Privacy and cookies
What data this website processes, why, how long it keeps it and how to exercise your rights.
In short
- We only process the data needed to run and protect the website.
- There is no analytics, advertising, contact form or user registration.
- The Intranet uses one strictly necessary cookie and a personal password for each user.
- We only use artificial intelligence to organise internal documents, and no profiles are built. To exercise your rights, write to [email protected].
01Scope and controller
This policy covers edificiorosarionorte.cl, its English (/en/), Korean (/ko/), Greek (/el/), French (/fr/) and German (/de/) versions and the Intranet (/intranet/). The data controller is the owner of Edificio Rosario Norte, who can be contacted at [email protected]. Compliance officer: not appointed.
02Management and contact
CBRE Chile manages the building. Vector Cero SpA develops and maintains the website and its hosting, and receives requests on behalf of the controller, who decides which documents are published and authorises corrections and deletions. For enquiries, security incidents and data requests, write to [email protected].
03What data we process and why
You do not need to register or provide any data to visit this website.
| Data | Whose | Purpose | Legal basis | How long |
|---|---|---|---|---|
| IP address, date and time, page requested and browser | Visitors | Running, troubleshooting and protecting the server | Legitimate interest in keeping the website running and secure | 30 days on our server |
| Hash of the IP address after failed attempts | Anyone trying to log in to the Intranet | Preventing attacks: 15-minute block after 5 failures | Legitimate interest in security | Until the block expires or login succeeds |
| rn_intranet session cookie | Intranet users | Keeping the authorised session open | Legitimate interest in access control | Until the browser closes; 2 hours idle or 12 hours at most |
| Name, email address, companies whose energy reports the user may see, password hash and links to create or reset the password | Intranet users | Providing personal access, sending a link to choose the password when the account is created and, on request, another to reset it | Legitimate interest in access control | While the person has access; the welcome link is valid until it is used, and reset links expire after 30 minutes |
| Names, contact details and professional or billing information contained in internal documents | People named in those documents | Managing the building and allowing authorised access | Legitimate interest in managing the building, and compliance with legal and contractual obligations | While needed to manage the building and, afterwards, for the statutory retention periods |
| Name, contact details, request and reply | Anyone exercising their rights | Handling the request and evidencing the reply | Legal obligation | 1 year after the reply |
We do not rely on your consent, so there is no consent to withdraw; you can, however, object to the processing (section 09).
04Sources and recipients
The data comes from the technical requests made by your browser, from documents the controller authorises for the Intranet and from emails you send us. Intranet accounts are requested by the building management (CBRE Chile), which indicates who should have access and which company they belong to.
Depending on their role, the following may access it:
- The controller and building management (CBRE Chile).
- Authorised staff of Vector Cero SpA, which maintains the website.
- HostGator, which hosts the server in the United States.
- Cloudflare, Inc., which protects and speeds up the website: all traffic passes through its network before reaching the server.
- Google (YouTube), only if you press “play” on a video.
We do not sell or share personal data. We will only disclose it to an authority when required by law or by a court.
05Intranet
Each authorised person signs in with their email address and a personal password, which they can change or reset from the Intranet; the password is stored only as an encrypted hash that cannot be reversed. There are no records identifying who downloads a file. The documents —about 1,100: consumption reports by company, invoices, reports, rules, the emergency plan, plans and supplier reports— are stored outside the public part of the server and only delivered with a valid session. Each company’s energy consumption reports can only be seen by people from that company and by building management; all other documents are available to every authorised person.
07How we protect the data
- Encrypted connection (HTTPS) across the whole website.
- The website only loads its own content; there are no third-party scripts.
- Protection against cross-site request forgery (CSRF) and against embedding the website in other pages.
- Passwords stored only as an irreversible hash (PBKDF2-SHA256).
- Sessions that close automatically and a temporary block after failed attempts.
- Intranet pages that are not cached and do not appear in search engines.
- Backups kept in Santiago, Chile, accessible only to authorised staff.
These measures reduce risk, but no system is completely invulnerable.
08International transfers
The website’s server is hosted by HostGator in the United States, and Cloudflare, Inc., a United States company, processes the website’s traffic on its global network. The United States has not been declared a country with an adequate level of protection by Chile’s Personal Data Protection Agency; these transfers are covered by the data protection clauses in HostGator’s and Cloudflare’s terms of service. The same applies to Google if you play a video. Website backups are kept in Santiago, Chile.
09Your rights and how to exercise them
You may ask, free of charge, for access to your data, its rectification, erasure or portability, or object to its processing. While a rectification, erasure or objection request is being resolved, you may ask for your data to be temporarily blocked.
Write to [email protected] with the subject “Personal data”, stating:
- Your name and how to verify your identity.
- An email or postal address for our reply.
- Which data or processing, which right you are exercising and any supporting information.
We will acknowledge receipt and the controller will reply within 30 calendar days, extendable once by another 30; any rejection will state its reasons. If you are not satisfied or do not receive a timely reply, you may file a complaint with Chile’s Personal Data Protection Agency.
10Security incidents
If a security breach occurs, we will contain, investigate and fix it. If it puts people’s rights at risk, the controller will report it without delay to Chile’s Personal Data Protection Agency and, where the law requires, to those affected. Every incident and the measures taken are recorded.
11Artificial intelligence and automated decisions
The website has no artificial intelligence chatbots or assistants. To organise the files uploaded to the Intranet (invoices, supplier and consumption reports, which may contain names and contact details) we use an open-source artificial intelligence model (Ollama) that runs only on Vector Cero SpA’s computer: the data does not leave that computer and is not sent to external artificial intelligence services.
The data is processed only for the duration of the task: no separate copies are kept and only the organised file remains on the Intranet. The artificial intelligence does not build profiles or make decisions about people, and a person reviews what it organises. The block after failed passwords is a fixed security rule, not an artificial intelligence decision.
12Photos, documents and minors
The website is not aimed at minors and does not ask for sensitive data. Some photos of community activities show people: if you appear in one and want it removed, write to [email protected] and we will take it down.
13Changes to this policy
Every change is published on this page with its version number and date. In case of any difference between languages, the Spanish version prevails.