Skip to content
Español
Menu

Privacy

Which personal data the laboratory processes, why, where, and how to exercise your rights.

Version 1.0, of 10 October 2026.

Controller

Datalab Orgánico is an initiative of BioAudita and aGo lab. aGo lab is the controller of the personal data the laboratory processes. Requests about personal data are received through the rights form and at hola@ago.cl.

Which data it processes and why

Visitors to this site

The portal is a set of static pages served by Cloudflare Pages. It uses no cookies, does not measure visits and loads no third-party resources: the fonts are served from the same site. It stores nothing but your theme and motion preference, in your own browser, and that preference does not leave it. To deliver the pages, the Cloudflare network receives the network address of each visitor; the laboratory does not receive that data.

API users

The data API asks for no key. To limit how many requests it receives per minute, it counts each device’s requests under a digest of its network address, computed with a secret key held by the laboratory, and it does not store the address. With those digests it counts how many requests it receives each day and from how many distinct origins, and for each day it keeps only those two totals.

Before reaching the API, each request goes through the server’s entry proxy, which writes the network address, the date, the requested path, the browser and the referring page to its technical log, in order to run and protect the server. That log is rotated by size, covers a few days and is not backed up.

The operators behind the figures

The laboratory works with lists that the Agricultural and Livestock Service (SAG) publishes with the name of each operator with organic certification, of each organisation of ecological farmers and its members, and of the shops selling organic products. Many of them are natural persons. When it reads a list, the laboratory removes name, tax number, address, email and phone, and keeps a pseudonymous key that prevents counting an operator twice. The original list is stored encrypted, is neither published nor shared, and is reduced within ninety days of its capture.

The laboratory publishes only aggregate counts and no data that identifies an operator, even when the source shows it by name. What the laboratory builds and the source does not publish, such as entries and exits between two editions of a list, also goes through a minimum threshold per cell and the suppression of the cells that would let someone deduce an operator.

People who exercise a right

The data in a rights request (name, email, the details of the request and its handling) are used only to handle and answer it, and are kept for four years from when the reply is sent, the limitation period for legal action over a breach of the law.

Why it processes them

The SAG lists are processed for statistical purposes in the public interest, under the legitimate interest recognised by article 16 quinquies of Law 19,628. The request limit and the proxy log rely on the controller’s legitimate interest in keeping the service available and secure. Rights requests are processed to meet the legal obligation to answer them.

Each processing activity, with its data, its legal basis and its retention period, is described in the record of processing activities.

Where the data are processed

The personal data the laboratory processes are stored outside Chile, with providers that process them on behalf of aGo lab and not for their own purposes:

Finland and the Western Europe region fall under the European Union’s data protection regulation. Each of these transfers rests on the processing agreement with the provider, which binds it to process the data only on aGo lab’s instructions, to keep them confidential, to protect them, to report a breach and to delete or return them when the service ends.

Backup copies

The laboratory backs up its database and its captures every day, so it can recover them if the server is lost. A list with names that had not yet been reduced may end up inside a copy. Daily copies are deleted after thirty-one days, and the copy from the first day of each month after three hundred and sixty-six days. No copy is used to compute figures or to answer requests: it only serves to restore the server, and a restore applies again the reductions and erasures made after the copy before the server goes back into service.

Your rights

You may ask for access to your data that the laboratory processes, for their rectification, erasure or blocking, object to their processing, or receive them in a format you can take to another controller. Use the rights form or write to hola@ago.cl, stating who you are, which data or processing the request concerns and the address where you want to receive the reply.

The reply states whether the right applies in your case and why. The law does not require erasing data or stopping their processing when the processing serves statistical purposes in the public interest, as with the aggregates the laboratory publishes, and it allows portability only when the processing is automated and based on consent.

An erasure or objection is carried out on the live database and captures: the capture is reduced without your data and the figures for that period are computed again. Earlier backup copies are not edited, because an edited copy can no longer be used to restore: they expire after the periods in the previous section and are not read in the meantime. The reply to an erasure or objection request tells you that period.

The form gives you a reference number and the deadline on the spot, which is the acknowledgement of receipt; a request sent by email receives it at that address. The deadline for replying is thirty calendar days from the day the request arrives. It may be extended once by another thirty days, and you will be told the reason for the extension.

Law 21,719, which amends Law 19,628, applies from 1 December 2026. If the request is refused or not answered in time, you may file a complaint with the Personal Data Protection Agency within the following thirty working days.

What the portal stores in your browser is explained on the cookies page.

Arrows choose, Enter opens and Escape closes.