Privacy and Personal Data Protection Policy

This document governs the processing of personal data collected through the website weareandale.com (the “Site”) and through àndale’s other contact channels.

Holder / Controller:

Fernando Adolfo Ambordt, trading under the name “àndale”.

CUIT (tax ID):

20-30238683-9

Address:

Enrique Bodereau 7491, X5147, City of Córdoba, Province of Córdoba, Argentine Republic

Privacy contact:

privacy@weareandale.com

Designated internal officer:

Fernando Adolfo Ambordt, to whom any query, request or complaint relating to the processing of personal data may be addressed.

This Policy describes which personal data àndale collects, on what purposes and legal bases it processes them, with whom it shares them, how long it keeps them and how data subjects may exercise their rights.

It applies to: (i) visitors and users of the Site; (ii) persons who contact àndale through web forms, email, social networks, telephone or messaging; (iii) contacts, referents and representatives of clients, suppliers and collaborators; and (iv) persons applying to job openings or sending speculative applications.

It does not apply to processing that àndale carries out on behalf of and under the instructions of its clients in its capacity as processor, which is governed by clause 10 and by the agreements signed with each client.

Processing is governed by Ley N.° 25.326, the Argentine Personal Data Protection Act, its implementing Decree N.° 1558/2001, the provisions and resolutions issued by the Agencia de Acceso a la Información Pública (AAIP), the Argentine supervisory authority, and other concordant and supplementary Argentine legislation.

In addition, in respect of data subjects located in the European Economic Area (EEA) or the United Kingdom, àndale applies the standards laid down in Regulation (EU) 2016/679 (GDPR) and in the UK GDPR, on the terms of clause 18.

àndale limits collection to data that are adequate, relevant and not excessive in relation to the scope and purpose for which they are obtained, in accordance with Article 4 of Ley N.° 25.326. Depending on the channel and the relationship, the following categories may be processed:

Fields identified as mandatory in the forms are necessary in order to deal with the request; failure to supply them will prevent the enquiry from being processed or the service from being provided. The remaining fields are optional and their omission has no consequence for the data subject, in accordance with Article 6(c) of Ley N.° 25.326.

The data subject declares that the data supplied are true, accurate and current, and undertakes to keep them up to date and to notify any relevant change.

Personal data are processed for the purposes set out below, with an indication of the basis that legitimises each processing operation:

Data will not be used for purposes different from or incompatible with those for which they were obtained, in accordance with Article 4(3) of Ley N.° 25.326.

Data are kept only for as long as is necessary to fulfil the purposes notified and, thereafter, blocked for the limitation periods of any actions that may arise from the relationship. By way of guidance:

• Enquiries not converted into an engagement: twenty-four (24) months from the last contact.
• Clients and suppliers: for the duration of the relationship and, after it ends, for the ten (10) year period required by the applicable commercial and tax legislation.
• Subscribers to commercial communications: until consent is withdrawn, keeping only the minimum record necessary to evidence the unsubscribe.
• Applicants: twelve (12) months from receipt of the application, unless consent is given for a longer period.

Once those periods have elapsed, the data will be deleted or irreversibly anonymised.

àndale does not sell, assign or make available to third parties the personal data of data subjects, save in the cases provided for by law or those set out below:

• Processors: providers of hosting, cloud infrastructure, form management, email, analytics tools, content management and social media scheduling platforms, administrative and accounting systems, and external professional firms. All of them process the data on behalf of and under the instructions of àndale, under documented instructions and an obligation of confidentiality and security, in accordance with Article 25 of Ley N.° 25.326.
• Competent authorities: public, judicial or administrative bodies, where there is a request grounded in a legal provision.

Some of those providers are established outside the Argentine Republic, including the United States and Member States of the European Union. Where a transfer is directed to countries that do not afford adequate levels of protection within the meaning of Article 12 of Ley N.° 25.326 and of AAIP Resolution N.° 159/2018, àndale will put in place the standard contractual clauses approved by the supervisory authority or obtain the express consent of the data subject, as appropriate.

As at the date of this version, the providers involved in the operation of the Site are: Vercel Inc. (hosting and infrastructure, United States), Google LLC (provision of web typefaces, United States) and Calendly LLC (meeting scheduling, United States, only where the user voluntarily accesses that service).

Sending commercial communications by electronic means requires the prior consent of the data subject, given by an affirmative and unambiguous act, without pre-ticked boxes or tacit consent.

The data subject may withdraw that consent at any time, without giving reasons and at no cost, through the unsubscribe link included in each communication or by request addressed to privacy@weareandale.com. The unsubscribe will take effect within seventy-two (72) working hours.

In accordance with Article 27(3) of Ley N.° 25.326, every communication for advertising purposes will inform the data subject of the right to request the withdrawal or blocking, in whole or in part, of their name from the database. As regards telephone communications, the Registro Nacional “No Llame” created by Ley N.° 26.951 is observed.

In the course of providing communication, social media management and development services, àndale may access personal data for which its clients are responsible. In such cases àndale acts exclusively as a processor and, accordingly:

• processes the data solely in accordance with the documented instructions of the client controller;
• does not apply or use them for a purpose other than that provided for contractually, nor assign them to third parties, not even for storage;
• maintains the duty of confidentiality provided for in Article 10 of Ley N.° 25.326, which subsists even after the relationship has ended;
• applies the technical and organisational security measures required; and
• on termination of the engagement, destroys or returns the data to the controller, as the latter instructs.

Requests to exercise rights in relation to that processing must be addressed to the client controller; should àndale receive them, it will forward them without delay.

The data subject has the right to request access to, rectification, updating and deletion of their data, as well as to object to certain processing, to withdraw the consent given and to request the blocking or withdrawal of their name from databases used for advertising purposes.

The data subject is entitled to exercise the right of access free of charge at intervals of not less than six months, unless a legitimate interest to that effect is established in accordance with Article 14(3) of Ley N.° 25.326.

The Agencia de Acceso a la Información Pública, as the supervisory body under Ley N.° 25.326, has the power to hear complaints and claims brought by those whose rights are affected by non-compliance with the rules in force on personal data protection.

The Site and àndale’s services are directed at persons over eighteen (18) years of age. àndale does not knowingly collect data from minors. Should it become aware that data of a minor have been obtained without the due authorisation of the person exercising parental responsibility, it will proceed to delete them immediately.

àndale adopts the technical and organisational measures necessary to guarantee the security and confidentiality of personal data, so as to prevent their alteration, loss, unauthorised consultation or processing, in accordance with Article 9 of Ley N.° 25.326 and the Recommended Security Measures approved by AAIP Resolution N.° 47/2018. Among others: encryption of communications by means of the HTTPS protocol, access control on the principle of least privilege, centralised credential management, multi-factor authentication, periodic backups and confidentiality agreements with staff and collaborators.

No security measure is infallible. In the event of a security incident affecting personal data, àndale will act in accordance with its internal response procedure and will notify data subjects and the supervisory authority where appropriate.

The Site may contain links to third-party websites, profiles or platforms, including those of àndale’s clients. àndale does not control those sites and is not responsible for their privacy policies or processing practices, which it is for the user to acquaint themselves with.

The use of cookies and tracking technologies is governed by àndale’s Cookies Policy, available at weareandale.com/cookies, which forms an integral part of this Policy.

àndale may amend this Policy to bring it into line with regulatory, case-law, technological changes or changes in its processing practices. The version in force will always be the one published on the Site, with an indication of the date it was last updated. Where the amendments are substantial, they will be communicated by an appropriate means with reasonable notice before they take effect.

This Policy is governed by the laws of the Argentine Republic. Any dispute arising from its interpretation or application will be submitted to the ordinary courts of the City of Córdoba, Province of Córdoba, without prejudice to the non-waivable jurisdiction provided for by consumer protection and personal data protection legislation, and to the right of any data subject to lodge complaints with the Agencia de Acceso a la Información Pública.

The Argentine Republic has been recognised by the European Commission, by Decision 2003/490/EC, as a country ensuring an adequate level of personal data protection. Notwithstanding this, in respect of data subjects located in the EEA or the United Kingdom, àndale recognises the following additional rights: access, rectification, erasure, restriction of processing, portability and objection, including objection to automated decisions producing legal effects.

The applicable legal bases will be, as the case may be, consent (Art. 6(1)(a) GDPR), performance of a contract or of pre-contractual measures (Art. 6(1)(b)), compliance with a legal obligation (Art. 6(1)(c)) or legitimate interest (Art. 6(1)(f)). Data subjects concerned have the right to lodge a complaint with the supervisory authority of their State of residence.

Any query relating to this Policy may be addressed to privacy@weareandale.com, to the telephone number +54 9 3492 567 025 or to the postal address given in clause 1.