Privacy Notice and Data Processing Policy with AI

How to use this document

• Use it as a base for the organization's privacy notice or personal data processing policy, with specific sections to disclose AI use, automated decisions and profiling, AI vendors and transfers.
• Suggested owner: the Data protection officer (or the country's equivalent role) with Legal; the owners of each system provide the information on AI systems. The starting inventory is the "AI System Inventory" and the "AI Annex to the Record of Processing Activities".
• This notice summarizes rights. The detail of each right regarding AI is in the "AI User Rights Notice", which can be linked from section 9, and the explanation request circuit is in the "AI Transparency and User Explanation Policy".
• Before adopting it, inventory the processing activities: what data each AI system uses, for what purpose, on what legal basis, with which vendors and in which countries. Without that inventory the notice will not be accurate.
• Decide whether you will use personal data to train or improve models and whether there are decisions made solely by automated means that affect people: both change the content and may require consent.
• Complete every bracketed field and delete the rows and sections marked [OPTIONAL] that do not apply.
• Choose the variant for the country where you process data and apply its requirements: GDPR Arts. 13 and 14 information in the European Union (layered in Spain), the right to information in Peru and Ecuador, full and short notice in Mexico, processing policy in Colombia, an Art. 14 ter policy in Chile, information duties in Argentina and Brazil. If you operate in several countries, prepare one version per country.
• Ask internal legal or an outside advisor to review the final version, especially legal bases, sensitive data and transfers.
• Approve the notice, publish it with date and version on the website and at each point of data collection, and place the short notice (section 13) in forms, chats and apps.

Privacy Notice and Data Processing Policy with AI

Version [COMPLETE], effective from [DATE].

1. Data controller

Item	Information
Controller	[LEGAL ENTITY NAME] ([ORGANIZATION NAME])
Tax ID	[COMPLETE]
Address	[COMPLETE]
Privacy email	[PRIVACY EMAIL]
Phone	[COMPLETE]
Data protection officer	[COMPLETE]
Function handling inquiries and complaints	[RESPONSIBLE FUNCTION]

2. Personal data we process

Category	Examples	Source
Identification and contact	Name, email, phone, address	You
Business relationship data	Orders, contracts, payments, service history	You and our systems
Content of your communications	Messages to the virtual assistant, emails, call recordings and transcripts	You
Usage and device data	Browsing, IP address, device identifiers	Our systems
Data generated by AI systems	Summaries, request classifications, scores, segments or profiles, predictions	Our AI systems
[OPTIONAL] Sensitive data	[COMPLETE] (for example, health or biometric data)	[COMPLETE]
[OPTIONAL] Job applicant data	Resume, assessments, interviews	You and authorized third parties

The data our AI systems generate about you (for example, a score or a profile) is also personal data and is handled with the same safeguards.

[OPTIONAL] We process sensitive data only when needed for [COMPLETE], with your express consent or another basis permitted by law. Providing it is voluntary unless stated otherwise.