Privacy Policy

Data of the client company and its representative:

• Business name, tax ID (RUC), registered address
• Name and position of legal representative
• Corporate email and contact phone
• Billing data and payment method
• Transaction history with OnixLand
• Platform usage data (logs, access, configurations)

The Client enters third-party data into the platform (drivers, passengers, employees). OnixLand processes it exclusively to provide the contracted service:

• Driver data: name, ID, license, documents, GPS location, wallet
• Passenger data: name, phone, trip history (if the client registers them)
• Hotel staff: name, email, phone

The Client is responsible for obtaining the appropriate legal bases to process this data and informing data subjects in accordance with applicable regulations.

• Onix Driver (drivers). While the driver is set to “Online”, the app collects the device's precise GPS location and sends it to the platform about every 10 seconds, including while the app is minimized. Android shows a persistent notification (“OnixLand — Online”) for as long as this is active. Sharing stops when the driver goes offline or signs out.
• Onix Guide (guides). The app does not track location in the background. It reads the device location once, only when the guide presses the SOS button and only while the app is open, to include it in the alert.
• Onix Dispatch and web panels. They do not collect the device's location.
• What we use it for: assigning nearby trips, showing the driver's live position on the trip tracking screen to the hotel, agency or passenger involved in that trip, and safety (SOS alerts and incident review). We do not use it for advertising and we do not sell it.
• Retention: the driver's current position is overwritten with each update. A route history is saved about once every 30 seconds and is permanently deleted after 14 days.
• Your control: you can revoke the location permission in the device settings at any time; without it, a driver cannot go Online. Android does not grant this app “all the time” location access — it works through the notification described above.

• SaaS service provision: managing subscriptions and access
• Billing: issuing electronic invoices (SUNAT)
• Technical support: resolving issues and improving the service
• Commercial communications: product updates (with opt-out option)
• Legal compliance: tax and regulatory obligations
• Use of Artificial Intelligence: the platform uses artificial intelligence (language models and OCR) to support an operational chat assistant/copilot for staff, a support chatbot for passengers and drivers, translation and drafting assistance for tourism content, and automatic reading of fields from travel or identity documents during check-in or document upload. In every one of these functions, a member of the Client's staff always reviews and confirms the result before it takes effect — none of these AI functions makes an automated decision without human review. See section 6 for the AI providers involved.

• Contract performance: data necessary for service delivery
• Legal obligation: electronic invoicing and tax regulations
• Legitimate interest: platform security, fraud prevention
• Consent: marketing communications (revocable at any time)

• Billing data: 7 years (Peruvian tax obligation)
• Active account data: for the duration of the contract
• Data after you request account closure: you have a 30-day grace period from the moment you request deletion, during which you may restore your account and cancel the deletion. If you do not restore it, at the end of those 30 days we run an automated process that: (a) permanently anonymizes your personal data in our systems — name, email, phone, password and push-notification subscription are replaced or removed, so the account can no longer identify you; (b) permanently deletes (hard-delete) your uploaded documents, saved addresses and active sessions; and (c) removes your personal identifiers from trip/booking and rating records while keeping the underlying trip, invoice and payment record itself. We keep that underlying record — without any data that identifies you — because Peruvian tax and accounting law requires businesses to retain proof of transactions and electronic invoices (see the 7-year billing retention above). In short: this is not an instant full deletion, it is a 30-day reversible grace period followed by irreversible anonymization of your personal data.
• Security logs: 12 months

Representatives of client companies may exercise rights over their personal data:

You may also lodge a complaint with Peru's Directorate General for Personal Data Protection (MINJUS).

The Client may at any time request an export of all their data (trips, drivers, invoices) in CSV/JSON format through their admin panel or by writing to privacidad@onixland.cloud. OnixLand will deliver the data within a maximum of 15 business days.

• TLS encryption in transit and encryption at rest in the database
• Production access restricted to authorized personnel with 2FA
• Daily encrypted backups with 30-day retention
• Full audit log of sensitive actions
• Security breach notification within ≤ 72 hours

Any material changes to this policy will be notified to the Client 30 days in advance by email. The current version will always be available on this page.

OnixLand and its apps (Onix Driver, Onix Guide, Onix Dispatch) are professional tools aimed at people aged 18 or over. We do not knowingly collect personal data from children or teenagers under 18. If you believe a minor has registered, write to privacidad@onixland.cloud and we will delete the account.