Privacy policy
This document explains what personal data we process, for what purpose and under what conditions, both on vortex.adnsoftsas.com and in our mobile applications.
Who the controller is
The data controller is ADN SOFT S.A.S. (“ADN Vortex”, “we”), a Colombian company with tax ID (NIT) 902094914-1, registered office at Calle 64 G # 90 A - 95, Bogotá D.C., Colombia and a second office at Calle 49 # 8-06, Soacha, Cundinamarca, Colombia.
For anything related to this document or to your personal data, write to info@adnvortex.com.
Who this applies to
This policy applies to three kinds of person:
- Website visitors, who browse or contact us through a form.
- Users of our mobile applications, who sign in with an account.
- People whose data one of our clients processes on our platform. In that case the client is the controller and we act as processor: the client defines the purposes and we process the data on their instructions.
What data we process
We process only the data needed to provide the service:
| Category | Data | Purpose |
|---|---|---|
| Identification | Name, email, phone, company and role | Create and manage your account, handle requests and invoice |
| Authentication | Encrypted credentials, session tokens, access logs | Provide secure access and detect improper access |
| Location | Coordinates, speed, heading and timestamp from the device or phone | Provide the tracking service and produce the contracted reports |
| Device telemetry | Ignition, battery, fuel, temperature, inputs and outputs | Asset monitoring and alert generation |
| Media | Photographs, video and signatures captured in the field app | Delivery evidence, inspections and event support |
| Service usage | Pages viewed, actions in the platform, errors | Operate, debug and improve the product |
| Device | Model, operating system, app version, install identifier | Compatibility, technical support and security |
| Billing | Tax and payment data of the corporate client | Issue invoices and meet accounting obligations |
We do not process sensitive data (racial origin, health, religious beliefs, sexual orientation, biometrics for identification) unless a client uploads it into their own space, under their responsibility and with the authorisation the law requires of them.
Background location
Some of our applications — in particular the one intended for drivers and field staff — collect device location even when the application is closed or not in use.
This is necessary because the service contracted by the employer or the tracking company consists precisely of knowing the position of the vehicle or asset throughout the shift, not only while someone is looking at the phone screen.
- Background collection only happens after express consent, granted on the device through the operating system permission.
- Before requesting that permission, the application shows a prominent disclosure explaining what is collected and why.
- The permission can be revoked at any time from the operating system settings, with no need to contact us.
- If revoked, the application stops reporting position; other functions may keep working in a limited way.
- Background location is not used for advertising, not sold and not shared with third parties other than those listed in this policy.
If you are an employee and your employer contracted the service, they are the controller: they define the purpose, the monitoring schedule and the retention period. We process that data on their instructions.
Legal basis
Depending on the case, we process data on the basis of:
- Your consent, where the law requires it (for example, for background location or for commercial communications).
- Performance of a contract, where processing is necessary to provide the service you contracted.
- Compliance with a legal obligation, in tax, accounting or authority-request matters.
- Our legitimate interest in keeping the service secure and preventing fraud, provided your rights do not override it.
Who we share with
We do not sell personal data and we do not transfer it for advertising purposes. We share it only with:
- Infrastructure providers that host the service, under a processing agreement and a confidentiality obligation.
- Ancillary service providers (transactional email, SMS gateway, messaging), limited to what is necessary.
- The corporate client that contracted the service, where the data belongs to their operation.
- Competent authorities, upon a valid court order or legal request.
The current list of processors is available on the sub-processors page linked at the end of this document.
How long we keep data
| Data | Retention |
|---|---|
| Account data | While the account is active and up to 30 days after deletion |
| Positions and telemetry | The period contracted by the client; 12 months by default |
| Media (photos, signatures, video) | The contracted period; 6 months by default |
| Access and audit logs | 24 months, for security reasons |
| Accounting and tax documents | The period Colombian law requires |
| Backups | Up to 90 days, after which they are overwritten |
Once those periods elapse, data is deleted or irreversibly anonymised.
Your rights
As a data subject you may, at any time:
- Know what data of yours we process and how.
- Update and rectify inaccurate or incomplete data.
- Request erasure of your data and deletion of your account.
- Withdraw the consent you gave us.
- Request proof of the consent granted.
- Object to certain processing.
- Request portability of your data in an open format.
- Lodge a complaint with the Colombian Superintendence of Industry and Commerce, or with your local supervisory authority if the GDPR applies to you.
To exercise them write to info@adnvortex.com stating your name, the right you are exercising and a contact method. We respond within a maximum of fifteen (15) business days for queries and fifteen (15) business days for complaints, extendable under Colombian Law 1581 of 2012. Where the GDPR applies, we respond within one month.
If your data sits in a client's space, we will forward the request to that client, who is the controller, and let you know.
Account deletion
You may request permanent deletion of your account and associated data at any time, without signing in. The procedure, the timelines and what is kept by legal obligation are detailed on the account deletion page.
Minors
Our services are aimed at businesses and adults. We do not knowingly collect data from children under 14. If we find we have received a minor's data without the authorisation of whoever holds parental responsibility, we delete it.
If you believe a minor has provided us with data, write to info@adnvortex.com and we will delete it.
International transfers
Part of the infrastructure we use may sit outside Colombia. When that happens we require the provider to offer protection equivalent to Colombian rules and, where the GDPR applies, standard contractual clauses approved by the European Commission.
Security
We apply reasonable technical and organisational measures: encryption in transit and at rest, role-based access control, two-step authentication for the internal team, audit logging and backups with periodic restore testing.
No system is infallible. If an incident affects your data we will notify you and report it to the authority where the law requires it.
Changes to this policy
We may update this document. We will publish the current version at this same address with its update date and, where the change is substantial, notify you by email or inside the product.