Personal Data Processing Policy

Version 1.2 · Effective from 24 September 2026

1. General provisions

This Policy sets out how personal data of individuals who use the chilehome.me website is processed and protected.

The Policy has been drawn up pursuant to clause 2 of part 1 of article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” of the Russian Federation and takes into account the requirements of Law No. 21.719 of the Republic of Chile on the protection of personal data, which comes into force on 1 December 2026.

The purposes and the content of the processing of personal data on the chilehome.me website are determined by a single person — the Operator within the meaning of clause 2 of article 3 of Federal Law No. 152-FZ. The Operator is named in section 2. Services in the territory of the Republic of Chile are provided by a Chilean company, which receives personal data from the Operator to the extent necessary for the provision of the service and is named in section 8 as a recipient of the data.

The chilehome.me website is addressed, among others, to residents of the Russian Federation, and the requirements of Russian law therefore apply to the processing of personal data.

The Policy covers all personal data that the Operator receive from visitors of the chilehome.me website in its Russian, English and Chinese versions.

By using the website and submitting an enquiry through the contact form, the visitor confirms that they have read this Policy.

2. Operator of personal data

Hereinafter referred to as the Operator. Address for enquiries concerning the processing of personal data: info@waveris.co.

The Operator performs the obligations imposed by the law of the Russian Federation: notification of the supervisory authority, localisation of databases, responses to requests from data subjects.

Services in the territory of the Republic of Chile are provided by CHILE HOME SPA, RUT 77.853.258-1, address: 13 Norte 853, of. 803, Viña del Mar, Chile. The Operator transfers to that company personal data to the extent necessary for the provision of the service. The company is named in section 8 as a recipient, and the transfer is described in section 9.

Representative of the Operator in the Republic of Chile within the meaning of Article 1 bis and Article 14 of Law No. 21.719: CHILE HOME SPA, RUT 77.853.258-1, address: 13 Norte 853, of. 803, Viña del Mar, Chile. E-mail for requests: info@waveris.co. This entity is authorised to receive notices from the Personal Data Protection Agency and from data subjects.

CHILE HOME SPA acts as a processor (encargado) within the meaning of Article 15 bis of Law No. 21.719. It processes personal data strictly on the Operator’s instructions and under a data processing agreement (comisión de tratamiento). The processor is bound by confidentiality and security obligations to the same extent as the Operator.

3. Key definitions

• Personal data — any information relating to a directly or indirectly identified or identifiable individual.
• Processing of personal data — any operation with personal data: collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer, depersonalisation, blocking, erasure, destruction.
• Data subject — the individual to whom the personal data relates. For the purposes of this Policy, a visitor of the website who has submitted an enquiry.
• Operator — a person who determines the purposes and the content of the processing of personal data. The Operator of this website is named in section 2.

4. What data the Operator collects

The Operator processes the data that the data subject provides about themselves when filling in the contact form on the website:

• name;
• phone number;
• email address;
• city or country of residence, where the form contains such a field;
• preferred means of contact — WhatsApp, Telegram or a phone call;
• the content of the enquiry, where the data subject has set it out.

Data added at the contract stage. Where the data subject enters into a service agreement, the following is additionally processed in order to prepare and perform it and to file documents with the competent authorities:

• date and place of birth, citizenship;
• internal passport of the Russian Federation: series, number, date of issue, issuing authority, subdivision code;
• international passport: number, date of issue, period of validity;
• birth certificate, where the service is provided in respect of a minor;
• registered address and actual address of residence;
• SNILS and TIN (INN);
• bank details for settlements under the agreement.

This data is processed on the basis of clause 5 of part 1 of article 6 of Federal Law No. 152-FZ — performance of a contract to which the data subject is a party — and solely to the extent necessary for the provision of the service.

In addition, depersonalised data about the visit is collected automatically — cookies, IP address, device and browser type, referral source, pages viewed. The counters and advertising pixels used on the website are listed in section 13.

The Operator does not process special categories of personal data — racial or ethnic origin, political opinions, religious beliefs, state of health, sex life — nor biometric personal data.

The Operator processes personal data of minors where the service is provided in their interests (obtaining citizenship, preparing documents). Such processing is carried out only with the consent of a parent or other legal representative of the minor (Article 9 of Federal Law No. 152-FZ of 27 July 2006; Article 16 quater of Law of the Republic of Chile No. 21.719). Processing is carried out in the best interests of the child, taking into account the principle of the progressive autonomy of the minor. By giving consent, the legal representative confirms their status and full authority to act on behalf of the minor.

5. Purposes of processing

The Operator processes personal data solely for the following purposes:

1. contacting the data subject in response to their enquiry: advice on residence, permanent residence and citizenship programmes, on real estate and related services, answering a question, arranging a meeting;
2. preparing and sending a commercial offer and presentation materials for the service requested;
3. concluding and performing a service agreement, should the parties enter into one;
4. measuring the performance of advertising campaigns in depersonalised form;
5. compliance with statutory requirements.

The Operator does not use personal data for automated decision-making producing legal effects for the data subject.

The Operator does not send marketing communications on the basis of this Policy. Such communications are possible only with a separate consent of the data subject, given by a separate affirmative action.

6. Legal bases of processing

• consent of the data subject to the processing of their personal data — clause 1 of part 1 of article 6 of Federal Law No. 152-FZ, given by a specific affirmative action, namely by ticking the box in the contact form;
• necessity for the performance of a contract to which the data subject is a party, or for taking steps at their request prior to entering into a contract — clause 5 of part 1 of article 6 of Federal Law No. 152-FZ;
• compliance with obligations imposed on the Operator by law;
• for visitors located in the Republic of Chile — consent of the data subject and performance of a contract within the meaning of article 12 of Law No. 21.719.

7. Procedure and conditions of processing

Personal data is processed both by automated means and without the use of such means.

The Operator ensures that the recording, systematisation, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation is carried out using databases located in the territory of the Russian Federation, in accordance with part 5 of article 18 of Federal Law No. 152-FZ. The Operator is responsible for compliance with this requirement.

The chilehome.me website and its database are hosted on the servers of the hosting provider Beget LLC located in the territory of the Russian Federation. The corporate email of the Operator is served by Yandex 360 (Yandex LLC, Russian Federation).

8. Recipients of the data

The Operator does not sell personal data and does not transfer it to third parties for those parties’ own purposes.

Personal data may be transferred to the following categories of recipients, solely to the extent necessary for the purposes set out in section 5:

The transfer of personal data to CHILE HOME SPA is a cross-border transfer and is described in section 9. That company processes the data on the Operator’s instruction, for the purposes set out in section 5, and does not determine the purposes of the processing on its own.

Personal data is transferred to persons engaged by the Operator for processing on the basis of an agreement containing an instruction to process personal data and an obligation to maintain confidentiality and comply with data protection requirements.

9. Cross-border transfer

The Operator carries out cross-border transfers of personal data to the territory of the following states:

• the Republic of Chile — to CHILE HOME SPA, named in section 8;
• the United States of America — when Google services are used.

These states are not included in the list of foreign states providing adequate protection of the rights of personal data subjects. The Operator notifies the authority responsible for the protection of the rights of personal data subjects of such transfers in accordance with part 4 of article 12 of Federal Law No. 152-FZ before the transfer begins.

Personal data is transferred to the extent set out in the table in section 8 subject to the consent of the data subject and, as regards advertising and analytics services, only after consent to the use of the corresponding cookies has been obtained (section 13).

For data subjects located in the Republic of Chile, international transfers of personal data are made on the basis of: the performance of a contract between the data subject and the controller, or pre-contractual steps taken at the data subject’s request (Article 27, paragraph 5, of Law No. 21.719); the data subject’s consent (Article 27, paragraph 1, of Law No. 21.719). Until the Agency publishes its list of countries with an adequate level of protection, the Operator and CHILE HOME SPA ensure appropriate safeguards for transferred personal data through contractual terms containing confidentiality, security and purpose-limitation obligations.

10. Retention periods

Personal data is processed no longer than is required for the purposes of the processing.

• where no contract is concluded — 12 months from the date of the data subject’s last enquiry, after which the data is destroyed;
• where a contract is concluded — for the term of the contract and 5 years after its performance, unless a longer period is prescribed by law;
• where consent is withdrawn — processing ceases and the data is destroyed within 30 days of receipt of the withdrawal, except where the law obliges the Operator to continue storing it;
• depersonalised web analytics data is retained for the periods set by the relevant service.

Achievement of the purpose of processing, expiry of the retention period or withdrawal of consent entail the destruction of the personal data.

11. Rights of the data subject

The data subject has the right to:

• obtain information about the processing of their personal data: the legal bases and purposes, the methods applied, the periods, the list of data processed and its source, and the names of the persons to whom the data is transferred;
• require that their personal data be updated, blocked or destroyed where it is incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose;
• withdraw consent to the processing of personal data;
• object to the processing;
• appeal against the acts or omissions of the Operator to Roskomnadzor or in court.

How to exercise these rights. Send an enquiry to info@waveris.co, stating the name, phone number or email address provided at the time of the enquiry, and the substance of the request. The Operator considers the enquiry and sends a response within 10 (ten) working days of its receipt (Part 1 of Article 20 of Federal Law No. 152-FZ). For data subjects located in the Republic of Chile, the response is provided within the period set by Law No. 21.719 and the regulations of the Personal Data Protection Agency.

Withdrawal of consent. Consent is withdrawn in the same way — by an email to info@waveris.co stating that the data subject withdraws consent to the processing of their personal data. No justification is required.

12. Rights of data subjects located in the Republic of Chile

From 1 December 2026, data subjects located in the Republic of Chile additionally have the rights provided for by Law No. 21.719 (ARCO+ rights):

• the right of access to their personal data;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure of the data;
• the right to request suspension (blocking) of the processing of personal data while a request for rectification, erasure or objection is being considered (derecho de bloqueo, Article 8 ter of Law No. 21.719);
• the right to object to processing, including processing for direct marketing purposes;
• the right to data portability — to receive the data in a structured, machine-readable format;
• the right not to be subject to a decision based solely on automated processing.

Requests are to be sent to info@waveris.co. The Operator, together with CHILE HOME SPA, responds within the period set by Law No. 21.719. The data subject has the right to lodge a complaint with the Personal Data Protection Agency of the Republic of Chile.

13. Cookies and web analytics

The following categories of cookies are used on the chilehome.me website:

• essential — required for the site to work: keeping the visitor’s session, the selected language version, and service parameters of the content management system. They are set without consent because the site does not work without them;
• analytics — Yandex Metrica (counter No. 98196065). They collect depersonalised data about the visit: referral source, pages viewed, time on site, device type;
• advertising — Google Ads (conversion ID AW-943952506). They make it possible to measure advertising performance, to track conversions and to build advertising audiences;
• tag management — Google Tag Manager (container GTM-5DZ9JQTF), through which analytics and advertising services are loaded;
• security — Google reCAPTCHA, used to protect forms against automated submissions.

Analytics and advertising cookies are set only after the visitor’s consent, given through the consent banner shown on the first visit. Consent can be changed or withdrawn at any time through the same banner, and also by disabling cookies in the browser settings. Disabling essential cookies may cause certain functions of the site to work incorrectly.

Legal basis. Information collected by analytics and advertising services (including the visitor’s IP address) is personal data within the meaning of Federal Law No. 152-FZ of 27 July 2006 and Law of the Republic of Chile No. 21.719 (Article 2(f)). For visitors located in the Russian Federation, the legal basis for setting analytics and advertising cookies is the data subject’s consent given through the consent banner (Clause 1 of Part 1 of Article 6 of Federal Law No. 152-FZ). For visitors located in the Republic of Chile, the legal basis is the data subject’s free, informed and specific consent within the meaning of Article 12 of Law No. 21.719, expressed by an affirmative action in the consent banner on the first visit to the site. Until such consent is given, analytics and advertising cookies are not set and no data is transferred.

14. Data protection measures

The Operator takes legal, organisational and technical measures to protect personal data against unlawful access, destruction, alteration, blocking, copying and dissemination, in accordance with Article 19 of Federal Law No. 152-FZ:

• appointment of a person responsible for organising the processing of personal data;
• limiting access to personal data to those employees who need it for their work;
• use of an encrypted HTTPS connection when data is transmitted from the site;
• storage of data in information systems with access rights segregation;
• confidentiality undertakings for persons admitted to the processing.

In respect of data subjects located in the Republic of Chile, the Operator additionally applies the principle of data protection by design and by default (protección por diseño y por defecto) under Article 14 quater of Law of the Republic of Chile No. 21.719: technical and organisational measures are put in place before processing begins and remain in effect throughout, taking into account the state of the art, the cost of implementation, the nature, scope and purposes of processing, and the risks to data subjects’ rights. These measures include, where possible, pseudonymisation and encryption of personal data, the ability to restore access to data in the event of a technical incident, and regular assessment of the effectiveness of the measures taken (Article 14 quinquies of Law No. 21.719).

The Operator carries out a data protection impact assessment (DPIA) where processing is likely to result in a high risk to the rights and freedoms of data subjects, in accordance with Article 15 ter of Law No. 21.719.

The person responsible for organising the processing of personal data under Clause 1 of Part 1 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 is the Operator itself — Individual Entrepreneur Aleksandr Sergeevich Lukianov. Enquiries concerning the processing of personal data should be sent to info@waveris.co.

The position of Data Protection Officer within the meaning of Article 49 of Law of the Republic of Chile No. 21.719 is not provided for. When adopting a compliance programme (modelo de prevención de infracciones) under that Law, the Operator undertakes to appoint such a person and to disclose their contact details in this Policy.

15. Notification of incidents

In the event of an unlawful transfer of personal data or unlawful access to it, the Operator notifies the authority responsible for the protection of the rights of personal data subjects within the periods set by part 3.1 of article 21 of Federal Law No. 152-FZ: within 24 hours of the incident itself, and within 72 hours of the results of the internal investigation.

In respect of data subjects located in the Republic of Chile, notification is sent to the Personal Data Protection Agency within the period set by Law No. 21.719.

Where an incident affects sensitive personal data, data of minors or financial data of data subjects located in the Republic of Chile, the Operator and/or CHILE HOME SPA also notify the affected data subjects in clear and plain language of the nature of the incident, its possible consequences and the measures taken to remedy it and prevent its recurrence (Article 14 sexies of Law No. 21.719).

16. Changes to the Policy

The Operator may amend this Policy. The current version is always published on the chilehome.me website on a separate page linked from every page of the site.

The date of the version is stated at the beginning of the document.