In short
We explain what personal data we process, why, and how to exercise your rights. The essentials: we do not use personal data or email content to train artificial intelligence models, we do not sell data, and measurement and advertising cookies are only activated if you accept them (Cookie policy). When we analyze a server's email, we do so on behalf of our customer, who is the controller of that data. This is a translation for convenience; if there is any difference, the Spanish version prevails.
1. Controller
Clisec Internet Ltda., tax ID (RUT) 77.772.204-2, address at Los Maquis 14, San Miguel, Ñuble Region, Chile.
For any privacy question or to exercise your rights: privacidad@clisec.cl. The data protection officer duties are carried out by Clisec's legal representatives, who can be reached at the same address.
2. Who this policy applies to
| If you are… | Clisec's role | Applicable document |
|---|---|---|
| A website visitor or someone who contacts us | Controller | This policy |
| A customer (account, billing, support) | Controller | This policy |
| A user of an email account protected by Clisec | Processor, on behalf of your hosting provider or company | That provider's privacy policy and our Data processing agreement |
| A person whose data appears in threat intelligence | Controller | This policy, section 9 |
3. What data we process, why, and on what legal basis
Legal bases follow article 13 of Chilean Law 19.628, as amended by Law 21.719, and article 6 of the GDPR.
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, company, number of servers and message from the contact form | Reply to your inquiry and, if you ask, prepare a proposal | Pre-contractual steps at your request |
| Customer account, billing and support data | Provide the Service, invoice and give support | Performance of the contract and legal obligations, including tax obligations |
| Cloudflare Turnstile verification result and IP address when submitting forms | Protect forms against bots and abuse | Legitimate interest in website security |
| Website technical logs (IP, browser, date and time) | Security, fraud prevention and operation of the website | Legitimate interest in network and information security |
| Measurement and advertising cookies (Google Tag Manager, Google Analytics, Google Ads) | Measure website use and campaign performance | Your consent, which you can withdraw at any time |
| Threat indicators (IPs, domains, URLs, hashes, email addresses used in attacks) | Detect and block attacks for all our customers | Legitimate interest in network and email security (GDPR recital 49) |
Where we rely on legitimate interest, we have assessed that the processing is necessary and proportionate and does not override your rights. You can object to it (section 8).
4. Artificial intelligence and automated decisions
We do not use personal data or email content to train artificial intelligence models, our own or third parties', nor to build commercial or advertising profiles.
The Service automatically decides whether an incoming email is delivered, quarantined or rejected, based on technical risk signals. That decision applies to messages, does not evaluate people, and can always be reviewed: the customer and its users can release messages from quarantine, and any affected sender can request human review (section 9).
5. Who we share data with
We do not sell or rent personal data. We only share it with providers that help us deliver the Service, under contract and with confidentiality and security obligations:
| Provider | Purpose | Country |
|---|---|---|
| Clisec's own cloud | Host and process email analysis | Chile |
| Google Cloud | Host clisec.cl | Chile |
| Cloudflare | Website security and Turnstile verification | United States and global network |
| Google (Tag Manager, Analytics, Ads) | Measurement and advertising, only with your consent | United States |
| Transbank (Webpay) | Process payments | Chile |
| Google Cloud | Send email replies and notices | Chile |
| Cyber threat intelligence providers | Check the reputation of technical indicators (URLs, domains, hashes). Email content is not sent to them | Mainly Chile and the United States |
We may also disclose data when required by law or a competent authority, such as the Chilean Personal Data Protection Agency, the ANCI or the courts.
6. International transfers
The Service's email analysis runs on Clisec's own cloud in Chile, and the website is hosted on Google Cloud in Chile. Some website providers, such as Google Tag Manager, Google Analytics, Google Ads and Cloudflare, and some cyber threat intelligence providers we query, may process data outside Chile, mainly in the United States. Only technical indicators are sent to the latter, never email content. We only transfer data to countries with an adequate level of protection or with sufficient safeguards, such as standard contractual clauses, under Law 21.719 and, for EU data, the standard contractual clauses approved by the European Commission or the EU-US Data Privacy Framework where the provider is certified.
7. How long we keep data
| Data | Period |
|---|---|
| Contact form inquiries that do not lead to a contract | 12 months from the last contact |
| Customer data | For the duration of the contract and until legal claims are time-barred |
| Tax documents | 6 years, under the Chilean Tax Code |
| Website technical logs | 90 days |
| Service quarantine | 15 days. Only emails verified as malicious are held |
| Service filtering logs | 15 days |
| Threat indicators | While still useful for detection; reviewed and discarded periodically |
| Cookies | See the Cookie policy |
8. Your rights and how to exercise them
You may at any time exercise your rights of access, rectification, erasure, objection, portability and blocking, and not to be subject to decisions based solely on automated processing that significantly affect you.
- Write to privacidad@clisec.cl stating which right you want to exercise and a way to verify your identity.
- It is free. We reply within 30 calendar days, extendable once by another 30 if the request is complex, letting you know beforehand.
- If your data is in an email account protected by Clisec, your request should go to your provider or company. If it reaches us, we will forward it and help them respond.
- If you are not satisfied with our answer, you can complain to the Chilean Personal Data Protection Agency and, if you live in the European Union, to your country's supervisory authority.
9. If your address, domain or IP was flagged as a threat
If you believe your email address, domain or IP was classified by mistake and your messages are being blocked, write to privacidad@clisec.cl with the affected address and an example of the rejection. A person on our team will review the case and, if appropriate, correct the classification and inform the original source where possible.
11. Security
We apply technical and organizational measures proportionate to the risk: encryption in transit, least-privilege access control, audit logs, separation of data between customers and supplier review. If a security breach affects personal data, we will report it to the Chilean Personal Data Protection Agency without undue delay and to the people affected when the law requires it.
12. Minors
Our website and Service are aimed at businesses and professionals. We do not knowingly collect data from people under 18.
13. Changes to this policy
We will publish any change on this page with its update date. If the change is relevant, we will notify our customers by email or through a notice on the website.
Related documents: Terms and conditions of service · Cookie policy · Data processing agreement