Privacy policy

1. Data controller

The controller of your personal data is Ignacio Cabezas González, operating under the name Heads Consulting (headsconsulting.cl).

For any question about this policy or your data, write to me at [email protected].

This policy is governed by Chilean Law No. 19,628 on the protection of private life, as amended by Law No. 21,719, which regulates the protection and processing of personal data in Chile.

2. What data I collect

I only collect the data that you (or the client hiring a search) provide through the site or the services:

Contact forms

Name, email, phone (optional), company, job title, reason for contact, your message, how you found the site and the campaign parameters (UTM) of the visit.

Applications and talent pool

Identification and contact details, CV (experience, education, skills), LinkedIn, salary expectations, availability, location and the answers you give in the application form.

Psychometric assessments

Answers to the Heads Consulting Assessment and its results (profile, scores and report), together with interview notes from the process.

Role scoping (clients)

Details of the client contact person (name, title, email, phone) and information about the company and the role to be filled.

I do not ask for data I do not need for the stated purpose. I do not buy databases or obtain data by scraping.

3. Why I use them

• To assess your application for the position you applied to or, if you authorize it, for future positions that match your profile.
• To contact you about job opportunities that match your experience (talent pool).
• To answer your enquiries and meeting requests.
• To deliver the contracted services: executive search, business diagnosis, advisory and web development, including invoicing.

I do not use your data for third-party advertising or sell it. I do not make decisions based solely on automated processing: every candidate assessment is reviewed by a person.

4. Legal basis

• Consent: for applications, the talent pool, psychometric assessments and contact forms. You give it freely, informed and specifically when submitting each form, and you may withdraw it at any time without retroactive effect.
• Performance of a contract: for data of clients and their contact persons, needed to deliver and invoice the contracted service.
• Compliance with legal obligations: for example, keeping tax records.

5. Psychometric assessments: sensitive data

Psychometric assessment results may reveal personality traits and other personal characteristics, so I treat them as sensitive data, with a reinforced standard:

• You are only assessed with your express consent, requested before the assessment begins.
• Restricted access: only me and, where applicable, the psychologist taking part in the process.
• Used exclusively for the selection process in which it was applied. Results are not reused for other purposes.
• The client only receives the report on the presented candidate, never the raw answers.

6. Processors and third parties

I only share data with those who need it to fulfil the purposes described:

• Technology infrastructure providers, acting as data processors: Supabase (database and file storage) and the website hosting provider.
• Companies that invoice the services: HR Consultores (executive search, diagnosis and advisory) and Valmont Lab (web development). They receive the data needed for invoicing and, in the case of HR Consultores, to support the selection process.
• The client of the selection process: receives the information on the candidate I present (CV, assessment report and references), only if you reach that stage.
• Authorities, when required by law or a court order.

7. International transfers

The servers of infrastructure providers may be located outside Chile (for example, in the United States). In those cases, the transfer is made to providers that offer adequate security and confidentiality safeguards, as required by law. By using the site and sending your data, you are informed of this transfer.

If I present your application to a client in Peru, Colombia or the United States, your data will be transferred to that client for that specific process.

8. Retention period

I keep data only for as long as needed for its purpose. Proposed periods:

• Applications and talent pool: 24 months from your last interaction, unless you ask for deletion earlier. (period to be confirmed)
• Psychometric assessment results: 12 months from the close of the process in which they were applied. (period to be confirmed)
• Contact enquiries with no subsequent business relationship: 12 months. (period to be confirmed)
• Client data: for the duration of the contract and 6 years afterwards, for tax and accounting obligations. (period to be confirmed)

Once the period expires, the data is deleted or anonymized so that it can no longer identify you.

9. Your rights

You may exercise the following rights at any time, free of charge:

• Access: to know what data of yours I process, for what purpose and to whom it has been disclosed.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to request deletion of your data when it is no longer needed or you withdraw your consent.
• Objection: to object to a specific processing.
• Portability: to receive your data in a structured, commonly used format.
• Blocking: to request the temporary suspension of processing while a request is resolved.

How to exercise them

Write to [email protected] stating your name, the right you wish to exercise and a way to verify your identity. I will reply within 30 calendar days of receipt, a period that may be extended once by the same length if the request requires it, with prior notice to you.

If you are not satisfied with the response, you may contact the Chilean Personal Data Protection Agency.

10. Security measures

• Restricted access: only people who need the data for their work can access it.
• Encryption in transit: the entire site and tools run over HTTPS.
• Role-based access control and row-level rules in the database: the public site can only create records, not read them.
• CVs and documents in private storage, accessible only through temporary links.

If a security breach affecting your data occurred, I would report it to the authority and, where applicable, to you, as required by law.

11. Cookies and analytics

The site currently uses no analytics or advertising cookies. It only stores in your browser the campaign parameters (UTM) of your visit, to know how you arrived if you later write.

If an advertising measurement tool (for example, Meta Pixel) is enabled in the future, it will only load after you expressly accept it, and you will be able to decline it without affecting your use of the site.

12. Minors

The services are not directed at people under 18 and I do not knowingly collect their data. If I detect data from a minor, I delete it.

13. Changes to this policy

I may update this policy to reflect legal or service changes. Each version carries an identifier and a date shown at the top. If the change is significant and I have your email, I will let you know.