Privacy and Data Protection Policy

EVoting's Data Protection Policy

For us, the privacy of our clients' data is a non-negotiable value. That is why we have defined a Privacy and Data Protection Policy, based on our principles and on the data protection regulations applicable in each country where we operate.

1. Information provided by clients before the vote

In their electronic voting processes, EVoting works with the information that clients provide for this purpose. This is generally information containing the name, national ID number (RUT) and email address of the people authorised to take part in the vote (the electoral roll).

2. Information provided by users during the voting process

EVoting consults personal data of voters that they themselves provide voluntarily, such as their national ID number (RUT), ID card serial number, phone number and others, depending on the authentication mechanism. However, this information is not stored.

Likewise, through one of the authentication mechanisms (a knowledge-based challenge), we access personal information about each voter. This system is supplied by an external provider whose contract stipulates that EVoting may not store this information.

Finally, EVoting collects the IP address of the computer or mobile phone from which the vote is cast.

3. Use of data

The information provided to EVoting by the client or by users is confidential. This means it is used solely for the purpose of delivering a good electronic voting service.

The provision prohibiting the information from being shared with third parties or used for purposes other than the vote is set out in the contracts signed between EVoting and its clients.

The data generated during EVoting's votes receives differentiated treatment, which is also detailed in the service contract.

Of this data, the following is considered public —that is, available to everyone:

• The existence of the election, its purpose and who convenes it
• The time at which votes are received
• The opening and closing times of the election
• The results

Of the data generated by the vote, the following is considered confidential —that is, restricted to the Electoral Commission:

• The list of voters and their data
• The identity of those who have voted

Of the data generated by the vote, the following is considered secret —that is, impossible to know:

• The preference marked by those who have voted

It is worth highlighting here that the voting platform developed by EVoting makes it technically impossible to know the option marked by the voter.

4. Safeguarding of data

EVoting safeguards all the data collected in its votes in a cloud folder, under strict controls, accessible only to the company's operations staff.

To safeguard data, EVoting works with recognised providers such as Amazon and Google, thereby inheriting those providers' security policies. In both cases, access to the data is protected by two-factor authentication, a procedure similar to the dynamic password used by banks.

5. Data retention

EVoting retains personal data only for as long as necessary to fully deliver the service for which it was collected —the electronic vote— and in accordance with what is agreed with each client in the service contract. While the data remains in our custody, it is stored on encrypted disks, so that any information released is impossible to decipher without the corresponding cryptographic key.

6. Secure deletion of information

At the client's request, EVoting carries out a secure deletion of the data associated with their process and provides a document certifying the erasure: the data deletion certificate.

Deletion follows the Media Sanitization Guidelines of the U.S. National Institute of Standards and Technology (NIST SP 800-88, Guidelines for Media Sanitization), which guide the sanitization process —restricting access to the target data on storage media— according to the categorisation of the information's confidentiality. EVoting's infrastructure relies on providers such as Amazon Web Services, which apply these same guidelines when releasing resources.

7. Legal rights regarding the protection of personal data

EVoting respects the regulations in force relating to the protection of personal data. In Chile, this includes Law No. 19,628 on the Protection of Private Life and Law No. 21,719, which modernises the personal data protection regime and comes fully into force in December 2026. In the other markets where we operate we apply the equivalent local regulations —among others, Law 25,326 (Argentina), Law 18,331 (Uruguay), Law 29,733 (Peru), Law 1581 of 2012 (Colombia), the Organic Law on Personal Data Protection (Ecuador), Law 8968 (Costa Rica), Law 81 of 2019 (Panama) and the Federal Law on Protection of Personal Data Held by Private Parties (Mexico).

The rights in this area are:

• Right of Access: to know the personal data held by EVoting and to obtain a copy of it.
• Right of Modification or Rectification: to correct the personal data held by EVoting.
• Right of Cancellation or Erasure: to object to and delete personal data held by EVoting.
• Right of Blocking: to withdraw authorisation for EVoting to process personal data. This provision, however, will not affect processes carried out before the authorisation to use such data was terminated.

If you have any questions about the rights set out above, or a request for information, you can contact us at protecciondatos@evoting.com and we will respond within a maximum of one week. If the question or request is particularly complex, or there are numerous joint requests and we cannot respond within a week, we will keep you informed of our progress.

8. Dispute resolution

If there are any doubts about compliance with this Privacy and Data Protection Policy, you can contact EVoting by email at info@evoting.com and we will address your concern.

9. Changes to this privacy policy

If at any time EVoting implements substantial changes to its Privacy and Data Protection Policy, this will be notified publicly through its website and other institutional channels. If you do not agree with the use of personal data under the changes to the Policy, you must notify us by email.

Other privacy and data-safeguarding policies

Notwithstanding the above, each organisation that holds electronic votes with EVoting may have its own data-handling protocols, different from ours.