision-support platform.

Features intended to analyze individuals must incorporate human review when required by the nature and impact of the decision.

ACHALAI does not intend for an automated result to indiscriminately replace the judgment of individuals responsible for an employment decision.

21. Minors

The website and Platform are designed for business contexts and are not directed to minors as end users.

Clients must not upload minor information unless legitimately necessary for a permitted business purpose and supported by a sufficient legal basis.

22. Amendments

This Policy may be updated due to:

• regulatory amendments;
• provider changes;
• new features;
• product evolution;
• architecture changes.

Material changes will be communicated when applicable.

23. Contact

Data Controller:

Diego Damián Freire

Legal Address:

Av. Medrano 1940, Autonomous City of Buenos Aires, Republic of Argentina

Privacy:

info@achalai.com