Privacy Policy & Data Security Agreement

VFERJ PROFIT ("we," "us," "our," or the "Company"), operated by Viviana Ferj, provides specialized financial audit and marketing services to construction companies. We are committed to transparency, data security, and building trust. This Privacy Policy details exactly how we handle your information, ensuring compliance with applicable U.S. state laws (including the California Consumer Privacy Act – CCPA/CPRA) and Chilean data protection regulations.

1. Introduction & Scope

This policy applies to all data collected via our website, Client Portal, intake forms, and direct communications. In the context of data protection laws, you (the client) are the Data Controller, and VFERJ PROFIT acts strictly as the Data Processor on your behalf.

2. Information We Collect

We collect only the data strictly necessary to deliver our services:

• Identity & Contact Data: Name, business email, phone number, job title, and company name.
• Financial & Billing Data: Billing name, Tax ID/EIN, billing address, and payment routing details. Note: we do not store full credit card numbers; all payments are processed by PCI-DSS compliant third parties.
• Operational & Audit Data: Revenue, expenses, project costs, payroll figures, and related business records provided exclusively for audit and reporting purposes.
• Marketing Intake Data: Company description, target audience, website URL, and content preferences.
• Technical Data: IP address, browser type, and cookie data collected automatically to ensure website security and functionality.

3. How We Use Your Information

Your data is used solely for the following legitimate business purposes:

• To prepare, deliver, and manage your customized financial audit reports and marketing content.
• To process invoices, manage your account, and communicate about service status.
• To maintain the security and integrity of our Client Portal and infrastructure.
• To comply with binding legal, accounting, and tax obligations in the U.S. and Chile.

4. Data Ownership & Confidentiality

• You Own Your Data: All financial and operational data you provide remains your exclusive property.
• No AI Training: We explicitly guarantee that your financial, payroll, or operational data is never used to train, fine-tune, or improve any Artificial Intelligence (AI) or machine learning models.
• NDA Alignment: This policy complements and does not replace any specific Non-Disclosure Agreement (NDA) or Master Services Agreement (MSA) signed between us. In case of conflict, the stricter confidentiality terms shall prevail.

5. How We Protect Your Data

We implement enterprise-grade technical and organizational security measures, including:

• Encryption: Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256 standard).
• Access Control: Strict role-based access. Only authorized personnel directly working on your account can view your data, protected by multi-factor authentication (MFA).
• Secure Infrastructure: Our services are hosted on reputable, secure infrastructure providers (e.g., Hostinger, Amazon Web Services) with regular security patching.

6. Data Sharing & Third-Party Processors

We do not sell, rent, or trade your data. We only share minimal, necessary data with trusted, contractually bound subprocessors to operate our services:

• Payment Processing: PayPal or Wise (for secure, PCI-compliant transactions).
• Automation & Infrastructure: Make.com (for secure workflow automation), Hostinger (website hosting), and Amazon SES (secure email delivery).
• Professional Advisors: Legal or accounting professionals, only as required by law and under strict confidentiality.

7. International Data Transfers

VFERJ PROFIT operates from Santiago, Chile. By engaging our services, you acknowledge that your data will be processed in Chile. We guarantee that this cross-border transfer is protected by contractual clauses and security safeguards that provide a level of protection essentially equivalent to U.S. data protection standards.

8. Data Retention & Secure Destruction

We retain your personal and financial data only as long as necessary to fulfill the contracted service.

• For audit and financial records, we retain data for a minimum of seven (7) years to comply with standard U.S. and Chilean accounting, tax, and legal statutes of limitations.
• Upon expiration of this period, or upon your valid deletion request (subject to legal holds), data is permanently and securely destroyed or anonymized.

9. Data Breach Notification Protocol

In the unlikely event of a confirmed security breach that compromises your unencrypted personal or financial data, we commit to notifying you and the relevant regulatory authorities within 72 hours of discovery, providing clear details on the incident and remediation steps.

10. Your Privacy Rights (CCPA/CPRA Compliant)

Depending on your jurisdiction (including California residents), you have the right to:

• Know what personal data we collect and how it is used.
• Access and receive a portable copy of your data.
• Correct any inaccurate or incomplete information.
• Delete your personal information, subject to legal retention requirements.
• Opt-out of any "sale" or "sharing" of data (note: we do not sell or share data for cross-context behavioral advertising).
• Non-discrimination for exercising any of these rights.

To exercise these rights, email us at contact@vferjprofit.com with the subject line "Privacy Rights Request." We will verify your identity and respond within thirty (30) days.

11. Cookies & Tracking Technologies

We use essential cookies to maintain website security and Client Portal functionality. We do not use invasive third-party tracking cookies for unauthorized profiling. You can manage cookie preferences via your browser settings.

12. Children's Privacy

Our services are strictly intended for B2B transactions with adults. We do not knowingly collect data from individuals under the age of 18. If discovered, such data will be immediately deleted.

13. Changes to This Policy

We may update this policy to reflect operational or legal changes. The updated version will be posted on our website with a revised "Effective Date." Material changes will be communicated to active clients via email.

14. Contact Information

For any questions, concerns, or formal requests regarding this policy or your data, contact us directly:

• Company Name: VFERJ PROFIT (VFERJ PROFIT International)
• General Manager: Viviana Ferj
• Email: contact@vferjprofit.com
• Physical Address: Directo 6000, Of. 207, Las Condes, Santiago, Chile
• Website: vferjprofit.com