1. Data Controller

The owner of Astromind SpA acts as Data Protection Officer (DPO), in accordance with the provisions for micro and small businesses under Law No. 21,719.

2. Personal Data We Collect

We collect only the data necessary to operate the platform:

Registered users (tourism operators):

• Full name and email address
• Tax ID (for issuing electronic receipts)
• Subscription and payment data (processed by MercadoPago)
• If you request validation of your SERNATUR registration: RUT, registration number, link to your listing, and the certificate or screenshot of your registration
• Name, description, and location of the tourism business
• Images voluntarily uploaded for listing purposes

Unregistered visitors:

• IP address and browsing data (only with consent)
• Search queries within the platform
• Approximate geolocation for search filters (with prior browser authorization)

We do not collect sensitive data (health, ethnic origin, biometrics) or data from minors under 18.

3. Purposes and Legal Basis for Processing

• Account and access management: performance of the service agreement.
• Publishing tourism listings: performance of the agreement.
• SERNATUR registration validation: consent (you submit it voluntarily) and verification that the published information is accurate. Only the Turisters team can see it, and it is used solely to validate your registration.
• Payment processing: performance of the agreement and legal obligation.
• Sending transactional emails: performance of the agreement.
• Marketing communications: explicit consent (you can withdraw it at any time).
• Platform statistical analysis: legitimate interest in improving the service.
• Analytics and marketing cookies: prior explicit consent.

4. Transfer of Data to Third Parties

We do not sell or transfer personal data. We only share what is strictly necessary with the following providers:

• Amazon Web Services (AWS): computing and storage infrastructure (us-east-1 region, ISO 27001 certified).
• Google LLC: maps and address autocomplete service (Google Maps/Places).
• MercadoPago Chile S.A.: payment processing and recurring subscriptions. Turisters does not store card data.
• Amazon SES: sending transactional emails.
• Meta Platforms (Facebook): targeted advertising via Facebook Pixel (only if you accept marketing cookies).
• Meta Platforms (Instagram): displays the Instagram posts that users link on their profiles and listings. It only loads if you accept marketing cookies, and Meta may use its own cookies when loading them.

Data is stored on AWS servers outside of Chile. AWS operates under adequate contractual protection clauses and recognized international certifications.

5. Data Retention Period

• Account data: for as long as the account is active. Deleted within 30 business days after a cancellation request.
• SERNATUR validation data: while the account is active. The certificate is stored in a private, encrypted space and is deleted when you replace it or when you request it.
• Tax documents (receipts): 6 years, in accordance with SII (Chilean tax authority) regulations.
• Browsing and cookie data: up to 13 months.
• Backup copies: up to an additional 90 days after deletion.

6. Your Rights (Access, Rectification, Cancellation, Objection + Portability)

In accordance with Law No. 21,719, you have the right to:

To exercise any of these rights, write to us at privacidad@turisters.cl. We will respond within a maximum of 30 business days.

7. Use of Cookies

When you enter the site, a preferences panel will let you accept or decline each category:

8. Security of Your Data

• Encrypted communications via HTTPS/TLS across the whole platform.
• Passwords stored with bcrypt hashing.
• Database access restricted through least-privilege roles (RDS Proxy).
• AWS infrastructure with ISO 27001 and SOC 2 certifications.
• Encrypted backups with a maximum retention of 90 days.

In the event of a security breach affecting your data, we will notify the Personal Data Protection Agency within a maximum of 72 hours and affected individuals as soon as possible.

9. Minors

Turisters is not directed at people under 18 years of age. If we become aware that we have collected data from a minor, we will delete it immediately. If you are a parent or guardian and believe your child has provided data, contact us at privacidad@turisters.cl.

10. Changes to This Policy

When we make material changes, we will notify you through a prominent notice on the platform or by email, with at least 15 days' notice. The last-updated date will always appear at the top of this page.

11. Contact

For inquiries, rights requests, or complaints:

Astromind SpA · turisters.cl · Document subject to Law No. 21,719 on the Protection of Personal Data of Chile