Privacy Policy — Tucango SpA and Tucango LLC

Tucango operates through two companies. The controller of your data is the company you deal with:

Tucango SpA (Chile)

• Legal name: Tucango SpA
• Tax ID (RUT): 76.592.882-6
• Legal representative: Rodrigo Cárcamo Gruebler
• Address: Los Laureles 075, 2nd floor, Valdivia, Chile (this address is not open to the public)
• Controller of: the data of the clients, and their contacts, that Tucango SpA quotes or invoices, of its suppliers, of visitors to the tucango.com website, and of people who write to us, apply to work with us, or subscribe to our communications.

Tucango LLC (United States)

• Legal name: Tucango LLC, a limited liability company organised under the laws of the State of Florida, United States
• Address: 7901 4th Street North, STE 300, St. Petersburg, FL 33702, USA (this address is not open to the public)
• Controller of: the data of the clients, and their contacts, that Tucango LLC quotes or invoices (for example, international clients paying in US dollars).

Contact for both companies

• General contact email: hola@tucango.com
• Email for privacy matters and exercising your rights: hola@tucango.com
• Data Protection Officer: Rodrigo Cárcamo Gruebler (contact: hola@tucango.com)

Each company is responsible only for the personal data it processes in relation to its own clients and contacts, consistent with the "Contracting entity" clause of our Terms and Conditions. If you are not sure which company you deal with, check your quotation or invoice, or write to us at hola@tucango.com: we will handle your request and, where appropriate, coordinate it with the responsible company.

Applicable law. Tucango SpA processes data in accordance with Chilean law, in particular Law No. 19,628, as amended by Law No. 21,719, under the supervision of Chile's Personal Data Protection Agency. Tucango LLC processes data in accordance with the laws of the State of Florida and the US federal laws that apply to it and, in addition, applies the same standards set out in this Policy and honours the rights described in section 8 for everyone whose data it processes. If you live in a country whose data protection law applies to the processing (for example, the United Kingdom or a European Union country), you retain the rights that law gives you, including the right to complain to your data protection authority.

This Policy applies to the personal data that Tucango processes as a controller, that is, when it decides why and how the data is used. In this Policy, "Tucango" means Tucango SpA or Tucango LLC, whichever is the controller under section 1. This includes:

• Visitors to the tucango.com website and its subdomains.
• People who contact us through forms, email, WhatsApp, social media, or other channels.
• B2B clients and prospects: representatives, contacts, and staff of companies or organisations that engage our services or are considering doing so.
• Subscribers to marketing communications or content (newsletters, updates, etc.).
• Applicants who send us their information to work or collaborate with us.
• Suppliers and their contacts.

Data of our clients' customers. When we provide services (for example, digital marketing, CRM, automations, integrations, hosting, or account management) and, to do so, process data from a client's databases (its own customers, leads, users, or contacts), Tucango acts as a processor on behalf of that client, which is the controller. In those cases, the processing is governed by the client's instructions, by our Terms and Conditions and, where applicable, by the data processing agreement signed with that client. If that data relates to you, we recommend that you first contact the company that is the controller; if you contact us, we will refer you to it or work with it to handle your request.

Depending on how you interact with us, we may process the following categories of data:

Form data in Google Analytics 4. If you accept analytics and advertising cookies (see section 9), Google Analytics 4 may automatically detect certain data you enter in the website's forms, such as your email address, phone number, or address, and send it to Google encrypted using a hash function, that is, converted into a code that does not reveal the original data. Google uses it to match the visit with Google accounts and thereby improve the accuracy of conversion measurement and reporting. If you do not accept those cookies, this feature is not activated.

Sensitive data. Tucango does not request sensitive data (for example, data concerning health, ethnic origin, political opinions, beliefs, sex life, or biometric data) through its website or its commercial channels. We ask that you do not include it in forms or messages. If we receive it without having requested it and it is not necessary, we will delete it.

Minors. Our services are intended for businesses and adults. We do not knowingly collect data from minors. If we discover that we have done so, we will delete it.

We only process personal data when there is a legal basis that allows it. The following table summarises the purposes and their legal basis:

Where processing is based on your consent, you may withdraw it at any time by writing to hola@tucango.com, without affecting the lawfulness of any processing carried out before the withdrawal. Where it is based on our legitimate interest, we have assessed that your rights and interests do not override it, and you may object as described in section 8.

We do not use your data to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

We do not sell your personal data.

We may share data with third parties only to the extent necessary for the purposes described:

a) Processors (service providers working for us). Providers that process data on Tucango's behalf and according to our instructions, subject to confidentiality and security obligations. For example:

• Providers of hosting, servers, cloud storage, and backups.
• Providers of email, productivity, and communication services.
• Web analytics and measurement tools.
• CRM, project management, and customer support tools.
• An email delivery system (newsletter), used to send marketing communications to those who have authorised them.
• Payment gateways and banking services.
• Accounting and electronic invoicing services, and legal or tax advisors.

b) Third-party services integrated into the website. Our website uses:

• Google Tag Manager (Google): management of the website's measurement and advertising tags.
• Google Analytics 4 (Google): web analytics; for example, pages visited, scrolling, clicks on external links, downloads, interaction with forms and videos, and the source of the visit.
• Google Ads (Google): measurement of the effectiveness of our ads (see letter c).
• Statistics from our hosting platform: measurement of visits and of the website's technical performance (for example, loading times).
• Cloudflare: website delivery and protection against bots and malicious traffic.
• YouTube (Google): playback of videos embedded in some blog articles.
• jsDelivr: content delivery network from which the map data on the About page is loaded.

These services may receive technical data such as your IP address, browser type, device, and operating system, and they are also governed by their own privacy policies, which we encourage you to review.

c) Advertising platforms and social media. If you interact with us through social media or ads (for example, on Meta or Google platforms), those platforms process data in accordance with their own policies. On our website, we also use Google Ads tags (Google), managed through Google Tag Manager, to measure the effectiveness of our ads: they store an identifier of the ad click (_gcl_* cookies) and record conversions, such as calls or contacts that originate from an ad. Our Google Analytics 4 account is linked to Google Ads and has Google signals enabled, which allows Google to associate activity on the website with users who are signed in to their Google account and have authorised it, in order to produce reports and advertising audiences (remarketing). These tags are not necessary for the website to work: they are only activated if you accept them in the cookie notice, and you may withdraw that consent at any time. We do not currently use pixels or remarketing tags from other advertising platforms or social networks (such as Meta, LinkedIn, or TikTok); if we add them, we will update this Policy and ask for your consent.

d) Authorities. When required by law, by a competent authority, or by a court order.

e) Corporate transactions. In the event of a merger, acquisition, or reorganisation of Tucango, data may be transferred to the successor entity, which must comply with this Policy.

f) Between Tucango SpA and Tucango LLC. Tucango SpA and Tucango LLC provide their services with the same team and share tools (for example, CRM, email, and invoicing systems). They may therefore share client and contact data with each other only to the extent necessary to provide the services, manage the business relationship, invoice and collect payments, and comply with legal obligations. Each company uses that data in accordance with this Policy and with the safeguards described in section 6.

Some of our providers and third-party services (for example, Google —Tag Manager, Analytics, Ads, and YouTube—, Cloudflare, jsDelivr, the website's hosting platform, and the email delivery system) may store or process data on servers located outside Chile, including in the United States and other countries.

When an international transfer takes place, we will seek to ensure that it is made:

• To countries that Chile's Personal Data Protection Agency (Agencia de Protección de Datos Personales) considers to provide an adequate level of protection; or
• With appropriate safeguards, such as contractual clauses or data protection terms offered by the provider; or
• In the other cases permitted by law, such as when the transfer is necessary to perform a contract with you or you have given your consent.

Transfers between Tucango SpA (Chile) and Tucango LLC (United States). As described in section 5, letter f, client and contact data may be transferred in both directions between Tucango SpA, in Chile, and Tucango LLC, in the United States. These transfers are made with the following safeguards and, from its entry into force, in accordance with Articles 27 and 28 of Chilean Law No. 19,628, as amended by Law No. 21,719:

• Tucango SpA and Tucango LLC undertake to enter into and maintain an international data transfer agreement between the two companies, based on the model contractual clauses for international transfers of personal data approved in Chile, before Law No. 21,719 comes into force. That agreement will require the company receiving the data to observe principles, rights, and safeguards equal to or higher than those of Chilean law, and will give you enforceable rights.
• The same data processing policies and security measures in both companies (see section 11), with access limited to the people who need the data for their work.
• The ability to exercise your rights (see section 8) with either company by writing to hola@tucango.com.

We keep data only for as long as our relationship with you lasts or as long as it is necessary for the purpose for which it was collected. After that, we only keep it for the periods required by law (for example, tax and accounting periods) or for as long as necessary to handle claims or to exercise or defend legal rights. As a guide:

You may request the deletion of your data at any time by writing to hola@tucango.com; we will honour your request unless the law requires us to keep the data. Once these periods have ended, the data is deleted or anonymised so that it can no longer be linked to you.

As a data subject, you have the right to:

• Access: find out whether we process your data and obtain information about it and how it is processed.
• Rectification: correct data that is inaccurate, outdated, or incomplete.
• Erasure: ask us to delete your data where applicable (for example, if it is no longer necessary or you have withdrawn your consent).
• Objection: object to certain processing, including processing based on legitimate interest and processing for direct marketing purposes.
• Portability: receive the data you provided to us in a structured, commonly used, and machine-readable format, and ask for it to be transmitted to another controller where technically feasible.
• Blocking: request the temporary suspension of processing while a request for rectification, erasure, or objection is being resolved, or in the other cases provided by law.
• Not to be subject to automated decisions that significantly affect you, under the terms of the law.
• Withdraw your consent at any time, where processing is based on it.

How to exercise them. Send an email to hola@tucango.com including:

1. Your name and a means of verifying your identity (or that of your representative, together with the corresponding power of attorney).
2. The right you wish to exercise and a clear description of your request.
3. An email address or postal address where we can reply to you.

Exercising your rights is free of charge, except in the exceptional cases permitted by law. We will respond within the period established by law, currently 30 calendar days from receipt of the request, which may be extended once for an equal period when necessary, in which case we will inform you.

Complaints to the Agency. If your request is denied, is not answered within the deadline, or you are not satisfied with the response, you may file a complaint with Chile's Personal Data Protection Agency (Agencia de Protección de Datos Personales), following the procedure established by law, without prejudice to any other actions that may be available to you. If you deal with Tucango LLC and live outside Chile, you may also complain to the data protection authority in your country, where your law allows it.

Unsubscribing from marketing communications. All of our marketing emails include a link or instructions to unsubscribe. You may also request this at any time by writing to hola@tucango.com.

What are they? Cookies are small files that a website stores in your browser to remember information about your visit. We also use similar technologies, such as third-party tags or scripts.

What types do we use?

How can you manage them? The first time you visit the website, you will see a cookie notice with three options: Accept all; Essential only, under which we only use technical or necessary cookies; and Configure, which lets you separately enable or disable analytics, advertising, and third-party content cookies. Until you choose an option, we only use technical or necessary cookies. You can change your preferences at any time through the "Cookies" link in the website footer. You can also delete or block cookies in your browser settings; if you do, some features of the website may not work properly.

• Website forms: the data you enter (for example, your name, email address, phone number, company, and message) is used to respond to your enquiry and, where appropriate, to prepare a proposal. Submitting a form does not mean that you agree to receive marketing communications; for that purpose, the contact form includes an optional consent tick box, which is not ticked by default, and we will only send you promotional content if you tick it.
• WhatsApp and social media: if you write to us through these channels, we will process your phone number, profile name, and the content of the conversation in order to assist you. These services are provided by third parties and are also governed by their own policies.
• Email marketing: we only send marketing communications and promotional content to those who ticked the optional consent tick box on the contact form. When you tick it, your contact details (such as your name and email address) are added to our email delivery system (newsletter), from which we send you those communications. Every email includes an unsubscribe link, and you may also unsubscribe at any time by writing to hola@tucango.com.

We apply reasonable technical and organisational measures, proportionate to the risk, to protect your data against unauthorised access, loss, alteration, or disclosure. These include role-based access control, encrypted connections (HTTPS), backups, system updates, and confidentiality obligations for our team and providers.

No system is completely infallible. If a security incident affecting your personal data occurs and poses a risk, we will notify the Personal Data Protection Agency and, where applicable, the affected individuals, in accordance with the law.

Our website may contain links to third-party websites. When you click on them and leave our website, we no longer have control over the processing of your data on those websites, which are governed by their own privacy policies. We encourage you to review them.

We may update this Policy to reflect changes in the law, in our services, or in our practices. We will publish the new version on this page, with its date and version number. If the changes are significant, we will inform you through appropriate means (for example, a notice on the website or an email to our clients) and, where required by law, we will ask for your consent again.

If you have questions about this Policy or about the processing of your data, or if you wish to exercise your rights, please write to us at hola@tucango.com:

Tucango SpA
Tax ID (RUT) 76.592.882-6
Los Laureles 075, 2nd floor, Valdivia, Chile (this address is not open to the public)
Privacy and exercise of rights: hola@tucango.com
General contact: hola@tucango.com
Business hours: Monday to Friday, 9:00 to 18:00 (Chile time)

Tucango LLC
A limited liability company organised under the laws of the State of Florida, USA
7901 4th Street North, STE 300, St. Petersburg, FL 33702, USA (this address is not open to the public)
Privacy and exercise of rights: hola@tucango.com