Privacy Policy

The data controller is VALDIVIA, GARCÍA, MUÑOZ & ROJAS, with registered address at Jr. Tupac Inca Yupanqui 458, Baños del Inca, Cajamarca, Peru. Contact email: [email protected].

This policy is drafted for review by the firm's lawyer and is to be interpreted in accordance with Law No. 29733, the Personal Data Protection Law, its Regulations and the provisions of the National Authority for Personal Data Protection.

We may process the following categories of data:

• Identification and contact data: name, email address and telephone number.
• Enquiry data: area of interest, message, case summary and communications with the firm.
• Legalito chatbot data: conversation, messages, area, summary, consent, date and time.
• Technical data: language, user agent, hashed IP address, security identifiers and attribution data if used.

We do not request sensitive data or identity documents through the site or the chatbot. Do not send confidential documents in the first message.

• Respond to enquiries and guide the person to the relevant area or service.
• Manage the relationship with clients and interested parties, including arranging an initial conversation.
• Route the enquiry to the responsible team and follow up.
• Maintain site security, prevent abuse and comply with legal obligations.
• Improve service quality and review conversations to adjust how Legalito works.

Processing is based on the data subject's consent for contact and guidance purposes; on the performance of a contractual relationship or pre-contractual steps where applicable; and on compliance with legal obligations. Where another legitimate interest is invoked, it will be assessed under applicable law.

Consent may be withdrawn at any time without affecting the lawfulness of prior processing. Prior consent will be requested for unsolicited commercial communications where required by law.

As a provisional criterion, lead and conversation data will be retained for 12 months from the last interaction, unless a legal obligation, a current contractual relationship or the need to defend rights justifies a different period. The data will then be deleted or anonymised.

TODO: Confirm the final retention periods with the firm and reflect them in the record of processing activities.

Data subjects may exercise their rights of access, rectification, cancellation and objection, and withdraw their consent, by writing to the firm through the contact page. The request must identify the data subject and describe the right they wish to exercise, subject to the requirements of applicable law.

The firm will respond within the periods and formalities provided by Law No. 29733 and its Regulations. Data subjects may also file a complaint with the National Authority for Personal Data Protection (ANPD) of the Ministry of Justice and Human Rights.

To exercise these rights, data subjects may write to [email protected]. TODO: Confirm the internal procedure and final deadlines.

Legalito is a virtual assistant that uses artificial intelligence to converse, organise the enquiry and identify the area of interest. It is not a lawyer, does not provide definitive legal advice and does not by itself create a lawyer-client relationship. Responses may be incomplete or inaccurate and must be reviewed by a professional.

To operate, Legalito may store the conversation and messages, the name and contact data you provide, the area, the case summary, consent and the date, as well as technical data such as language, user agent and a hashed IP address. Messages are sent to the artificial intelligence provider to generate the response; the firm's server validates the data before storing it and the AI does not write directly to the database.

Do not share identity documents, bank details, passwords or especially sensitive information in the chat. If you do not wish to use AI, you can use the contact form as a fallback channel. The firm may review conversations for quality control, security and service improvement.

TODO: Confirm the AI provider's processing, retention and international transfer terms, and review the specific chatbot notice.

To operate the site, the firm may rely on hosting, email, artificial intelligence, security and map providers, including Resend, DeepSeek, Cloudflare Turnstile and Google Maps (only when the map is opened). These providers process data on behalf of the firm and under the agreed terms. Personal data is not sold.

Some providers may be located outside Peru, which may involve an international transfer. TODO: Identify providers, countries and applicable safeguards before publication.

The firm applies reasonable administrative, technical and organisational security measures to protect data, such as access controls, incident logging, IP address hashing and usage limits. No measure is infallible; if a relevant incident occurs, the firm will act in accordance with applicable law.

No analytics or advertising cookies are currently used. Cloudflare Turnstile may process technical data to verify the security of the form. The map on the contact page is loaded from Google Maps only when the person selects «View interactive map»; when opened, Google may process technical data and use its own cookies. The map is not loaded automatically.

If analytics cookies or additional services are introduced, this policy will be updated and consent will be requested where required. TODO: Review the final list of cookies and third parties.

The firm may update this policy to reflect legal, technical or operational changes. The current version will be published on this page with its update date. Use of the site after an update implies acceptance of the new version to the extent permitted by law.

For questions about this policy or to exercise your rights, write to [email protected] or through the contact page.