Personal Data Processing Policy

Version of 5 September 2026

1. General provisions

This Policy sets out how personal data of individuals who use the chilehome.me website is processed and protected.

The Policy has been drawn up pursuant to clause 2 of part 1 of article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” of the Russian Federation and takes into account the requirements of Law No. 21.719 of the Republic of Chile on the protection of personal data, which comes into force on 1 December 2026.

Services on the chilehome.me website are provided jointly by a Russian and a Chilean party, which jointly determine the purposes and the content of the processing of personal data and therefore act as Operators within the meaning of clause 2 of article 3 of Federal Law No. 152-FZ. Both Operators are named in section 2.

The chilehome.me website is addressed, among others, to residents of the Russian Federation, and the requirements of Russian law therefore apply to the processing of personal data.

The Policy covers all personal data that the Operators receive from visitors of the chilehome.me website in its Russian, English and Chinese versions.

By using the website and submitting an enquiry through the contact form, the visitor confirms that they have read this Policy.

2. Operators of personal data

Personal data is processed jointly by:

Hereinafter jointly referred to as the Operators. A single address for enquiries concerning the processing of personal data: info@waveris.co. An enquiry sent to that address is deemed to have been received by both Operators.

Obligations imposed by the law of the Russian Federation — notification of the supervisory authority, localisation of databases, responses to requests from data subjects located in the Russian Federation — are performed by the Operator in the Russian Federation. Obligations imposed by Law No. 21.719 of the Republic of Chile are performed by the Operator in the Republic of Chile.

3. Key definitions

• Personal data — any information relating to a directly or indirectly identified or identifiable individual.
• Processing of personal data — any operation with personal data: collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer, depersonalisation, blocking, erasure, destruction.
• Data subject — the individual to whom the personal data relates. For the purposes of this Policy, a visitor of the website who has submitted an enquiry.
• Operator — a person who, alone or jointly with others, determines the purposes and the content of the processing of personal data. The Operators of this website are named in section 2.

4. What data the Operators collect

The Operators process the data that the data subject provides about themselves when filling in the contact form on the website:

• name;
• phone number;
• email address;
• city or country of residence, where the form contains such a field;
• preferred means of contact — WhatsApp, Telegram or a phone call;
• the content of the enquiry, where the data subject has set it out.

In addition, depersonalised data about the visit is collected automatically — cookies, IP address, device and browser type, referral source, pages viewed. The counters and advertising pixels used on the website are listed in section 13.

The Operators do not process special categories of personal data — racial or ethnic origin, political opinions, religious beliefs, state of health, sex life — nor biometric personal data.

The Operators do not knowingly collect personal data of minors. If such data is received, it is erased upon request of a legal representative.

5. Purposes of processing

The Operators process personal data solely for the following purposes:

1. contacting the data subject in response to their enquiry: advice on residence, permanent residence and citizenship programmes, on real estate and related services, answering a question, arranging a meeting;
2. preparing and sending a commercial offer and presentation materials for the service requested;
3. concluding and performing a service agreement, should the parties enter into one;
4. measuring the performance of advertising campaigns in depersonalised form;
5. compliance with statutory requirements.

The Operators do not use personal data for automated decision-making producing legal effects for the data subject.

The Operators do not send marketing communications on the basis of this Policy. Such communications are possible only with a separate consent of the data subject, given by a separate affirmative action.

6. Legal bases of processing

• consent of the data subject to the processing of their personal data — clause 1 of part 1 of article 6 of Federal Law No. 152-FZ, given by a specific affirmative action, namely by ticking the box in the contact form;
• necessity for the performance of a contract to which the data subject is a party, or for taking steps at their request prior to entering into a contract — clause 5 of part 1 of article 6 of Federal Law No. 152-FZ;
• compliance with obligations imposed on the Operators by law;
• for visitors located in the Republic of Chile — consent of the data subject and performance of a contract within the meaning of article 12 of Law No. 21.719.

7. Procedure and conditions of processing

Personal data is processed both by automated means and without the use of such means.

The Operators ensure that the recording, systematisation, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation is carried out using databases located in the territory of the Russian Federation, in accordance with part 5 of article 18 of Federal Law No. 152-FZ. The Operator in the Russian Federation is responsible for compliance with this requirement.

The chilehome.me website and its database are hosted on the servers of the hosting provider Beget LLC located in the territory of the Russian Federation. The corporate email of the Operators is served by Microsoft 365 (Microsoft Corporation, USA).

8. Recipients of the data

The Operators do not sell personal data and do not transfer it to third parties for those parties’ own purposes.

Personal data may be transferred to the following categories of recipients, solely to the extent necessary for the purposes set out in section 5:

The Operators exchange personal data between themselves to the extent necessary for the purposes set out in section 5. Such an exchange is not a transfer to a third party, but it does constitute a cross-border transfer and is described in section 9.

Personal data is transferred to persons engaged by the Operators for processing on the basis of an agreement containing an instruction to process personal data and an obligation to maintain confidentiality and comply with data protection requirements.

9. Cross-border transfer

The Operators carry out cross-border transfers of personal data to the territory of the following states:

• the Republic of Chile — to the Operator in the Republic of Chile named in section 2;
• Ireland and the United States of America — when Facebook Pixel is used;
• the United States of America — when Google services are used;
• the United States of America — for the operation of Microsoft 365 corporate mail.

These states are not included in the list of foreign states providing adequate protection of the rights of personal data subjects. The Operator in the Russian Federation notifies the authority responsible for the protection of the rights of personal data subjects of such transfers in accordance with part 4 of article 12 of Federal Law No. 152-FZ before the transfer begins.

Personal data is transferred to the extent set out in the table in section 8 subject to the consent of the data subject and, as regards advertising and analytics services, only after consent to the use of the corresponding cookies has been obtained (section 13).

10. Retention periods

Personal data is processed no longer than is required for the purposes of the processing.

• where no contract is concluded — 3 years from the date of the data subject’s last enquiry, after which the data is destroyed;
• where a contract is concluded — for the term of the contract and 5 years after its performance, unless a longer period is prescribed by law;
• where consent is withdrawn — processing ceases and the data is destroyed within 30 days of receipt of the withdrawal, except where the law obliges the Operators to continue storing it;
• depersonalised web analytics data is retained for the periods set by the relevant service.

Achievement of the purpose of processing, expiry of the retention period or withdrawal of consent entail the destruction of the personal data.

11. Rights of the data subject

The data subject has the right to:

• obtain information about the processing of their personal data: the legal bases and purposes, the methods applied, the periods, the list of data processed and its source, and the names of the persons to whom the data is transferred;
• require that their personal data be updated, blocked or destroyed where it is incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose;
• withdraw consent to the processing of personal data;
• object to the processing;
• appeal against the acts or omissions of the Operators to Roskomnadzor or in court.

How to exercise these rights. Send an enquiry to info@waveris.co, stating the name, phone number or email address provided at the time of the enquiry, and the substance of the request. The Operators consider the enquiry and respond within 30 days of receipt at the latest.

Withdrawal of consent. Consent is withdrawn in the same way — by an email to info@waveris.co stating that the data subject withdraws consent to the processing of their personal data. No justification is required.

12. Rights of data subjects located in the Republic of Chile

From 1 December 2026, data subjects located in the Republic of Chile additionally have the rights provided for by Law No. 21.719 (ARCO+ rights):

• the right of access to their personal data;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure of the data;
• the right to object to processing, including processing for direct marketing purposes;
• the right to data portability — to receive the data in a structured, machine-readable format;
• the right not to be subject to a decision based solely on automated processing.

Requests are to be sent to info@waveris.co. The Operator in the Republic of Chile responds within the period set by Law No. 21.719. The data subject has the right to lodge a complaint with the Personal Data Protection Agency of the Republic of Chile.

13. Cookies and web analytics

The following categories of cookies are used on the chilehome.me website:

• essential — required for the site to work: keeping the visitor’s session, the selected language version, and service parameters of the content management system. They are set without consent because the site does not work without them;
• analytics — Yandex Metrica (counter No. 98196065). They collect depersonalised data about the visit: referral source, pages viewed, time on site, device type;
• advertising — Facebook Pixel (No. 1715653359028675) and Google Ads (conversion ID AW-943952506). They make it possible to measure advertising performance, to track conversions and to build advertising audiences;
• tag management — Google Tag Manager (container GTM-5DZ9JQTF), through which analytics and advertising services are loaded;
• security — Google reCAPTCHA, used to protect forms against automated submissions.

Analytics and advertising cookies are set only after the visitor’s consent, given through the consent banner shown on the first visit. Consent can be changed or withdrawn at any time through the same banner, and also by disabling cookies in the browser settings. Disabling essential cookies may cause certain functions of the site to work incorrectly.

14. Data protection measures

The Operators take legal, organisational and technical measures to protect personal data against unlawful access, destruction, alteration, blocking, copying and dissemination:

• appointment of a person responsible for organising the processing of personal data;
• limiting access to personal data to those employees who need it for their work;
• use of an encrypted HTTPS connection when data is transmitted from the site;
• storage of data in information systems with access rights segregation;
• confidentiality undertakings for persons admitted to the processing.

15. Notification of incidents

In the event of an unlawful transfer of personal data or unlawful access to it, the Operator in the Russian Federation notifies the authority responsible for the protection of the rights of personal data subjects within the periods set by part 3.1 of article 21 of Federal Law No. 152-FZ: within 24 hours of the incident itself, and within 72 hours of the results of the internal investigation.

In respect of data subjects located in the Republic of Chile, notification is sent to the Personal Data Protection Agency within the period set by Law No. 21.719.

16. Changes to the Policy

The Operators may amend this Policy. The current version is always published on the chilehome.me website on a separate page linked from every page of the site.

The date of the version is stated at the beginning of the document.