Privacy Policy and Personal Data Processing Policy

Introduction

This Privacy Policy and Personal Data Processing Policy describes how Yes The Moon SpA collects, uses, stores, protects and processes personal data relating to the use of the Zeltask platform and its associated services.

Zeltask is an operations and continuous improvement platform aimed at organisations and companies. Its purpose is to facilitate the management of assets, actions, inspections, inventories, suppliers, locations, tickets and other operational processes. By using our services, you accept the practices described in this Policy.

Scope

This Policy governs the processing of personal data carried out by Yes The Moon SpA in connection with the Zeltask platform and its associated services.

For the purposes of this Policy, "personal data" means any information relating to an identified or identifiable natural person, in accordance with applicable Chilean law.

The operational and business information that customers store or generate within Zeltask — such as assets, inspections, inventories, procedures, work orders, tickets, suppliers, locations or corporate documentation — does not, as a general rule, constitute personal data and is governed primarily by the contracts entered into between Zeltask and its customers, without prejudice to the security and confidentiality measures applicable to all information hosted on the platform.

Information we collect

Zeltask processes two main categories of information:

a) Operational and business information, corresponding to the data our customers store or generate within the platform to manage their operations, such as assets, work orders, inspections, inventories, suppliers, locations, procedures, technical documents and operational indicators.

b) Personal data, corresponding to information relating to identified or identifiable natural persons that is necessary to operate the platform, administer user accounts, provide support and fulfil the purposes described in this Policy.

In order to operate the service, we may collect certain basic personal data associated with registered users, such as first name, last name, email address, job title or position, profile photograph, telephone number and RUT or other equivalent identifiers where applicable. This data is requested only where it is necessary for the use of the platform or for the provision of associated services.

We also collect technical and usage information that allows us to operate, maintain and protect our systems. This information may include IP addresses, browser type, operating system, device used, access dates and times, activity logs and events related to the use of the platform.

With the aim of continuously improving our services, we may also collect analytical information about users' interaction with Zeltask. This may include usage metrics, navigation patterns, product experiments and session recordings intended exclusively to understand how the platform is used and to identify opportunities for improvement. These tools are configured to avoid capturing passwords and sensitive information entered into forms.

Zeltask is not designed to collect special categories of personal data or sensitive information about natural persons. Unless there is a legitimate operational need and an adequate legal basis, we do not request medical, biometric, social security or personal financial information, family background, or data relating to religious beliefs, political opinions, trade union membership or other categories specially protected by applicable law.

How we use information

The information collected is used to operate, administer and improve Zeltask. This includes the creation and management of user accounts, access authentication, the provision of technical support, the protection of our systems, the detection of errors or incidents, compliance with legal obligations and the development of new functionality.

We also use aggregated and statistical information to better understand how our customers use the platform and thereby improve the overall product experience.

Additionally, we may use email addresses to send service-related communications, including important announcements, feature updates, product news, launches and other commercial communications relating to Zeltask. Recipients may request to stop receiving this type of communication where applicable.

Lawful basis for processing personal data

Zeltask processes personal data only where there is a legal basis permitting it, in accordance with applicable Chilean law.

Depending on the purpose of the processing, the lawful bases may include:

• Performance of a contract or the taking of pre-contractual steps, where processing is necessary to create accounts, provide the contracted services, deliver support, administer the platform or perform obligations arising from the contractual relationship with our customers.
• Compliance with legal obligations, where we are required to retain certain information, respond to requests from competent authorities or comply with tax, accounting, regulatory or other obligations provided for by law.
• The consent of the data subject, where the law so requires, for example for certain commercial communications or for processing that cannot be based on another legal basis.
• The legitimate interest of Zeltask, where necessary to protect the security of the platform, prevent fraud, detect incidents, improve our services, produce usage statistics, carry out product analysis or maintain operational continuity, provided that such interests do not override the fundamental rights and freedoms of data subjects.

Where a purpose requires a different or additional basis, Zeltask will inform the data subject in due course and adopt the measures required by applicable law.

Cookies and similar technologies

Zeltask uses cookies and similar technologies to ensure the proper functioning of the platform, maintain active sessions, remember user preferences and obtain analytical information about the use of our services.

These technologies may also be used to carry out product testing, analyse general browsing behaviour and evaluate improvements to the user experience. We do not use tracking technologies intended for third-party behavioural advertising, nor do we commercialise information obtained through cookies.

Users may configure their browsers to restrict or reject certain cookies, although doing so could affect the correct functioning of some platform features.

Disclosure of information and international transfers

We do not sell or commercialise personal data. We may share information with technology providers that assist in the operation of our services, including infrastructure, storage, communications, analytics, technical support and other functions necessary for the operation of the platform. Such third parties may only access the information to the extent necessary to provide the contracted services and must adopt reasonable confidentiality and security measures compatible with those used by Zeltask.

We may also disclose information where required by law, by a competent authority, or where necessary to protect our rights, users, systems or legitimate interests.

Information managed by Zeltask may be stored or processed on infrastructure located outside Chile. Currently, some of our technology services operate from the United States and other jurisdictions where our providers are located. In all cases we will endeavour to select providers that maintain adequate standards of information security and protection.

Use of artificial intelligence

Certain current or future Zeltask features may incorporate artificial intelligence technologies to assist users with analysis tasks, content generation, recommendations or other functions related to the operation of the platform.

Where such features are used, certain data or instructions provided by users may be processed by specialised external artificial intelligence providers for the sole purpose of generating the requested results. Zeltask will endeavour to limit the information sent to the minimum necessary for the provision of these features and to select providers that maintain reasonable standards of security and confidentiality.

Retention and security of information

We will retain information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, enforce our contractual rights and maintain the operational continuity of the platform.

Once the contractual relationship with a customer has ended, data may be retained for a period of up to eight (8) months in order to allow backup, recovery or data export processes requested by the customer. After that period, the information may be deleted or anonymised in accordance with our internal procedures and applicable legal obligations.

Zeltask adopts reasonable technical, organisational and administrative measures designed to protect information against unauthorised access, alteration, loss, destruction or improper disclosure. Notwithstanding the foregoing, no technological system can guarantee absolute levels of security.

In the event we detect a security incident that may significantly affect the confidentiality, integrity or availability of information, we will take reasonable measures to investigate, contain and mitigate its effects. Where appropriate under applicable law and given the nature of the incident, we will notify affected customers in due course.

Roles of Zeltask and its customers

With respect to the personal data necessary to operate the service, including user accounts, billing, support, security, commercial communications and platform administration, Yes The Moon SpA acts as the data controller.

However, with respect to the personal data that business customers enter or process within Zeltask, we act primarily as a technology provider and data processor. In these cases, customers are responsible for determining the purpose and legitimacy of the processing, holding the necessary authorisations and complying with the legal obligations applicable to the data entered into the platform.

Zeltask will process such personal data solely to provide the contracted services and in accordance with the instructions provided by each customer, without prejudice to our responsibility to implement reasonable security measures and to be accountable for incidents directly attributable to our systems, acts or omissions.

Rights of data subjects

In accordance with applicable law, data subjects may exercise the rights available to them, including:

• The right of access.
• The right to rectification.
• The right to have data updated.
• The right to erasure or deletion.
• The right to object.
• The right to data portability.
• The right to block or restrict processing where applicable.

Requests may be sent to legal@zeltask.com and will be handled within the timeframes established by applicable law.

Minors

Zeltask is a platform aimed exclusively at organisations and companies. Our services are not directed at minors and we do not knowingly collect personal information from minors.

Changes to this policy

We may update this Privacy Policy and Personal Data Processing Policy periodically to reflect legal, regulatory, technological or service-related changes. The version in force will always be available on our website and, where applicable, within the platform itself.

Annex: Commitment to Chilean personal data protection law

Zeltask undertakes to comply with the obligations applicable to it under Chilean law in force regarding the protection of personal data, including Law No. 19.628, Law No. 21.719 and any complementary regulation that may amend or replace them in the future.

As part of that commitment, we will endeavour to process personal data lawfully, fairly and transparently, to limit its use to legitimate and specified purposes, to collect only the information necessary for the provision of our services, to implement reasonable security measures and to facilitate the exercise of the rights granted to data subjects.

We will likewise review and update our privacy practices periodically to adapt them to the regulatory, technological and operational evolution of our services.

Contact

For enquiries relating to this Policy or to the processing of personal data, you may write to legal@zeltask.com.