Privacy · 2026-07-31.1

IKFace Customer Portal Privacy Notice

Version: 2026-07-31.1

Effective date: 31 July 2026

1. Controller

Tecnologías IP LTDA., Chilean tax ID (RUT) 76.013.135-0, trading as INFOKRAUSE, with registered address at Av. Del Valle Sur 662 Of. 401, is the controller for the processing described in this notice.

Privacy enquiries and rights requests: privacy@infokrause.com.

INFOKRAUSE has not currently appointed a data protection officer or a European Union representative. We will do so if applicable law requires it. The contact above receives all privacy enquiries.

2. Scope

This notice applies to the IKFace Customer Portal, company registrations, demo requests, enrolments, Managed Appliances, licences, support and related communications. The portal is strictly business-to-business and intended for company representatives and authorised users.

It does not govern images, biometric templates or other data that a customer processes within its own IKFace Edge installation. The customer determines the purposes and responsibilities for that processing.

3. Data processed

We may process:

  • first and last name, corporate email, telephone number, language, and a

    • password stored only as a cryptographic hash;

  • legal and trading company names, address, city, country, and the user's

    • relationship with the company;

  • demo requests, approvals, rejections and communications;
  • customer, enrolment, intent, appliance, installation and licence identifiers;
  • technical identifiers such as device UUID, system UUID, fingerprint, serial

    • number or model where available;

  • operating system, processor, installed version, update status, capacity,

    • modules, last connection, IP address and interfaces where needed for security, activation or support;

  • evidence of acceptance, consent withdrawal and legal-document versions;
  • security and audit events, including network and browser information,

    • pseudonymised where compatible with the purpose;

  • requests to exercise privacy rights.

We do not request biometric data to create an account, process a demo or administer licences.

4. Purposes and legal bases

We process data as needed to:

  1. create and verify accounts, link users to companies and process demos as

    2. pre-contractual steps requested by the user and to manage the business relationship;

  2. administer appliances, licences, capacity, updates and support to perform

    3. the contractual relationship;

  3. prevent abuse, investigate incidents, preserve evidence and protect the

    4. service based on our legitimate interests in security, integrity and legal defence;

  4. comply with legal duties and valid authority requests;
  5. send marketing news only with separate, optional and revocable consent.

Marketing consent is not required to use the account or request a demo.

5. Recipients, processors and reCAPTCHA

Access is limited to authorised INFOKRAUSE personnel and providers required to operate the service:

  • infrastructure, storage and backups managed by INFOKRAUSE;
  • Google Workspace or Gmail SMTP for transactional email;
  • Google reCAPTCHA to prevent abuse and automation;
  • Chatwoot and chat.infokrause.cl and soporte.infokrause.cl for customer

    • service and support.

reCAPTCHA may receive technical and interaction data, including IP address, device or browser characteristics and usage signals, and use strictly necessary technologies such as the _GRECAPTCHA cookie, under Google's terms and policies.

Providers receive only the data needed for their function and are subject to their contractual terms and data-protection commitments. We do not sell personal data.

6. International transfers

Some providers may process data outside Chile or the user's country. We apply the required contractual safeguards and transfer mechanisms. Where the GDPR applies, we will rely on an adequacy decision, standard contractual clauses or another permitted mechanism. Information about these safeguards is available through the privacy contact.

7. Retention

We apply the following periods:

  • unverified accounts: 7 days;
  • verification tokens: 24 hours;
  • expired sessions: immediate technical deletion; related security evidence:

    • 90 days;

  • rejected or abandoned demo requests: 24 months;
  • inactive accounts without licences: 24 months;
  • licences, activations and contractual evidence: 5 years after the

    • relationship ends;

  • security and audit logs: 24 months, unless an investigation or legal duty

    • requires longer retention;

  • backups: no more than 90 days;
  • marketing data: until consent is withdrawn.

At the end of a period, data is erased or anonymised unless a legal duty, dispute or investigation justifies retention. Backups are not used to restore erased data and expire through their rotation cycle.

8. Security

We use access control, least privilege, transport encryption, password and token hashing, secure sessions, CSRF protection, rate limiting, audit logging and separation between the portal, License Manager and appliances. No system is infallible; we apply the appropriate legal and operational measures if an incident occurs.

9. Rights

Subject to applicable law, individuals may request access, rectification, erasure, restriction, objection and portability, and may withdraw consent without affecting earlier processing. They may also complain to the competent supervisory authority.

We may request reasonable information to verify identity. A request may be limited by law, security, fraud prevention or the need to retain contractual evidence; if so, we will explain the basis.

10. Automated decisions and children

We do not make decisions producing legal or similarly significant effects solely through automated processing. The portal is for businesses and is not directed to children.

11. Cookies and necessary technologies

The portal uses only cookies or storage necessary for security, sessions, language and operation. reCAPTCHA may use _GRECAPTCHA. We do not use advertising cookies in the portal without the required consent.

12. Changes

Each change will be published with a new version and effective date. For material changes, we will notify users and request renewed acceptance when required. We retain the accepted version as evidence.