Privacy Policy

1. Who is responsible for your data

The controller responsible for personal data processed on nbow.io is Nicolas Gonzalez Albornoz, Tölzer Straße 39, 81379 Munich, Germany ("nbow", "we"). You can reach us at contact@nbow.io. Full provider details are in our legal notice.

2. Which laws this policy follows

We operate from Germany and Chile and address visitors in the European Union and in Chile, so this policy is written to satisfy both regimes:

• • the EU General Data Protection Regulation (GDPR) for visitors in the European Economic Area;
• • the Chilean data protection law: Law No. 19.628 as currently in force, and Law No. 21.719 — which reforms it along GDPR lines and creates the Personal Data Protection Agency (Agencia de Protección de Datos Personales) — applicable from 1 December 2026. This policy is already written to its standard.

3. What data we process

4. Purposes and legal bases

• • Delivering and securing the website (server logs): legitimate interest, Art. 6(1)(f) GDPR; in Chile, the corresponding lawful-basis ground of Art. 13 of the amended law (processing necessary for our legitimate interest in operating and securing the site).
• • Analytics and consent-based data collection (consent records, Google Analytics): your consent, Art. 6(1)(a) GDPR — freely given, specific, informed, prior, unambiguous, and revocable at any time, as Law No. 21.719 also requires.
• • Demonstrating your consent choices (consent records): compliance with our accountability obligations, Art. 6(1)(c) and Art. 7(1) GDPR.
• • Answering your requests (contact data): steps prior to entering into a contract or our legitimate interest in responding, Art. 6(1)(b)/(f) GDPR.

5. Recipients and third-party services

We never sell personal data. Data reaches third parties only as far as technically necessary:

• • our hosting infrastructure provider, which operates the server the site runs on;
• • Google (Analytics — only with your consent; the analytics script is loaded from googletagmanager.com);
• • the geolocation service ipapi.co (country lookup for consent records);

6. International data transfers

We operate from Germany and Chile, so data we process may be processed in both countries. For Google Analytics, transfers to the USA are covered by Google's certification under the EU-U.S. Data Privacy Framework. The country lookup transmits your IP address to the geolocation service ipapi.co, which may process it outside the EEA; this happens only at the moment you accept cookies and on the basis of that express consent (Art. 49(1)(a) GDPR). For users in Chile, we apply the international transfer requirements of Law No. 21.719 (Arts. 27–29) once in force: transfers only with adequate guarantees and an adequate level of protection.

7. How long we keep data

• • Server logs: kept short-term for security purposes, then deleted.
• • Consent records: kept only as long as needed to demonstrate that consent was given (accountability), then deleted.
• • Email correspondence: kept as long as needed to handle your request, plus any statutory retention periods.
• • Google Analytics user-level data: at most 14 months, then deleted automatically.

8. Your rights under the GDPR (EU/EEA visitors)

If the GDPR applies to you, you have the right to:

• • Access (Art. 15): obtain confirmation and a copy of the personal data we hold about you;
• • Rectification (Art. 16): have inaccurate data corrected;
• • Erasure (Art. 17): have your data deleted;
• • Restriction of processing (Art. 18);
• • Data portability (Art. 20): receive your data in a structured, machine-readable format;
• • Objection (Art. 21): object to processing based on legitimate interest;
• • Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• • Complain to a supervisory authority, in particular in the EU member state of your habitual residence.

9. Your rights under Chilean law

Under the currently applicable Law No. 19.628 you may request access, rectification, deletion, and blocking of your personal data. From 1 December 2026, Law No. 21.719 grants you the rights of access, rectification, erasure (supresión), objection (oposición), temporary blocking of processing, and data portability.

To exercise these rights, send a written request to contact@nbow.io identifying yourself and the data concerned. If we deny your request or fail to answer in time, Law No. 21.719 entitles you to file a claim with the Agencia de Protección de Datos Personales once it becomes operational.

10. No profiling, no children's data

We do not use automated decision-making or profiling that produces legal effects for you. Our website is aimed at business audiences and is not directed at children; we do not knowingly collect children's personal data.

11. Security

All traffic to nbow.io is encrypted with HTTPS. We follow the principles of data minimization — for example, IP addresses in consent records are shortened on receipt — and protect our systems against unauthorized access. No method of transmission over the internet is 100% secure, but we align our safeguards with the security duties of the GDPR and Law No. 21.719.

12. Changes to this policy

We update this policy when our website or the legal framework changes — for example, when Chilean Law No. 21.719 enters into force on 1 December 2026. The date above shows the current version.

13. Contact

For any privacy question or to exercise your rights: contact@nbow.io. Provider identity and address are listed in the legal notice.