PRIVACY AND PERSONAL DATA PROTECTION POLICY

This Privacy Policy (hereinafter, the "Policy") governs the processing of personal and operational data collected by DRUPPIFY (hereinafter, the "Platform" or "Druppify"), owned by Sistemas Tecnológicos Osystems SpA, tax ID 76.967.436-5, in its capacity as Data Controller.

By registering and using the Platform, the User (hereinafter, the "User" or "Drupper") expressly authorises Druppify to collect, store, process and use their personal and operational data in accordance with this Policy and the Terms and Conditions of Use.

1. INTRODUCTION AND SCOPE #

1.1. Data Controller: Sistemas Tecnológicos Osystems SpA (tax ID 76.967.436-5), as owner of the Druppify Platform, acts as the Controller of Users' personal and operational data.

1.2. Territorial Scope: This Policy applies to the processing of data of Users located in Chile and is governed by Chilean legislation in force on the protection of personal data, including Law No. 19,628 on the Protection of Private Life and complementary regulations.

1.3. Nature of the Service: Druppify is a technology platform for operational coordination connecting Logistics Operators, Commercial Principals and Users (Druppers). Druppify is NOT an employer of the User, does NOT process payments nor set rates, and does NOT intervene in the contractual relationship between the User and the Logistics Operator. Druppify acts exclusively as a technology intermediary.

1.4. Régimen legal aplicable y transición: hasta el 30 de noviembre de 2026 inclusive, el tratamiento descrito en esta Política se rige por la Ley N° 19.628 sobre Protección de la Vida Privada, en su texto vigente.

Desde el 1 de diciembre de 2026 se rige por la Ley N° 19.628 modificada por la Ley N° 21.719, y las referencias de esta Política a bases de licitud, a los roles de responsable y encargado, a los derechos del titular, a los plazos, a las vulneraciones de seguridad, a las transferencias internacionales y a la autoridad competente se entenderán adaptadas a dicho régimen y a las normas, reglamentos e instrucciones obligatorias que dicte la Agencia de Protección de Datos Personales.

Cuando esta Política reconozca al Usuario un derecho, un plazo o una garantía más favorable que la que resulte del régimen legal aplicable en cada momento, prevalecerá la más favorable al titular.

2. DRUPPIFY'S ROLE AS DATA CONTROLLER #

2.1. Druppify's Responsibilities: As Data Controller, Druppify is responsible for:

• Ensuring the lawful, fair and transparent processing of personal data
• Implementing technical and organisational security measures to protect the data
• Processing data solely for the purposes stated in this Policy
• Respecting Users' privacy rights in accordance with applicable law
• Retaining the operational data required for system integrity and legal compliance

2.2. Limitations: Druppify is NOT responsible for:

• Data processing carried out by Logistics Operators or Commercial Principals outside the Platform
• Employment, contractual or commercial relationships between the User and third parties
• The User's payments or tax obligations
• Misuse of data by third parties unconnected with Druppify

3. TYPES OF DATA COLLECTED #

Druppify collects and processes the following categories of data:

3.1. Identifiable Personal Data (Registration and Profile)

• Full name: required to identify the User
• Email address: used for communications, notifications and account recovery
• Mobile phone: required for SMS verification, notifications and operational contact
• Password: stored with bcrypt encryption (irreversible hash) for secure authentication
• Profile photograph: optional, for visual identification on the Platform
• Home address: optional, to calculate distances and optimise coordination
• Date of birth: to verify the User is of legal age (under-18s prohibited)
• Identity document: required for identity validation and legal compliance
• Driving licence: only for Operational Roles that involve driving
• Certificates and skills: documentation of relevant training, permits or certifications
• Certificado de antecedentes: documento relativo a condenas e infracciones penales. Es un dato de categoría especial, sujeto al régimen restringido que le reconoce la ley. Se trata únicamente para verificar el cumplimiento de un requisito de habilitación exigido por una norma o por la entidad que ofrece la oportunidad, se restringe su acceso al personal expresamente autorizado y no se utiliza para ordenar, priorizar, calificar ni dirigir comunicaciones comerciales. Druppify limitará su exigencia a los roles de servicio que lo requieran objetivamente e identificará en la Plataforma la entidad y el fundamento que lo exigen, antes del 1 de diciembre de 2026.
• Datos de cuenta bancaria: se recogen para que la entidad responsable del pago pueda efectuarlo, y se comunican a ella con esa única finalidad. Druppify no realiza el pago ni retiene fondos.

3.2. Verification and Authentication Data

• SMS verification code: sent to the User's phone during registration via the endpoint /auth/send-sms-verification-signup
• Session token: generated after successful authentication to keep the session active
• Login history: date, time, IP address and device used
• Failed authentication attempts: to prevent unauthorised access

3.3. Operational Data (Activity on the Platform)

• Service start/end records: date and time when operational activities are started and finished
• Geolocation at critical events: GPS coordinates captured while entering an address (where applicable), delivering orders, during incidents or whenever required for operational traceability.
• Photographic evidence: photos of products, digital signatures, proof of delivery, vehicle or facility condition, or any evidence required by the operational process
• Digital signatures: captured on a touchscreen to record deliveries or acceptance of services
• Performance metrics: punctuality, adherence to protocol, completion rate, average rating and indicators calculated automatically by the Platform
• Service history: a list of services assigned, accepted, completed, declined or cancelled, including reasons for declining or cancelling
• Incidents and claims: records of operational anomalies, problem reports, claims made by the User or reported against them

3.4. Technical and Device Data

• Device information: model, manufacturer, operating system (iOS/Android), OS version
• Mobile app version: for compatibility and to detect when updates are required
• Unique device identifier (Device ID): to prevent fraud and control multiple sessions
• Permissions granted: a record of the permissions granted by the User (camera, location, notifications)
• Error and crash logs: technical information about application failures, to improve the service

3.5. Data Generated by Algorithms and Automated Processes

• NON-binding payment estimates: indicative calculations based on rates configured by the Logistics Operator; they do NOT constitute a payment commitment on Druppify's part
• Scores and rankings: ordering of Users based on performance metrics, generated automatically to facilitate coordination (NOT for employment decisions)
• Priority assignment: an algorithm that suggests the order in which services are assigned according to availability, proximity, history and the Operator's configuration
• Automated flags and statuses: markers for active/inactive, blocked, under review or suspended accounts
• Anomaly alerts: automated detection of unusual behaviour

4. PURPOSE OF DATA PROCESSING #

Druppify processes the User's personal and operational data exclusively for the following purposes:

4.1. Platform Functionality and Operation

• Registration, authentication and management of User accounts
• Operational coordination between Users and Logistics Operators
• Notifications about available, assigned or modified services
• Recording and traceability of the start and end of services, operational evidence and digital signatures
• Calculation and display of NON-binding payment estimates (configured by the Operator)
• Management of incidents, claims and technical support

4.2. Validation, Security and Fraud Prevention

• Identity verification through validation of the national ID, documents and SMS
• Detection and prevention of record manipulation, impersonation or fraudulent use
• Auditing of critical events (logins, profile changes, suspicious actions)
• Access and permission control according to roles and account statuses

4.3. Traceability, Audit and System Integrity

• Retention of historical operational records for the integrity of metrics and calculations
• Auditing of operational processes for Logistics Operators and Commercial Principals
• Generation of aggregated operational reports, statistics and analysis
• Compliance with applicable accounting, tax and legal obligations

4.4. Service Improvement and Technology Development

• Analysis of Platform usage to improve features
• Detection and correction of technical errors (logs, crashes)
• Optimisation of coordination and dispatch algorithms
• Development of new features based on User feedback

4.5. Service-Related Communications

• Operational notifications (services, changes, alerts)
• Technical support and customer service communications
• Notices about changes to the Terms and Conditions or Privacy Policy
• Legal, administrative or regulatory compliance communications

5. LEGAL BASES FOR PROCESSING #

The processing of the User's personal data is based on the following legal grounds:

5.1. The User's Express Consent: By registering and accepting these Terms and Conditions and Privacy Policy, the User gives their free, informed and unambiguous consent to the processing of their data in accordance with this Policy.

5.2. Performance of the Service: Processing is necessary to provide the operational coordination service requested by the User when registering on the Platform.

5.3. Compliance with Legal Obligations: Retention of operational data to comply with accounting, tax, audit and other applicable regulations in Chile.

5.4. Druppify's Legitimate Interest: Fraud prevention, Platform security, system integrity, service improvement and protection of the rights of Druppify, Operators and other Users.

6. USE OF GEOLOCATION, CAMERA AND OPERATIONAL EVIDENCE #

6.1. Geolocation (GPS)

The Platform requires access to the GPS location of the User's mobile device only at specific events:

• Start of service: when starting a service, to validate presence at the correct location
• End of service: when finishing a service, to record completion
• Order deliveries: when completing deliveries, for traceability and evidence
• Operational incidents: when it is necessary to record the location of an abnormal event

6.2. Camera and Photographic Evidence

The Platform requires access to the device camera in order to capture:

• Profile photograph: optional, for visual identification of the User
• Identity documents: capture of the national ID card, driving licence and certificates
• Delivery evidence: photos of delivered products, packaging condition, digital signatures
• Incident records: photographic evidence of damage, anomalies or exceptional situations

6.3. Storage of Evidence

Photographic evidence and digital signatures are stored securely on cloud servers (Microsoft Azure) with encryption at rest and in transit, and are retained in accordance with the retention periods set out in Section 9.

7. AUTOMATED PROCESSES AND ALGORITHMS #

The Platform uses algorithms and automated processes for operational coordination, NOT for employment decisions or for defining the terms on which services are provided.

7.1. Priority Assignment Algorithm

It orders Users according to configurable criteria (availability, proximity, performance history, Operator preferences) to facilitate coordination. It does NOT determine who must provide services.

7.2. Calculation of Payment Estimates (NON-Binding)

Based on rates configured by the Logistics Operator, the Platform may display indicative estimates of financial compensation. These estimates:

• Are exclusively informative and indicative in nature, in accordance with the Terms and Conditions of Use
• do NOT constitute any payment commitment on Druppify's part
• are NOT binding on either the Operator or the User
• Serve only as informative reference
• The actual payment is the exclusive responsibility of the Logistics Operator

7.3. Automated Performance Metrics

The Platform automatically calculates metrics such as:

• Punctuality (difference between the expected time and the actual start, for roles where this applies)
• Completion rate (services completed versus assigned)
• Adherence to protocol (compliance with operational steps)
• Average rating (if the Operator enables a rating system)

These metrics are used for coordination and ordering, NOT for employment decisions or disciplinary action.

7.4. Automated Anomaly Detection

The Platform can automatically detect:

• Services started outside the expected geographical area
• Unusual patterns of declined services
• Manipulation of records
• Simultaneous access from multiple devices

These detections generate alerts for manual review; they do NOT apply automatic penalties.

8. AUTHORISATION OF USE AND NON-TRANSFER OF DATA #

8.1. Nature of the Authorisation: The User declares and accepts that the authorisation granted to Druppify to process their personal and operational data does NOT constitute an assignment, transfer or sale of data, but rather a limited and revocable permission for strictly operational, functional and security purposes of the Platform.

8.2. Ownership of the Data: The User does NOT transfer ownership of their personal data to Druppify. They retain all their rights over the data in accordance with applicable law.

8.3. Revocability: The User may revoke their authorisation and request the deletion of their identifiable personal data, subject to the limitations set out in Section 9 (retention of operational data for system integrity).

9. DATA RETENTION, DELETION AND ANONYMISATION #

9.1. Erasable Personal Data

The User may request the deletion of the following identifiable personal data:

• Name, surname, email, telephone (to be replaced by a pseudonymous identifier)
• Profile photograph
• Home address and its GPS coordinates
• Images of identity documents, licences and certificates (subject to the minimum legal retention period)

9.3. Reasons for Retaining Operational Data

• System integrity: deleting operational data would break historical metrics, calculations and reports
• Operational audit: Operators require full traceability of past services
• Legal compliance: accounting, tax and audit obligations require operational records to be retained
• Fraud prevention: historical pattern analysis to detect anomalous behaviour
• Dispute resolution: operational evidence may be needed for mediation or legal proceedings

9.4. Account Deletion Mechanism

When account deletion is requested:

1. Identifiable personal data (name, email address, telephone) is pseudonymised: it is replaced by an identifier that does not reveal it, of the form "Usuario-XXXXX".
2. Operational data is kept linked to that identifier in order to preserve the integrity of the historical records.
3. The User will not be able to access the Platform again with the same account.
4. Las evidencias operativas se conservan conforme al plazo aplicable a cada categoría según la sección 9.5.

9.5. Retention Period

• Identifiable personal data (with no deletion request): while the account is active and for up to 2 years after the last activity
• Pseudonymised operational data: el plazo que exija la obligación legal que justifica su conservación, y en particular las obligaciones contables y tributarias aplicables a la operación de que se trate. Cumplido ese plazo se anonimizan de forma efectiva o se suprimen.
• Operational evidence (photos, signatures): el plazo del contrato u obligación legal que las respalda, contado desde la operación a la que se refieren.
• Security and audit logs: el plazo necesario según el riesgo y la investigación a la que sirvan, con un mínimo de 2 años.

Estos plazos son criterios de conservación, no un compromiso de retener indefinidamente: cumplido el plazo aplicable a cada categoría, el dato se suprime, se anonimiza de forma efectiva o se bloquea para impedir su uso ordinario cuando deba conservarse únicamente para la defensa de derechos o el cumplimiento de una obligación legal.

10. USER RIGHTS #

The User has the following rights over their personal data:

10.1. Right of Rectification

To correct inaccurate or out-of-date personal data. This can be done directly from the profile settings or by contacting support.

10.2. Right of Erasure (with limitations)

Solicitar la supresión de los datos personales identificables, sujeto a las reglas de conservación de la sección 9. Cuando una obligación legal impida la supresión inmediata, Druppify seudonimizará el dato, lo bloqueará para su uso ordinario y lo suprimirá o anonimizará de forma efectiva al vencer el plazo que justificaba conservarlo. La seudonimización no equivale a la supresión: mientras subsista, el Usuario conserva sus derechos sobre esos datos.

10.3. Right to Object to Processing

To object to specific processing that is not essential to the service. Objecting to essential processing means it will not be possible to continue using the Platform.

10.4. Right Not to Be Subject to Automated Decisions with Legal or Employment Effects

The Platform's algorithms and automated processes (priority assignment, metric calculation, rankings, anomaly detection) have NO legal or employment effects on the User. They are tools for operational coordination and traceability, NOT for selection, hiring, employment appraisal or determining the terms on which services are provided. The User retains at all times the absolute and unrestricted right to accept or decline the services offered, with no consequences or penalties.

10.5. How to Exercise These Rights

To exercise any of these rights, the User must get in touch through the official support channels (see Section 15), identifying themselves appropriately.

11. SHARING DATA WITH THIRD PARTIES #

Druppify does NOT sell or trade Users' personal data. Data may be shared only in the following cases:

11.1. Logistics Operators, Commercial Principals and Shippers

Druppify comunica o permite el acceso a los datos necesarios para publicar oportunidades, verificar requisitos y habilitaciones, evaluar postulaciones, contactar al Drupper, asignar, coordinar, supervisar, documentar, calcular y gestionar los servicios y su pago. Las categorías comunicadas comprenden el nombre, la fotografía de perfil cuando exista, los roles habilitados, el estado de habilitación documental, la disponibilidad, el historial operativo con esa entidad y las métricas de desempeño.

Estas entidades actúan como responsables independientes in respect of the Drupper data they access. They may act as processors on Druppify’s behalf only where a written and executed processing agreement so provides, defines the instructions and prohibits their own purposes; absent such an agreement they are deemed independent controllers.

En su calidad de responsables independientes deben informar al Drupper su identidad y sus finalidades, contar con base de licitud propia, limitar el acceso, atender los derechos del titular, aplicar medidas de seguridad y suprimir los datos cuando dejen de ser necesarios para la finalidad que justificó el acceso. La visibilidad de un dato no los autoriza a descargarlo, combinarlo, perfilarlo, comunicarlo ni conservarlo fuera de esas finalidades.

Un Operador Logístico puede restringir la participación del Drupper dentro de su propia operación, respecto de un mandante, de determinados locales o de determinados roles de servicio. No puede exigir la eliminación de su cuenta ni impedir su participación con otras entidades del ecosistema.

Druppify identificará al Drupper la entidad que ofrece cada oportunidad, la entidad responsable de su pago, las categorías de datos comunicadas y la finalidad del acceso. Esta identificación se incorporará de forma visible en la Plataforma antes del 1 de diciembre de 2026. Antes de esa fecha, y también después, el Drupper puede solicitar por el canal de la sección 15 el listado de las entidades que han accedido a sus datos y la fecha del acceso.

11.2. With Technology Providers

• Microsoft Azure: cloud storage of data and evidence (with encryption at rest)
• MongoDB Atlas: operational database (with encryption at rest and in transit)
• SMS providers: to send verification codes (phone number + temporary code only)
• Push notification services: Firebase/APNs for mobile notifications (device token + message)

All technology providers are subject to confidentiality and data processing agreements.

11.3. Upon Legal Requirement

Druppify may disclose personal data if required by:

• A court order
• A requirement from a competent authority (public prosecutor, tax authority, etc.)
• Compliance with mandatory legal obligations
• Protection of the rights of Druppify, Operators or third parties in legal proceedings

11.4. NOT Shared with Third Parties for Marketing

Druppify does not share, sell or transfer personal data to third parties for advertising, direct marketing or the commercialisation of databases.

11.5. Tratamiento fuera de Chile

Parte del tratamiento descrito en esta Política se ejecuta en infraestructura de proveedores situada fuera de Chile, en particular el almacenamiento de archivos y evidencias, la base de datos operativa, el envío de mensajes de texto, las notificaciones push y la telemetría de infraestructura.

Druppify realiza estas transferencias amparadas en las garantías que exige la ley aplicable y, desde el 1 de diciembre de 2026, en los mecanismos de adecuación o en las garantías previstas en la Ley N° 19.628 modificada por la Ley N° 21.719, tales como la existencia de un nivel adecuado de protección declarado, cláusulas contractuales aprobadas por la autoridad, normas corporativas vinculantes o mecanismos de certificación.

El Drupper puede solicitar por el canal de la sección 15 el país o región de tratamiento de cada proveedor y la garantía invocada.

12. INFORMATION SECURITY #

Druppify implements technical and organisational security measures to protect the User's personal and operational data:

12.1. Technical Security Measures

• Password encryption: bcrypt algorithm with irreversible hashing (passwords are never stored in plain text)
• HTTPS/TLS communication: all communication between the mobile/web application and the servers uses TLS 1.2+ encryption
• Encryption at rest: data stored in Azure and MongoDB Atlas with AES-256 encryption
• Session tokens: JWT token-based authentication with automatic expiry
• Access control: granular permissions by role (User, Operator, Administrator)
• Auditing of critical events: logging of logins, profile changes and suspicious actions

12.2. Organisational Measures

• Access to personal data restricted to authorised staff bound by confidentiality obligations
• Regular team training in data protection and information security
• Internal policies for managing security incidents and notifying breaches
• Confidentiality agreements with technology providers and Data Processors

12.3. Security Limitations

Despite the measures in place, no system is 100% secure. Druppify cannot guarantee absolute security against unauthorised access, cyberattacks or security breaches. The User accepts these risks inherent in the use of digital services.

12.4. Notification of Security Breaches

Ante una vulneración de seguridad confirmada que afecte datos personales del Usuario, Druppify le notificará sin dilación indebida y, cuando sea razonablemente posible, dentro de las 48 horas siguientes a la confirmación del incidente. La comunicación informará, de forma progresiva a medida que se establezcan, la naturaleza del incidente, las categorías de datos afectadas, sus consecuencias probables, las medidas de contención y recuperación adoptadas y un punto de contacto.

Desde el 1 de diciembre de 2026, Druppify notificará además a la Agencia de Protección de Datos Personales en los casos y dentro de los plazos que la ley establezca. Si el plazo legal aplicable en cada momento fuere menor que el señalado en el párrafo anterior, regirá el menor.

13. PROHIBITION OF USE BY MINORS #

13.1. User Responsibility

The User is responsible for the accuracy of the age information provided. Any falsehood in this regard constitutes a serious breach of the Terms and Conditions.

13.2. Procedure if a Minor Is Detected

• Immediate suspension of the account
• Complete deletion of personal data (total deletion, not anonymisation)

14. AMENDMENTS TO THIS PRIVACY POLICY #

14.1. Right to Amend: Druppify reserves the right to amend this Privacy Policy at any time, publishing the new version on the Platform and/or on the website www.druppify.com.

14.2. Notification of Substantial Changes: Substantial amendments affecting the User's fundamental rights will be notified at least 10 days in advance by:

• Email to the registered address
• Push notification in the mobile app
• An information banner in the User's panel

14.3. Acceptance of Changes: Continued use of the Platform after the changes come into force constitutes tacit acceptance of the new Privacy Policy.

14.4. Right Not to Accept: If the User does not agree with the amendments, they must stop using the Platform and request the deletion of their account before the changes come into force.

15. CONTACT AND EXERCISING PRIVACY RIGHTS #

For queries, complaints, the exercise of privacy rights (access, rectification, deletion of data) or any request relating to the processing of personal data, the User may contact Druppify through:

Official Support Channels:

• Email: soporte@druppify.com (please write "PRIVACY" in the subject line)
• In-app form: "Support" section > "Privacy and Personal Data"
• Support chat: available during business hours (Mon-Fri 9:00-18:00 Chile time)

Data Controller Details:

• Registered name: Sistemas Tecnológicos Osystems SpA
• Tax ID: 76.967.436-5

Response Times:

• General information requests: 5 business days
• Exercise of ARCO rights (access, rectification, cancellation, objection): 10 business days
• Complaints about infringement of rights: 15 business days

16. ACCEPTANCE AND CONSENT #

17. APPLICABLE LAW AND JURISDICTION #

This Privacy Policy is governed by the laws of the Republic of Chile, in particular:

• Law No. 19,628 on the Protection of Private Life
• Law No. 19,496 on the Protection of Consumer Rights
• The Civil Code and Commercial Code of Chile
• Complementary regulations in force on data protection

Back to top