Privacy policy and personal data processing

1. Data controller and corporate group

The controller of users' account and contact personal data is Liberty Field Ingeniería S.A., with registered office at Av. Santa Cruz 381, Piso 5, Miraflores, Lima, Perú, email contacto@libertyfield.pe. Liberty Field Ingeniería S.A. is part of Grupo Huneidie and operates in coordination with the group's other companies for the integrated provision of the service, always under its supervision and responsibility.

2. Scope and collection channels

This policy applies to data collected through the Platform and its associated contact channels: the commercial site, web forms, email, messaging and support communications. Using any of these channels implies awareness and acceptance of this policy.

3. Applicable legal framework

Processing is governed by Peru's Law No. 29733 on Personal Data Protection, its Regulation (Supreme Decree No. 003-2013-JUS), the directives of the National Authority for Personal Data Protection and other applicable rules. For users located in the European Economic Area, Regulation (EU) 2016/679 (GDPR) also applies. Where rules overlap, the higher standard of protection prevails.

4. Categories of personal data

Depending on how the Platform is used, the following may be processed:

• Identification and contact data: name, email, organization, role and, where applicable, national or tax identification.
• Account data: assigned role, projects accessed, preferences and language, and activity (audit) and sign-in logs.
• User-uploaded content: project documents the user chooses to upload (for example purchase documents, proofs of payment and delivery documents) and the data they contain, which may include third-party information such as suppliers.
• Browsing data: IP address, browser type and technical data necessary for the security and operation of the service.

5. Role regarding data: controller and processor

Regarding users' account, contact and billing data, Liberty Field Ingeniería S.A. acts as data controller. Regarding the content the client uploads to its projects (documents and their information), the licensee client is the controller of that data, and Liberty Field Ingeniería S.A., through the Platform, acts as processor, handling that information solely under the client's instructions and to provide the service.

6. Purposes of processing

• Create and manage user accounts and control role-based access.
• Provide the disbursement-request and expense-accountability service, including computing the reportable amount per resource line.
• Process, using artificial intelligence, the documents the user uploads to pre-fill forms; the result always undergoes human confirmation before being saved.
• Generate reports, downloadable packages and tracking dashboards for authorized stakeholders.
• Send operational communications and service notifications.
• Handle support queries and commercial contact requests.
• Comply with legal, tax and security obligations, and exercise or defend rights before competent authorities.

7. Legal bases

• The data subject's consent upon accepting this policy and using the Platform.
• Performance of the contractual relationship or pre-contractual measures.
• Compliance with legal obligations.
• Legitimate interest in the security and improvement of the service, as permitted by applicable law (Article 6.1.f of the GDPR for EEA users).

8. Recipients and processors (sub-processors)

Operating the Platform relies on technology providers acting solely as processors, under confidentiality and security obligations, including hosting and database, file storage, email delivery and AI document-processing services. Personal data is neither traded nor sold to third parties. Data may be shared with competent authorities where legally required, and with Grupo Huneidie companies for the integrated provision of the service under the controller's supervision.

9. International transfers

Some technology providers may be located outside Peru. In such cases, transfers rely on contractual clauses, adequacy frameworks or equivalent safeguards ensuring an adequate level of protection. Where no applicable safeguard exists, the data subject's express consent will be obtained.

10. Retention periods

• Account data and project content: while the service relationship is in force and during subsequent legal retention periods.
• Contact queries that do not lead to a service relationship: up to 24 months from the last contact.
• Browsing and audit logs: for the time needed for security, up to a maximum of 12 months unless a legal obligation requires otherwise.
• Documents of accounting or contractual relevance: for the periods required by applicable law.

11. Data subjects' rights

The data subject may exercise their rights of access, rectification, erasure and objection and, where the GDPR applies, portability and restriction of processing, and may withdraw consent at any time. To exercise them, send a request to contacto@libertyfield.pe attaching a copy of your ID. The request will be handled within a maximum of 30 business days. The data subject may also turn to Peru's National Authority for Personal Data Protection or, in the EEA, to the relevant supervisory authority.

12. Security measures

Technical and organizational measures protect the data, including encryption of communications (HTTPS/TLS), role-based access control, second-factor authentication for password accounts, per-project data isolation, periodic reviews and confidentiality agreements with staff and processors. No system is entirely infallible; the data subject acknowledges the inherent risks of transmitting information over the internet.

13. Cookies and similar technologies

Only strictly necessary cookies are used for the operation and security of the service (for example, the session and language preference), which do not require consent. No advertising or third-party commercial tracking cookies are used. Users can configure their browser to manage cookies.

14. Profiling and automated decisions

The Platform uses artificial intelligence to assist in extracting data from documents, but does not make decisions with legal or significant effects for the data subject without human intervention: every extraction is reviewed and confirmed by a person before being saved.

15. Minors

The Platform is intended for adults with legal capacity. Data of minors is not intentionally collected; if detected, it will be deleted promptly.

16. Changes to this policy

This policy may be updated due to regulatory changes or the evolution of the service. Updates will be published on this page with their date; continued use of the Platform implies acceptance of the version in force.

17. Contact

For any query about this policy or the processing of your data, and to exercise your rights, write to contacto@libertyfield.pe, or contact Liberty Field Ingeniería S.A., Av. Santa Cruz 381, Piso 5, Miraflores, Lima, Perú.