Privacy Policy

Data of the client company and its representative:

• Business name, tax ID (RUC), registered address
• Name and position of legal representative
• Corporate email and contact phone
• Billing data and payment method
• Transaction history with OnixLand
• Platform usage data (logs, access, configurations)

The Client enters third-party data into the platform (drivers, passengers, employees). OnixLand processes it exclusively to provide the contracted service:

• Driver data: name, ID, license, documents, GPS location, wallet
• Passenger data: name, phone, trip history (if the client registers them)
• Hotel staff: name, email, phone

The Client is responsible for obtaining the appropriate legal bases to process this data and informing data subjects in accordance with applicable regulations.

• SaaS service provision: managing subscriptions and access
• Billing: issuing electronic invoices (SUNAT)
• Technical support: resolving issues and improving the service
• Commercial communications: product updates (with opt-out option)
• Legal compliance: tax and regulatory obligations

• Contract performance: data necessary for service delivery
• Legal obligation: electronic invoicing and tax regulations
• Legitimate interest: platform security, fraud prevention
• Consent: marketing communications (revocable at any time)

• Billing data: 7 years (Peruvian tax obligation)
• Active account data: for the duration of the contract
• Data after account closure: 90 days for export, then permanent deletion
• Security logs: 12 months

Representatives of client companies may exercise rights over their personal data:

You may also lodge a complaint with Peru's Directorate General for Personal Data Protection (MINJUS).

The Client may at any time request an export of all their data (trips, drivers, invoices) in CSV/JSON format through their admin panel or by writing to privacidad@onixland.cloud. OnixLand will deliver the data within a maximum of 15 business days.

• TLS encryption in transit and encryption at rest in the database
• Production access restricted to authorized personnel with 2FA
• Daily encrypted backups with 30-day retention
• Full audit log of sensitive actions
• Security breach notification within ≤ 72 hours

Any material changes to this policy will be notified to the Client 30 days in advance by email. The current version will always be available on this page.