WEB PRIVACY POLICY OF COSAYACH

Version: 1.0
Last updated: 02/07/2026
Effective date: As from its publication on the corporate website.
Application: This Policy applies to the website www.cosayach.cl, its contact forms and other digital channels associated with Cosayach (hereinafter, the “Website”).

This Policy aims to inform individuals about the way in which Cosayach collects, uses, stores, communicates and protects their personal data through the website www.cosayach.cl and its web forms, as well as the rights available to them and the mechanisms available to exercise them.

1. Commitment and regulatory framework

Cosayach undertakes to process personal data in a lawful, fair, transparent and secure manner, respecting the rights of individuals and applying measures proportionate to the risk of the processing.

This Policy is aligned with the Chilean regulations applicable to personal data protection, including Law No. 19,628 and the amendments introduced by Law No. 21,719, which regulates the protection and processing of personal data and creates the Personal Data Protection Agency, whose general entry into force is scheduled for December 1, 2026.

2. Definitions

• Personal data: any information linked or referring to an identified or identifiable natural person.
• Data Controller: whoever determines the purposes and means of the processing.
• Processor (agent/mandatary): whoever processes data on behalf of the controller, under its instructions.
• Sensitive data / special categories: data subject to enhanced protection due to its nature.
• Data processing: any operation or set of operations performed on personal data, such as collection, recording, storage, organization, retention, modification, extraction, consultation, use, communication, transfer, transmission, blocking, erasure or destruction.
• Data subject: the natural person to whom the personal data relates.
• Consent: a freely given, specific, informed and unambiguous indication of the data subject’s wishes, by which the data subject authorizes the processing of his or her personal data for one or more specific purposes.
• Communication or transfer of data: making personal data known, transferring or transmitting personal data to a person or entity other than the data subject, controller or processor, as applicable.

3. Who is the Data Controller?

3.1 Controller by Website

The controller of the personal data collected through the website www.cosayach.cl is Cosayach, the company that owns or administers this website.

3.2 Single privacy channel

For inquiries, requests or the exercise of rights related to personal data processed through the website www.cosayach.cl, you may write to the corporate privacy channel:

• datospersonales@grupoerrazuriz.cl

This channel centralizes the receipt and internal coordination with the corresponding Responsible Company, in order to provide traceability and consistent responses.

Requests received through this channel will be recorded internally for traceability purposes, deadline management, identity verification where applicable, and coordination with the respective Responsible Company.

Cosayach will seek to respond to requests within the deadlines established by the applicable regulations. If a request is incomplete or requires additional background information to verify the identity of the applicant or locate the information, Cosayach may request supplementary information.

4. What personal data do we process on the Website?

Cosayach will seek to collect only personal data that is adequate, relevant and limited to what is necessary in relation to the purposes informed in this Policy or in the specific notices available in each form.

Depending on how you interact with the website www.cosayach.cl, Cosayach may process:

4.1 Data provided directly by the user

In particular, through the Website contact form, Cosayach may process data such as name, email address, telephone number, topic or department, and the content of the message sent by the user.

4.2 Browsing and technical data

Online identifiers and technical records (e.g., IP address, browser, device, pages visited, date/time, interaction events), associated with cookies or similar technologies where applicable.

4.3 Sensitive data

In general, Cosayach does not request sensitive data through its web forms. Users are asked not to include sensitive data in forms, messages, open fields or attachments, unless strictly necessary for the corresponding purpose or expressly requested.

If, exceptionally, the user voluntarily provides sensitive data, for example in a CV or other attached document, Cosayach will apply enhanced safeguards, limit its processing to the corresponding purpose and may delete or anonymize any data that is not necessary.

Users are asked not to include sensitive data in open fields, messages or forms, such as health data, religion, political opinion, union membership, biometrics, data of minors or medical/judicial records.

5. Purposes of processing (what do we use your data for?)

Cosayach processes personal data for:

1. Responding to inquiries and contact: responding to messages sent through forms/emails and requests.
2. Commercial management and B2B relationship: for example, distribution requests or commercial contact.
3. Recruitment and selection: receiving and evaluating job applications where the Website offers “work with us” or CV attachment.
4. Support/after-sales: managing requests related to sales or other operational requirements.
5. Security and continuity: preventing fraud, abuse of the Website, incidents and ensuring operational continuity.
6. Analytics and improvement: measuring and improving the performance and user experience on the Website.
7. Marketing/campaign measurement (where applicable): measuring conversions and advertising effectiveness, as indicated in the section on cookies, pixels and tracking technologies.
8. Legal compliance and defense: complying with legal/regulatory obligations and managing disputes or requests.

In certain forms or functionalities of the Website, Cosayach may include specific privacy notices that supplement this Policy, indicating particular purposes, mandatory or optional fields, applicable legal basis or other relevant background information.

6. Legal bases (basis for processing data)

Cosayach will process personal data only when there is an applicable legal basis in accordance with current regulations. Depending on the case, the processing may be based on one or more of the following bases:

• a) Data subject’s consent: for example, for non-essential cookies, subscriptions, commercial communications, direct marketing or retention of records for future job opportunities, where applicable.
• b) Performance of a contract or application of pre-contractual measures: for example, to manage commercial requests, quotations, applications, requests from customers, suppliers or potential counterparties.
• c) Compliance with legal or regulatory obligations: for example, to respond to requests from competent authorities, retain information required by law or comply with duties applicable to Cosayach-related companies.
• d) Legitimate interest: of Cosayach, as well as of related companies: for example, for information security, prevention of fraud or abuse, operational continuity, defense against claims, basic analytics of the website’s operation and service improvement.

When the processing is based on legitimate interest, Cosayach will assess that such interest does not unduly affect the rights and freedoms of data subjects, applying proportionality, minimization, security and transparency measures.

7. Cookies, pixels and tracking technologies

The website www.cosayach.cl may use cookies, pixels, tags, online identifiers or other similar technologies to enable its operation, improve user experience, perform statistical measurements and, where applicable, measure campaigns or communication actions.

These technologies may include, depending on the Website, tools such as Google Analytics, Meta Pixel, LinkedIn Insight Tag or other equivalent tools.

Strictly necessary cookies may be used to enable the technical operation of the Website. In contrast, non-essential cookies or technologies, such as advanced analytics, advertising or marketing cookies, will be used in accordance with the applicable legal basis and, when necessary, after acceptance or configuration by the user.

Where applicable, the Website will provide mechanisms to accept, reject or configure non-essential cookies, as well as to modify preferences later through a Preference Center or equivalent mechanism.

The details of cookies, providers, duration, purpose and applicable category will be informed in the Cookie Policy corresponding to each Website or group of Websites.

The user may also block or delete cookies from the browser settings. Notwithstanding the foregoing, some strictly necessary cookies may be essential for the proper functioning of the Website.

For more information, review our Cookie Policy.

8. Automated decisions

Currently, the Website does not make decisions based exclusively on automated processing that produce relevant legal effects or significantly affect data subjects.

If processes of this type are implemented in the future, Cosayach will inform data subjects in a timely manner about the logic applied, the purpose of the processing and their corresponding rights under the applicable regulations.

9. With whom do we share data? (recipients and processors)

Cosayach may share personal data with:

• Related companies: when necessary to manage requests, support, security or corporate functions, applying minimization criteria.
• Providers or processors: such as hosting services, web support, email, cybersecurity, analytics, maintenance or administration of forms, under confidentiality, security and limited-use obligations.
• Authorities or other third parties: when there is a legal obligation or valid request.

Providers that process personal data on behalf of Cosayach must do so in accordance with documented instructions, confidentiality obligations, appropriate security measures and restrictions on use for their own purposes, unless legally or contractually authorized.

Cosayach does not sell personal data.

10. International transfers

Some technology providers, analytics platforms, marketing tools, cloud services, support, cybersecurity, CRM or other service providers may host, access or process personal data outside Chile.

When international transfers of personal data are carried out, Cosayach will seek to verify that there is a valid legal basis and will adopt appropriate safeguards to protect personal data, including contractual, technical and organizational measures proportionate to the risk, in accordance with the applicable regulations.

These transfers may have as their purpose the provision of technology services, storage, backup, security, analysis, communications, support or request management.

11. Retention (data storage)

Cosayach will retain personal data only for the time necessary to respond to the inquiry, manage the request or fulfill the informed purpose, unless there is a legal obligation or a need to defend against claims.

Data received through contact forms must have an internally defined retention period.

Reference periods (adjustable by company/service):

• General inquiries: up to 24 months from the closure of the request.
• Recruitment: up to 12 months from receipt of the application or completion of the respective process, unless the applicant expressly authorizes the retention of his or her records for a longer period for future job opportunities or “talent pool”.
• Security logs: 6 to 24 months depending on criticality and risk.

The above periods are referential and may vary when there is a legal retention obligation, an ongoing contractual relationship, a dispute, investigation, request from an authority or need to defend against claims.

12. Rights of individuals and how to exercise them

Individuals may request from Cosayach the exercise of their rights over their personal data, including access, rectification, erasure, objection, portability and blocking, in accordance with the applicable regulations.

13. How to request

Send your request to: datospersonales@grupoerrazuriz.cl

Ideally include:

• Full name and contact method
• Website/company related to Cosayach with which you interacted (if known)
• Right you wish to exercise and description of the request
• Data that helps locate the requested information, for example, the email address used in the form.

To protect individuals against unauthorized access, we may request identity verification where applicable.

If the data subject considers that the processing of his or her personal data infringes the applicable regulations, or if he or she believes that an adequate response has not been received regarding the exercise of rights, he or she may file a complaint with the Personal Data Protection Agency, once it is in operation, without prejudice to any other rights or actions that may apply.

14. Information security

Cosayach applies reasonable technical and organizational measures proportionate to the risk to protect personal data, including access controls, monitoring, encryption in transit where applicable, and management of providers with security obligations.

Internal access to personal data will be limited to the people who require such information for the performance of their duties, who must observe duties of confidentiality and proper use of the information.

15. Incidents and security breaches

If a security incident occurs that affects or may affect personal data, Cosayach will apply procedures for detection, containment, analysis, investigation, mitigation and remediation. It will also make communications or notifications that correspond to data subjects, competent authorities or other third parties, in accordance with the applicable regulations and the level of risk of the incident.

16. Links to third-party sites

The Website may contain links to third-party pages, for example, social networks or external platforms. This Policy does not apply to third-party sites; it is recommended to review their privacy policies.

17. Data of children and adolescents

The website www.cosayach.cl is not directed at children or adolescents and does not seek to deliberately collect their personal data. If it is detected that personal data of minors has been received without the authorization that corresponds under the applicable regulations, Cosayach will adopt reasonable measures for its deletion, blocking or regularization, as applicable.

In the case of personal data of minors under 16 years of age, the processing will require the authorization of their legal representatives, unless the law expressly authorizes another form of processing.

18. Privacy notices in forms

The forms available at www.cosayach.cl must include brief privacy notices informing the specific purpose of the processing, mandatory or optional fields, the data controller, the applicable legal basis and a link to this Policy.

When the processing requires consent, the form may incorporate specific mechanisms to obtain it, record it and allow its subsequent withdrawal, in accordance with the applicable regulations.

19. Updates to this Policy

Cosayach may modify this Policy due to legal, regulatory, technical or operational changes, or due to adjustments in its processing activities. The effective version will be available on the website www.cosayach.cl, indicating its last update date.

When changes are substantial or may significantly affect the way in which personal data is processed, Cosayach may inform such changes by reasonable means, such as notices on the Website, electronic communications or other available channels, as applicable.