Privacy Policy and Personal Data Processing

This Privacy Policy and Personal Data Processing Policy explains how Inversiones El Morro SpA, Tax ID (RUT) 78.443.427-3, trading under the Western Patagonia brand (hereinafter, “Western Patagonia”, “we”, “us” or the “Data Controller”), collects, uses, stores, protects and, where applicable, discloses personal data through www.western-patagonia.com (the “Website”), its forms, communications and associated services.

This Policy has been prepared with regard to Chilean legislation currently applicable to the protection of personal data and will be updated where necessary as a result of legislative, regulatory or technological changes, or changes to the processing activities carried out by the Data Controller.

1. Data Controller

The Data Controller responsible for the processing of personal data collected through the Website is:

• Inversiones El Morro SpA
• RUT: 78.443.427-3
• Trading name: Western Patagonia
• Registered address: Astilleros s/n, Dalcahue, Los Lagos Region, Chile
• Legal Representative: Felipe Eduardo Jugo de las Heras
• Privacy contact: explore@western-patagonia.com

For any enquiry, request or exercise of rights relating to personal data, you may contact us at:

explore@western-patagonia.com

2. Scope of this Policy

This Policy applies to personal data that we collect or process through:

• www.western-patagonia.com;
• contact forms and information requests;
• forms used on campaign pages or landing pages;
• subscriptions to the “Captain's Log”;
• communications made by email;
• measurement, analytics and advertising technologies used on the Website;
• communications initiated through WhatsApp, to the extent that Western Patagonia has access to the relevant information.

This Policy does not govern the processing of personal data carried out directly by third parties in connection with their own services, platforms or websites, which are subject to their respective privacy policies.

3. Personal data we may collect

We collect only data that is necessary and relevant for the purposes described in this Policy.

3.1. Enquiries and requests

When a person uses our forms, we may collect:

• name;
• email address;
• telephone number or WhatsApp number, where provided;
• type of service or experience of interest;
• area, territory or voyage of interest;
• estimated travel date or period;
• number of passengers, where provided;
• content of the message or enquiry;
• page or form from which the request was submitted;
• date and time of the request;
• information necessary to manage and respond to the enquiry.

We do not deliberately request sensitive personal data through the Website's general forms.

Please do not include sensitive or unnecessary personal information in your enquiry.

3.2. Captain's Log

To subscribe to the “Captain's Log”, we primarily collect:

• email address;
• date and time of the subscription request;
• confirmation of the subscription;
• information necessary to manage the subscription and preferences.

The subscription uses an email confirmation mechanism. An email address will not be added to our mailing list until the confirmation process has been completed.

3.3. Technical data

Depending on the Website configuration and the cookie preferences selected by the user, we may process technical information such as:

• IP address;
• browser;
• operating system;
• device type;
• browsing information;
• technical identifiers;
• pages visited;
• date and time of access;
• referring website or source.

The scope of such collection depends on the technologies that are active and the cookie preferences selected by the user.

4. How we use personal data

We use personal data only for defined, explicit and legitimate purposes related to our activities.

These purposes may include:

a) Managing enquiries

We use the information provided to:

• respond to enquiries;
• provide information about our services;
• understand the requirements expressed in a request;
• prepare proposals;
• coordinate dates, voyages, vessels, activities and services;
• maintain communications directly related to an enquiry;
• manage a potential booking, charter, expedition, journey or service.

b) Managing contractual or pre-contractual relationships

Where a person requests information, a quotation or coordination of a service, we may process their data to the extent necessary to manage that request, prepare a proposal, enter into or perform a contract, or take pre-contractual steps requested by the individual.

c) Managing the “Captain's Log”

Where a person subscribes and confirms their subscription, we use their email address to send the Captain's Log and manage the subscription.

d) Website security

We may process technical information to prevent abuse, unauthorised access, fraud, spam, cyberattacks and other improper uses of the Website.

e) Analytics

Where the user has provided the applicable consent, we may use analytics tools to understand how the Website is used, improve its operation and assess the performance of our content.

f) Advertising and measurement

Where the user has provided the applicable consent, we may use advertising measurement technologies to assess the performance of our campaigns and advertising content.

With that consent, we may also show our ads on Meta and Google to people who have visited the Website (remarketing).

g) Legal obligations

We may process and retain information where necessary to comply with legal, tax, accounting or regulatory obligations, or with valid requests from competent public authorities or courts.

h) Exercise or defence of rights

We may retain or use information where reasonably necessary to establish, exercise or defend legal rights before courts, administrative authorities or other competent bodies.

5. Legal basis for processing

Personal data will be processed on the legal basis applicable to the specific purpose.

Depending on the circumstances, this may include:

• the individual's consent;
• management of a request made by the individual;
• taking pre-contractual steps at the individual's request;
• entering into or performing a contract;
• compliance with legal obligations;
• establishing, exercising or defending legal rights;
• other lawful grounds established by applicable legislation.

Where consent is legally required, it will be requested in advance, in an informed manner and through a clear affirmative action.

Consent may be withdrawn in accordance with applicable law. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

Withdrawal of consent will not necessarily prevent us from continuing to process information where another lawful basis permits such processing, for example where processing is required by law or is necessary in connection with an existing contractual relationship.

6. Consent

Where applicable law requires consent for a particular processing activity, we will request a free, informed and specific expression of consent for the relevant purpose.

We will not use pre-ticked boxes as a mechanism for obtaining consent.

The Data Controller may retain evidence of consent, including the date, method, purpose communicated and version of the information presented to the individual.

Withdrawal of consent will not affect processing lawfully carried out before withdrawal.

7. Captain's Log and marketing communications

Subscription to the “Captain's Log” is voluntary.

The individual must confirm their email address through the mechanism provided in order to complete the subscription.

The email address used for the Captain's Log will not be sold or disclosed to third parties for their own marketing campaigns.

Each Captain's Log communication will include a mechanism for unsubscribing.

Unsubscribing from the Captain's Log does not necessarily result in the immediate deletion of all information that Western Patagonia may be required to retain for contractual, legal, security or rights-protection purposes.

8. Cookies and similar technologies

The Website may use cookies and similar technologies.

When first accessing the Website, users may be presented with a preference-management mechanism allowing them, where applicable, to:

• accept optional categories;
• reject optional categories and use only necessary technologies;
• configure preferences by category.

8.1. Necessary cookies

These technologies are required for basic Website functionality, security, navigation and the storage of certain preferences.

They may be used without consent where they are strictly necessary to provide a service requested by the user or for the technical operation of the Website, in accordance with applicable law.

8.2. Analytics

We may use Google Analytics 4, potentially implemented through Google Tag Manager, to obtain statistics regarding use of the Website.

These technologies will only be loaded where permitted by the user's selected cookie preferences.

8.3. Advertising and measurement

We may use Meta Pixel or equivalent technologies to measure advertising campaigns and understand interaction with our content.

These technologies will only be loaded where the user has accepted the relevant category, where required by applicable law.

The Website does not intentionally transmit the content of users' enquiries to such tools.

With consent to Advertising, Meta and Google may use visit data to measure and personalise ads, including showing our ads to people who have visited the Website (remarketing). We do not share names, email addresses, phone numbers or the content of enquiries, nor do we use customer lists. Consent can be withdrawn at any time through “Cookie preferences”.

8.4. Non-cookie visit statistics

The Website hosting provider may generate aggregated visit statistics using technical mechanisms that do not use cookies, depending on the configuration of the relevant service.

Such statistics may include information such as the page visited, referring website, country, browser and device type.

8.5. Managing cookie preferences

Cookie preferences may be stored in the user's browser.

Users may change or withdraw their preferences through the “Cookie Preferences” mechanism available on the Website where such functionality is enabled.

Where technically applicable, withdrawing consent for an optional category will stop the use of technologies included in that category and remove the corresponding cookies that are under the Website's control.

9. Anti-bot verification

The Website forms may use technological services designed to distinguish human users from automated systems and to prevent spam, abuse and automated attacks.

These services may process technical information, including IP addresses, browser characteristics, device information and other technical indicators.

Such mechanisms are used primarily for the security and protection of the Website and its forms.

The relevant provider may process information in accordance with its own terms and privacy policies.

10. WhatsApp

If you choose to contact us through WhatsApp, the communication will take place through the infrastructure of WhatsApp/Meta.

Western Patagonia may access the information and content contained in such communication to the extent necessary to respond to and manage your enquiry.

Processing carried out directly by WhatsApp or Meta in connection with its platform is subject to the relevant provider's own terms and privacy policies.

We do not control processing activities carried out directly by WhatsApp or Meta on their own platforms.

11. Email

Communications sent directly to explore@western-patagonia.com may be stored within the systems of the email service provider used by Inversiones El Morro SpA.

We use such information to:

• respond to communications;
• manage enquiries;
• coordinate services;
• maintain communication records;
• comply with legal obligations;
• protect our rights.

The email service provider may process information in accordance with its own terms, privacy policies and applicable agreements.

12. Who we may share data with

Western Patagonia does not sell personal data.

We do not disclose personal data to third parties for their own commercial purposes unless there is a lawful basis permitting such disclosure and it is authorised by applicable law.

We may allow access to personal data by service providers acting on our behalf where necessary to operate the Website or provide our services, including providers of:

• web hosting;
• technological infrastructure;
• databases;
• email services;
• forms;
• information security;
• anti-bot verification;
• analytics;
• advertising tools, where applicable;
• technological services related to our communications.

Such providers will have access only to the information necessary to provide the contracted services, in accordance with the applicable contractual arrangements and law.

Where appropriate, agreements with data processors will regulate the purposes, duration, categories of data, categories of individuals and obligations of the parties.

13. International data transfers

Some technology providers used by Western Patagonia may be located outside Chile or provide services from jurisdictions outside Chile.

As a result, certain personal data may be processed or stored internationally.

Where international transfers take place, we will seek to ensure that they are carried out in accordance with the requirements and mechanisms established by applicable Chilean law, including, where appropriate, contractual mechanisms, standard contractual clauses, appropriate safeguards or other legally recognised mechanisms.

Where an international transfer requires a particular legal basis, safeguard or additional condition, this will be implemented before or at the time the transfer takes place, as applicable.

14. Data retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected.

As a general rule:

• enquiries that do not result in a contractual relationship may be retained for up to 12 months from the date the enquiry is closed, unless there is a legitimate reason to retain them for a longer period;
• data associated with a contractual relationship may be retained throughout the relationship and subsequently for the periods necessary to comply with legal, tax or accounting obligations, resolve disputes, or establish, exercise or defend legal rights;
• data associated with the “Captain's Log” may be retained while the individual remains subscribed;
• records required to demonstrate consent, respond to data-rights requests, maintain security or demonstrate compliance may be retained for as long as reasonably necessary for those purposes.

Once the relevant purpose has been fulfilled and applicable retention periods have expired, data will be deleted, anonymised or otherwise rendered non-identifiable where appropriate.

15. Information security

Inversiones El Morro SpA implements reasonable technical and organisational measures proportionate to the nature of the data and the risks involved in processing, in order to protect personal data against:

• unauthorised access;
• loss;
• destruction;
• alteration;
• unauthorised disclosure;
• unlawful processing;
• data breaches;
• uses incompatible with the purposes described in this Policy.

Access to personal data is restricted, to the extent reasonably possible, to individuals and service providers who need access in order to fulfil the purposes described in this Policy.

No electronic storage, transmission or communication system can guarantee absolute security. Accordingly, while we adopt reasonable safeguards, we cannot guarantee that a security incident will never occur.

If a security incident occurs that may affect personal data, we will take the measures required under applicable law.

16. Confidentiality

Individuals who, by virtue of their duties or provision of services to Western Patagonia, have access to personal data must maintain appropriate confidentiality regarding such information.

This obligation continues after the employment, contractual or service relationship that gave rise to the access has ended.

17. Rights of individuals

Subject to applicable law, individuals may exercise the rights available to them in relation to their personal data.

These may include:

• access to personal data;
• correction of inaccurate or incomplete data;
• deletion or erasure where applicable;
• objection to processing where provided by law;
• data portability, where applicable;
• blocking, where applicable under the relevant legal framework;
• withdrawal of consent where processing is based on consent.

Requests may be submitted to:

explore@western-patagonia.com

Requests should reasonably identify the applicant, the data or processing concerned and the right being exercised.

We may request reasonable information to verify the identity of the requester where necessary to protect personal data against fraudulent or unauthorised requests.

Requests will be handled within the time limits and in accordance with the procedure established by applicable law.

18. Right to complain to the competent authority

If an individual considers that their data-protection rights have not been respected, they may use the complaint and enforcement mechanisms established by Chilean law before the competent authority.

Following the entry into force of the regime established by Law No. 21,719, this will include, where applicable and subject to the conditions established by that law, the possibility of lodging a complaint with the Chilean Data Protection Agency (Agencia de Protección de Datos Personales).

19. Data relating to third parties

If a person provides Western Patagonia with personal data relating to another individual, that person represents that they have the necessary authority, authorisation or lawful basis to provide such information and to allow it to be processed in accordance with this Policy.

Where appropriate, the person providing such information should inform the relevant third party about the processing.

20. Children and minors

The Website is not specifically directed at children or minors.

Where personal data relating to children or adolescents is processed, Western Patagonia will apply the special rules established by applicable Chilean law.

We do not deliberately request sensitive personal data relating to minors through the Website's general forms.

If a parent or legal representative believes that a minor has provided personal data improperly, they may contact us at explore@western-patagonia.com.

21. Sensitive personal data

Western Patagonia does not deliberately request sensitive personal data through the Website's general forms.

If it becomes necessary, exceptionally, to process sensitive personal data for a particular purpose, such processing will only take place where an appropriate legal basis exists and the safeguards required by applicable law are implemented.

22. Automated decision-making and profiling

We do not use information submitted through our forms to make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals.

Analytics or advertising platforms used on the Website may carry out automated processing in accordance with the functionality of those platforms and their respective privacy policies.

23. Accuracy of information

We ask users to provide accurate, complete and up-to-date information where necessary to manage their requests.

Western Patagonia may request clarification or correction where information provided is insufficient, inaccurate or necessary to properly provide the requested service.

24. Third-party websites

The Website may contain links to websites, platforms or services operated by third parties.

Western Patagonia does not control the privacy practices of such third parties.

Access to those websites is undertaken at the user's own discretion and is subject to the privacy policies and terms of use of their respective operators.

25. No sale of personal data

Inversiones El Morro SpA does not sell personal databases or commercialise personal data collected through Western Patagonia.

Personal data will not be used for purposes incompatible with those communicated at the time of collection unless another lawful basis permits such processing.

26. Changes to this Policy

We may amend this Policy when:

• applicable legislation changes;
• processing purposes change;
• technological tools are introduced or removed;
• service providers change;
• processing activities are modified;
• it is necessary to improve the information provided to individuals.

The current version will remain available on the Website.

Where a change materially alters the purposes or conditions of processing and applicable law requires further information or consent, we will take the measures required by law.

27. Applicable law

This Policy is governed by the laws of the Republic of Chile.

Personal data processing is currently governed principally by Law No. 19,628 on the Protection of Private Life, together with other applicable Chilean legislation.

Law No. 21,719, published on 13 December 2024, substantially reforms Chile's personal data protection framework and establishes the Chilean Data Protection Agency. Its entry into force is scheduled for 1 December 2026.

This Policy has been prepared taking into account both the current legal framework and the standards and obligations established by Law No. 21,719 in order to facilitate the transition to the new regime.

28. Contact

For enquiries relating to this Policy, personal data processing, privacy or the exercise of data-protection rights:

• Inversiones El Morro SpA
• RUT: 78.443.427-3
• Trading name: Western Patagonia
• Registered address: Astilleros s/n, Dalcahue, Los Lagos Region, Chile
• Legal Representative: Felipe Eduardo Jugo de las Heras
• Email: explore@western-patagonia.com