Legal
Privacy Policy
This policy explains how Horacio Garay processes personal data collected through horaciogaray.com, in accordance with Law No. 21.719, which regulates the protection and processing of personal data in Chile. The law was published on December 13, 2024, and becomes fully enforceable on December 1, 2026.
1. Data controller
The data controller for personal data collected on this website is:
- Name: Horacio Garay
- Role: B2B Marketing Director
- Website: horaciogaray.com
- Contact: the request form on this page
- Country: Chile
Given the size and nature of the activity, the controller also acts as the compliance officer under Article 49 of Law 21.719.
2. Data we collect
We only collect data you choose to provide through the forms on this website:
| Field | Required | Purpose |
|---|---|---|
| Name | Yes | Identify you and personalize the reply |
| Yes | Channel to reply to your inquiry | |
| Company | No | Context for your inquiry |
| Area of interest | No | Route the reply to the right service area |
| Message | No | Understand what you need |
| Consent checkbox | Yes | Record your consent to the processing of your data |
Only if you accept analytics or marketing cookies, Google Analytics and Google Tag Manager also collect technical browsing data in pseudonymized form, such as a truncated IP address, browser type, pages visited and session duration. This data does not directly identify you.
3. Purpose and legal basis
| Purpose | Legal basis (Law 21.719) |
|---|---|
| Reply to your inquiry or request | Your explicit consent (Art. 12) |
| Manage a pre-contractual or contractual relationship | Pre-contractual measures taken at your request (Art. 13 c) |
| Keep an internal record of prospects and clients in a proprietary CRM | Legitimate interest of the controller, compatible with the stated purpose (Art. 13 d) |
| Web traffic analysis and campaign measurement | Your consent, given through the cookie panel (Art. 12) |
Your data will never be used for unsolicited commercial communications or shared with third parties for marketing purposes.
5. Retention period
Personal data is kept only as long as needed for the purpose it was collected for, under the proportionality principle of Art. 3 c of Law 21.719:
| Data type | Retention period | Rationale |
|---|---|---|
| Prospects with no commercial relationship | 24 months from last contact | Reasonable period to assess commercial interest |
| Active clients | Length of the relationship + 5 years | Tax and legal obligations |
| Web analytics (GA4) | 14 months | GA4 retention setting |
| Consent records | 5 years from the date given | Controller accountability (Art. 12) |
After these periods, data is deleted or irreversibly anonymized.
6. Recipients and transfers
Personal data collected through the forms is processed by the following providers, acting as data processors (Art. 15 bis):
| Provider | Country | Function | Safeguards |
|---|---|---|---|
| Resend | USA | Sends form notifications to the controller | Standard contractual clauses |
| Netlify | USA | Website hosting and serverless functions | Data processing agreement (DPA) |
| Google (Analytics / Tag Manager) | USA | Web traffic analysis, only with consent | Standard contractual clauses |
| Proprietary CRM (built on Lovable) | Chile / cloud | Prospect and client records | Access restricted to the controller |
Because some providers are located outside Chile, the international transfer rules of Art. 27 of Law 21.719 apply, and adequate contractual safeguards are used in every case. Data is never transferred, sold or shared for purposes other than those described in this policy.
7. Your rights
Under Title I of Law 21.719 (Arts. 4 to 11), you have the following rights:
Access
Confirm whether your data is being processed and get a copy of it.
Rectification
Correct inaccurate, outdated or incomplete data.
Erasure
Have your data deleted when it is no longer needed or you withdraw consent.
Objection
Object to processing based on legitimate interest.
Portability
Receive your data in a structured, commonly used format.
Temporary blocking
Suspend processing while another request is being resolved.
To exercise any of these rights, use the request form below. You will receive a response within 30 calendar days, as set out in Art. 11 of Law 21.719.
8. Security
The controller applies appropriate technical and organizational measures to protect personal data against unauthorized processing, loss, destruction or damage, in line with Art. 3 f and Art. 14 quinquies of Law 21.719:
- Form submissions travel over HTTPS with TLS encryption.
- Notifications are sent through the Resend API, with the private key stored as an environment variable.
- The site is hosted on Netlify with industry-standard infrastructure protections.
- Access to the proprietary CRM requires authentication and is restricted to the controller.
If a security breach creates a reasonable risk to your rights and freedoms, affected people will be notified under Art. 14 sexies of the law.
9. Minors
The services on this website are intended only for people over 18. We do not knowingly collect data from minors. If you are a parent or guardian and believe a minor has submitted data, you can request its deletion through the request form.
10. Changes to this policy
This policy may be updated to reflect changes in data processing, services or applicable regulations. Changes are published on this page with a new "Last updated" date, so we recommend checking it from time to time.
11. Contact and rights requests
To exercise your rights or ask about how your data is processed, fill in the form below. You will receive a response within 30 calendar days.