Soyio Platform Terms of Use

So that we speak the same language, these are the key terms used throughout this document.

• —Soyio: Soyio SpA, RUT 77.830.754-5, domiciled at Avenida Andrés Bello 2447, oficina 3404, comuna de Providencia, Región Metropolitana, Chile.
• —Platform: the set of software, modules, components, APIs, SDKs, interfaces and functionalities that Soyio makes available to provide the Services.
• —Prisma AI: an artificial-intelligence-assisted service that enables the Client to build, maintain and analyze its Record of Processing Activities (RoPA) and the related privacy governance documentation. It is not integrated into the Client’s digital flows; it operates as an analysis and documentation tool whose outputs the Client must review and validate before using them.
• —Consent Management: a module for requesting, recording, versioning and revoking data subjects’ consent to the processing of their personal data, generating verifiable evidence of each consent.
• —Rights Manager: a module for receiving, managing and responding to requests from data subjects to exercise their rights over their personal data, while keeping auditable evidence of the process.
• —Identity Verification: a module for verifying a person’s identity in digital channels using the methods the Client configures (facial biometrics with liveness detection, identity document validation and/or checks against official sources), generating evidence of each verification process.
• —Authentication: a module for authenticating previously verified individuals, using facial biometrics or passkeys, to confirm access or actions in digital channels.
• —Cookie Management: a module for configuring and publishing a cookie banner on the Client’s websites, recording visitors’ preferences and generating evidence of each consent given, refused or withdrawn.

The functional scope of each module, its integration method (embeddable components, APIs, SDKs or dashboard) and its specific conditions are set out in the applicable service annex or commercial proposal.

• —Services: the modules and functionalities of the Platform actually contracted by the Client, as set out in the applicable commercial proposal or annex.
• —Client: the company or organization that contracts or uses the Services.
• —Authorized Users: the individuals the Client authorizes to access and operate the Platform on its behalf, such as its administrators, staff or representatives.
• —Client Data: the information, data and content that the Client or its Authorized Users upload, enter or make available through the Platform, as well as the data generated in the Platform through use of the Services on the Client’s behalf (for example, consent records, verification evidence or activity logs).
• —Personal Data: any information linked or relating to an identified or identifiable natural person, as provided in Law No. 19,628 as amended by Law No. 21,719, or any other regulation that amends, replaces or supplements it, that is processed through the Platform.
• —Soyio Account: the account an individual creates with Soyio to keep their verified identity and reuse it with organizations that use the Services, governed by the Soyio Account Terms and Conditions.
• —Agreement: the service agreement and its annexes entered into by the parties, including the Service Level Agreement Annex (SLA) and the Data Processing Agreement (DPA), where applicable.
• —Terms: this Platform Terms of Use document.
• —Controller: the natural or legal person that determines the purposes and means of processing Personal Data. In the relationship governed by these Terms, the Client acts as Controller of the Personal Data it processes through the Platform, including the data generated in the course of providing the Services on its behalf.
• —Processor: the natural or legal person that processes Personal Data on behalf of, and according to the instructions of, the Controller. Soyio acts as Processor of the Personal Data that the Client entrusts to it for the provision of the Services, including the Personal Data processed through the Platform.

Technical data protection terms not defined here shall be interpreted in accordance with Law No. 19,628 as amended by Law No. 21,719, or any other regulation that amends, replaces or supplements it.

By using the Platform, you accept these Terms. Acceptance may be given expressly, by accepting a commercial proposal, or by starting to use the Platform. When acceptance takes place within the Platform, Soyio will record the accepted version, the date and time, the Authorized User who accepts and the Client they represent. If you accept on behalf of a company, you represent that you have sufficient authority to bind it. Use of the Platform by any Authorized User shall be deemed to be on behalf of and in representation of the Client.

In the event of any conflict between the instruments governing the relationship, they shall prevail in the following order: (i) the service Agreement entered into by the parties and its annexes; (ii) the non-disclosure agreement (NDA) entered into, on matters of confidentiality; (iii) these Terms; and (iv) the accepted commercial proposal.

The parties acknowledge that their shared intention is to enter into a service Agreement and, where applicable, an NDA, which, once signed, shall prevail over these Terms and the proposal. Until those instruments are signed, these Terms and the accepted commercial proposal govern the relationship between the parties on a binding basis, so that the relationship is never without a legal framework.

Our Platform is modular. Only the Services or modules expressly identified as contracted in the applicable proposal or annex shall be deemed contracted and enforceable. Other modules, functionalities or materials provided for reference do not create obligations for Soyio unless they are expressly contracted or activated in writing.

The addition of new functionalities or improvements to the Platform does not mean they are automatically included in the contracted plan. If you choose to use new functionalities or improvements to existing ones, this may involve an adjustment to the monthly fee in accordance with the commercial terms in effect at the time of activation; Soyio will inform you in advance of the new applicable price and the date the change takes effect.

We may evolve and adjust the Platform. Soyio may modify, update or discontinue Platform functionalities for technical, security or continuous-improvement reasons, while seeking not to substantially affect the essential functionalities of the contracted Services. When a relevant change may affect you, we will notify you reasonably in advance.

Soyio may rely on technology providers to deliver the Services. We may use infrastructure, cloud services, APIs, artificial intelligence tools and other technical resources or services needed to operate, maintain and improve the Platform, without this constituting an assignment of the relationship or affecting our responsibilities to you.

We distinguish between a test environment and a production environment. The Platform includes a test environment, intended for configuration, integration and testing, and a production environment, intended for actual use of the Services. Service levels and availability commitments apply only to the production environment of the contracted Services.

We work to keep the Platform available and give you timely support. Soyio targets monthly availability of 99.5% and annual availability of 99.9%, and 99% monthly for Prisma AI. These targets are for reference only and do not constitute an enforceable service level unless and until the Service Level Agreement Annex (SLA) is signed, which will define the binding metrics, exclusions and remedies. Even where an SLA is signed, its commitments apply only to the Services expressly contracted in the applicable service annex; modules you use without a signed service annex (for example, in proofs of concept or pilots) are provided without enforceable service levels. In the absence of a signed SLA, no service credits, penalties or remedies for unavailability shall be enforceable.

We do not count as unavailability attributable to Soyio any interruptions or degradation caused by:

• —scheduled or emergency maintenance notified reasonably;
• —acts, configurations, integrations or systems of you or your Authorized Users;
• —failures of third-party providers, networks or infrastructure beyond Soyio’s reasonable control;
• —connectivity problems or problems with end users’ devices;
• —use outside the contracted scope; and
• —force majeure events.

If you sign an SLA, availability exclusions are governed in detail by that annex.

We classify and handle incidents and requests according to their priority. Incidents and support requests are classified according to their impact and severity and are handled in line with the applicable response times. The initial classification may be adjusted while the case is handled, based on the information available and the actual impact observed. To receive timely attention, the Client must report incidents and requests only through the enabled support channels, namely the email address soporte@soyio.id, the support chat available within the Platform and, to report critical incidents, the email address incidentes@soyio.id, or any others Soyio communicates in writing, providing the information reasonably necessary for diagnosis.

Enforceable service levels are defined in the Agreement. Binding availability metrics, response times, exclusions, service credits and other specific remedies are governed by the Service Level Agreement Annex (SLA) and the service Agreement, which prevail over any reference in these Terms. This section is for information only and does not, by itself, constitute an enforceable service level commitment independently of those instruments. Soyio publishes the operational status of its Services at https://soyio.instatus.com/, where you can also subscribe to alerts. This status page is for information only and does not create enforceable commitments other than those set out in the Agreement.

When we process Personal Data on your behalf, we act as Processor. For the Personal Data you entrust to us, you are the Controller and Soyio is the Processor. You represent that the sole purpose of the processing is to provide the Services you have contracted or are using, and that, as Controller, you have a lawful basis that permits it. Soyio will process this data only on your documented instructions and for those purposes, in compliance with Law No. 19,628 and Law No. 21,719, as well as any regulations that amend or replace them.

We do not use the data for our own purposes. Soyio does not use the Personal Data processed on your behalf for its own, commercial or advertising purposes, does not sell it to third parties and does not use it to train its own or third-party models, unless the data has been previously anonymized or you have given your prior, express written authorization, including the authorization you grant in the following paragraph.

Identity reuse with a Soyio Account. A data subject who has or creates a Soyio Account may prove their identity to you by authenticating, without repeating the full Identity Verification. To that end, you authorize Soyio to add to the data subject’s Soyio Account, only with their express consent, the result of the Identity Verification that Soyio performs on your behalf. With respect to the Soyio Account, Soyio acts as Controller under the Soyio Account Terms and Conditions and its Privacy Notice. You may revoke this authorization, or always require a full Identity Verification, by giving us written notice.

There is some data we process as Controller. Soyio acts as Controller of your Authorized Users’ identification, contact and account data (name, email, job title, credentials, and access and activity logs) and of the Platform operation, security and billing data that Soyio processes for its own purposes. It processes this data to enable and manage access, provide support, safeguard the security and traceability of the Platform, measure its use with pseudonymized data in order to improve it, and invoice, on the basis of performing the relationship with the Client and of its legitimate interest. It retains this data for as long as the Authorized User keeps access and, thereafter, for the period needed to comply with legal obligations or defend rights. Authorized Users may exercise their rights at privacidad@soyio.id, and Soyio’s Privacy Notice supplements this information.

We look after security and let you know if something happens. We implement and maintain technical and organizational security measures appropriate to the risk, aimed at safeguarding the confidentiality, integrity, availability and resilience of information. In the event of a security incident affecting Personal Data processed on your behalf, we will notify you without undue delay once we have reasonable confirmation of the incident, within the time frame and in the manner set out in the Agreement or the signed DPA, providing the information available and cooperating with you in managing, containing and remediating it.

You agree that we may work with sub-processors and process data outside Chile. To provide the contracted Services, you authorize Soyio to delegate part of the processing to sub-processors and to carry out international transfers of, access to or storage of Personal Data, to the extent necessary to provide those Services and always with safeguards equivalent to those in these Terms. Soyio maintains an up-to-date list of relevant sub-processors at trust.soyio.id and gives notice when new relevant sub-processors are added; the prior-notice and reasoned-objection regime, where applicable, is governed by the DPA. The current list of sub-processors and the applicable jurisdictions are deemed accepted by the Client as published there.

You handle data subjects’ rights, with our help. As Controller, you are the one who receives, assesses and responds to data subjects’ requests to exercise their rights. Soyio will provide you with reasonable assistance and, if a data subject contacts us, we will refer them to you as Controller.

We support you in your compliance obligations, under the terms of the Agreement. Assistance with impact assessments, regulatory requests and audits is provided only under the terms, time frames and limits agreed in the signed Agreement and DPA.

When the relationship ends, we return or delete the data. Once the relationship ends, we will give you a reasonable period to export or back up your information and, after that period, we will delete the Personal Data and Client Data processed on your behalf, except for data we are legally required to retain.

The details of the processing (categories of data, purposes, security measures, retention periods and assistance obligations) are governed by the Data Processing Agreement (DPA) that the parties sign as part of the service Agreement.

Notwithstanding the above, binding conditions, notification time frames and other matters are governed by the Agreement, the Service Annexes and the SLA, which prevail over any reference in these Terms.

You use the Platform lawfully and in accordance with these Terms. You undertake to use the Platform and the Services in accordance with these Terms, the technical documentation, the Agreement and applicable law; not to use them for unlawful, fraudulent or unauthorized purposes; and not to upload or host on the Platform information unrelated to the Services or that infringes third-party rights or applicable law.

You are responsible for your Authorized Users. You are responsible for enabling, managing and revoking your Authorized Users’ access, for safeguarding the confidentiality of their credentials, for using the available security features in line with your organization’s requirements, and for the actions they take on the Platform on your behalf.

You manage your credentials and access diligently. You must keep credentials and access keys (including API keys) confidential, enable multi-factor authentication where the Platform allows it, assign roles and permissions according to the principle of least privilege, rotate access keys periodically and promptly revoke the access of anyone who is no longer authorized. You must notify us without delay of any unauthorized use or security compromise of your credentials that comes to your attention.

You provide accurate information and have a lawful basis. You warrant that the information you provide is true, accurate and up to date, and that you have a sufficient lawful basis and the necessary authorizations for the Client Data and Personal Data you process through the Platform. You are responsible for the lawfulness, quality and content of that data, as well as for the texts, purposes, consents and other configuration decisions you define.

You configure and review the Platform’s outputs. You are responsible for defining, reviewing, validating and approving the configurations, texts and parameters, and the outputs generated by the Platform or its artificial-intelligence-assisted features, before using them, communicating them to third parties or incorporating them into your processes. Soyio provides supporting technology tools without taking on the compliance decisions that are yours as Controller.

You maintain the technical requirements on your side. You are responsible for the systems, equipment, networks, connectivity and integrations on your side that are needed to access and operate the Platform, in accordance with the technical documentation, as well as for the quality and security of those integrations.

Some uses are not permitted. When using the Platform, you undertake not to engage in, or allow third parties to engage in, the following conduct:

• —Accessing or attempting to access the Platform, systems or data without authorization, or circumventing or breaching its security measures, authentication or technical limits.
• —Reverse engineering, decompiling or attempting to obtain the source code, architecture or know-how of the Platform, except to the extent mandatorily permitted by law.
• —Introducing malicious software, viruses or harmful code, or taking actions that may affect the integrity, security, stability or availability of the Platform.
• —Performing security testing, ethical hacking or vulnerability scans on the Platform, or deploying RPA, bots or other unauthorized automation that may affect its security or performance, without Soyio’s prior written authorization.
• —Scraping, mass automated extraction, deliberate overloading or use that exceeds reasonable or contracted capacity and consumption limits.
• —Reselling, sublicensing, leasing or making the Platform available to third parties other than your Authorized Users, except with Soyio’s express authorization.
• —Using the Platform to store or process data for unlawful purposes, or uploading content that infringes third-party rights or applicable law.
• —Impersonating third parties or providing false information to Soyio.
• —Directly or indirectly performing load, stress, volume, concurrency or performance testing, mass request automation or other similar testing on the platform, APIs, production environments, test environments, infrastructure or components associated with the Services, where such testing may affect the availability, stability, security, integrity, continuity, performance or normal operation of the Services, of Soyio, of other clients or of third-party technology providers.
• —If the Client needs to perform testing of this kind, it must request it from Soyio in advance and in writing, specifying at least the scope, environment, dates, duration, estimated volume, expected concurrency, tools to be used and purpose of the test. Soyio may reasonably approve, reject, limit, reschedule or set conditions on such testing, taking into account security, operational continuity, technical capacity, available infrastructure, impact on third parties, the technology providers involved and applicable commercial terms.
• —Unless the parties expressly agree otherwise in writing, load, stress, volume, concurrency or performance testing shall not be deemed included in implementation, functional testing, UAT, standard support or contracted service levels, and may require a quote, a dedicated environment, an operating window, technical support or specific conditions.
• —Testing carried out without Soyio’s prior authorization, or outside the approved parameters, shall not be taken into account in calculating availability, response times, incidents, service credits, discounts, fines, penalties, SLA breaches or any other remedy associated with service levels. If Soyio detects unauthorized testing, or activities that create risk to the platform, the Services, security, availability or operational continuity, it may take reasonable mitigation measures, including temporary traffic limitation, rate limiting, blocking of requests, preventive suspension of credentials or suspension of access to the relevant environment, informing the Client as soon as reasonably possible.

Use of the Platform in breach of this clause constitutes a material breach and entitles Soyio to suspend or restrict access, without prejudice to any other actions available under these Terms, the Agreement and the law.

We provide the Services with professional diligence. Soyio warrants that it will provide the Services with the professional skill and diligence customary in the industry, using appropriate technology, and that it holds the authorizations needed to provide them. If faults or defects attributable to Soyio are detected while the Services are being provided, we will seek to correct or remedy them within a reasonable time, at no additional cost to you.

The Platform is provided as is and as available. Except for the preceding warranty and as mandatorily provided by the Agreement and the law, the Platform and the Services are provided “as is” and “as available,” without any additional warranties, express or implied. Soyio does not warrant that the Platform will operate uninterrupted or error-free, or that it will be fit for purposes other than those expressly contracted.

Identity Verification and Authentication results are probabilistic. They express a level of certainty in line with the state of the art and the thresholds you configure, and do not constitute an absolute guarantee of identity. Soyio does not guarantee the detection of every impersonation or fraud attempt. It is up to you to define the thresholds and decide the consequences of each result in your processes.

You are responsible for use and for your compliance decisions. Soyio provides supporting technology tools, traceability and assistance. Compliance decisions, the definition of purposes and lawful bases, and the validation of the Platform’s outputs are yours as Controller, in accordance with clause 6.

We are liable for the direct damages we cause, within a reasonable limit. Each party is liable to the other for direct, provable and attributable damages arising from a breach of its obligations. Soyio’s total aggregate liability, for any cause related to the Services, shall be limited to the amount actually paid by the Client to Soyio during the twelve (12) months preceding the event giving rise to the liability.

We are not liable for indirect damages. To the extent permitted by law, Soyio shall not be liable for indirect, incidental or consequential damages, lost profits or loss of business opportunities, or for damages arising from causes beyond its reasonable control or attributable to the Client, its Authorized Users or third parties.

This limit does not apply in cases of willful misconduct or gross negligence. The foregoing limitations and exclusions shall not apply, and the liable party shall be liable for the full amount of the damages, in cases of willful misconduct or gross negligence.

Each party shall indemnify and hold the other harmless against third-party claims directly caused by a breach attributable to it, including, in your case, claims arising from the lack of a lawful basis or from a breach of clause 7. Soyio’s indemnification obligation is subject to the limit in the first paragraph, except in cases of willful misconduct or gross negligence.

The relationship continues for as long as you use the Services. These Terms apply for as long as you use the Platform or have contracted Services. The term, renewal and termination conditions of each Service are set out in the applicable proposal and Agreement.

We may suspend access in justified cases. Soyio may suspend access to the Platform, in whole or in part, in the event of use in breach of clauses 6 or 7, a security risk, an instruction or processing that could involve a breach of applicable law, or significant late payment for the Services. Where possible, we will give prior notice and will seek to restore access once the cause has been remedied.

We may terminate in the event of a material breach. Either party may terminate the relationship in the event of a material breach by the other that is not cured within the period granted for that purpose, without prejudice to any additional grounds set out in the Agreement. Termination shall not affect obligations accrued beforehand.

When the relationship ends, we wind it down in an orderly way. Upon termination, your right to access the Platform and the Services shall cease. We will give you a reasonable period to export or back up your information, in accordance with clause 5, after which we will delete the data as provided there.

Some obligations survive termination. Provisions that by their nature must survive shall remain in force after the relationship ends, including those relating to confidentiality, data protection, intellectual property, liability, survival and dispute resolution.

We are not liable for causes beyond our reasonable control. Neither party shall be liable for any failure or delay in performing its obligations when it is due to unforeseeable events or force majeure, meaning events beyond the reasonable control of the affected party, including, without limitation, widespread power or internet outages, failures or unavailability of infrastructure or cloud service providers, cyberattacks by third parties that could not have been prevented with reasonable security measures, natural disasters, acts of government, civil unrest or pandemics.

We give notice and resume as soon as possible. The affected party must inform the other within a reasonable time and take the measures within its reach to mitigate the effects of the event and resume performance as soon as circumstances allow. If the force majeure situation continues in a way that substantially prevents the provision of the Services for an extended period, either party may terminate the relationship with respect to the affected Services, without liability.

We protect your confidential information, and you protect ours. Each party undertakes to keep strictly confidential any non-public technical, commercial, financial or operational information it receives from the other in connection with the relationship, and to use it only for the purposes of the Services. This obligation remains in force throughout the relationship and for five (5) years from the last exchange of confidential information. It does not apply to information that is in the public domain, that the receiving party already lawfully held, that it lawfully receives from a third party without a duty of confidentiality, or whose disclosure is required by law or a competent authority. If the parties sign an NDA, it shall prevail over this clause.

The Platform belongs to Soyio; your data is yours. All intellectual and industrial property rights in the Platform, its software, code, APIs, methodologies, documentation, tools, templates, processes, know-how, functionalities, improvements, updates and developments (whether pre-existing or developed in connection with the provision of the Services or during the relationship) are and shall remain the exclusive property of Soyio. You retain ownership of the Client Data you make available for the provision of the Services, which Soyio will use only to the extent necessary to provide them.

We grant you a license to use the Services, subject to certain limits. Soyio grants you a non-exclusive, non-transferable and non-sublicensable license to the Services in use, valid for the duration of the relationship and limited to their use in accordance with these Terms, the technical documentation and the Agreement. You may not copy, modify, decompile, reverse engineer, resell, sublicense or exploit the Platform or its components beyond that scope, or use it to develop products or services that replicate or compete with it.

We may use anonymized data or metadata to improve the Platform. Soyio may use properly anonymized or aggregated data or metadata, which does not allow you or data subjects to be identified, to improve, develop and train its Services.

Nothing here transfers Soyio’s intellectual property. No provision of these Terms shall be construed as an assignment or transfer of Soyio’s intellectual or industrial property rights to you, unless the parties expressly agree otherwise in writing.

We may update these Terms. Soyio may amend these Terms to reflect changes in its Services, technology, practices or applicable regulation. Each version is identified by its update date and version number, and the current version will be available through the channels Soyio makes available.

We notify you of material changes in advance. Minor changes, or changes made solely for alignment, apply from their publication. Material changes that affect your rights or obligations will be communicated reasonably in advance through appropriate means. Unless the law requires otherwise, continued use of the Platform after the new version takes effect constitutes acceptance of it; if you do not agree with a material change, you may terminate the affected Services in accordance with clause 10.

We are governed by Chilean law. These Terms and the Services are governed by and construed in accordance with the laws of the Republic of Chile.

We resolve disputes before the courts of Santiago. Any difficulty or dispute arising in connection with the validity, interpretation, performance, termination or rescission of these Terms shall be submitted to the jurisdiction of the ordinary courts of justice seated in the comuna of Santiago. This is without prejudice to the fact that, once a service Agreement is signed, the dispute resolution mechanism set out there shall prevail in accordance with the order of precedence in clause 2.

Order of precedence and entire agreement. These Terms, together with the accepted commercial proposal and, where applicable, the Agreement and its annexes, constitute the entire agreement between the parties regarding their subject matter and supersede any prior agreement or negotiation on the same matter. In the event of any conflict between those instruments, they shall prevail in the order set out in clause 2: first the service Agreement and its annexes, then the NDA on matters of confidentiality, then these Terms and, finally, the accepted commercial proposal.

Severability. If any provision of these Terms is held to be void, unlawful or unenforceable, the remaining provisions shall remain in full force and effect, and the affected provision shall be interpreted or replaced to the extent necessary to reflect the parties’ original intent within the applicable legal framework.

No waiver. Failure by either party to exercise a right, or delay in exercising it, shall not be construed as a waiver of that or any other right.

Assignment. You may not assign or transfer your position under these Terms without Soyio’s prior written authorization. Soyio may assign them to its affiliates or in the context of a corporate reorganization, merger or transfer of its business, informing you in due course.

Relationship between the parties. The parties act as independent contractors. Nothing in these Terms creates a partnership, agency, employment or representation relationship between them.

Notices. Communications between the parties shall be made in writing, through the channels or email addresses enabled for managing the relationship, and shall be deemed validly given on the business day following their sending, unless a delivery error message is received. Each party shall keep its contact details up to date.

If you have questions about these Terms, write to us at legal@soyio.id. For privacy and data protection matters, you can contact our team at privacidad@soyio.id.