Legal document

VanTrack Terms of Service

Version 2026-11-01 · Effective November 1, 2026 · This document is available in English and in Spanish.

1. Who we are and how you accept these Terms

VanTrack is a software service operated by VanTrack (Brayan Felipe Castrillon Salazar, C.C. 1193226446), domiciled at Pereira, Risaralda, Colombia ("we", "us" or the "Provider"). You can write to us at brayan.desarrollo2270@gmail.com.

These Terms of Service (the "Terms") are a binding contract between the Provider and the company that contracts or uses VanTrack (the "Customer"), and they also govern the use made by the people the Customer authorizes (the "Users"). The Privacy Policy and Annex A (Data Processing Terms) are part of these Terms.

You accept these Terms when any of the following happens:

• You request, activate or use a VanTrack workspace for your company (for example, yourcompany.vantrack.cloud), including the free trial.
• You sign in to the web platform or the mobile app. The sign-in screen says so next to the sign-in button, and we record the date and the version of the Terms accepted at each sign-in.
• You sign or accept an order, proposal or activation email that references these Terms.

If you accept on behalf of a company, you represent that you have authority to bind it. If you do not, or if you do not agree with these Terms, do not use the Service. Where a written agreement signed by both parties exists, that agreement prevails over these Terms to the extent of any conflict.

2. Definitions

• Service: the VanTrack web platform (the Customer's panel on its subdomain and the platform site at https://app.vantrack.cloud/), the application programming interface (API), the "VanTrack" mobile app for Android and iOS, the documentation and the related support services.
• Customer: the legal entity or business that contracts the Service to manage its fleet. Each Customer has its own isolated workspace (its "DSP" or "company" within VanTrack).
• User: each person the Customer gives access to the Service through a user account: administrators, editors, read-only users and drivers.
• Customer Data: all information the Customer or its Users upload to or generate in the Service: vehicles, VINs, plates, mileage, repairs, invoices and receipts, quotes, inspections and their photos, faults, maintenance programs, documents, driver assignments, users and their contact details, notes and settings.
• Personal Data: the part of Customer Data (and of Usage Data) that identifies or makes it possible to identify a natural person, such as a User's name and email, or an inspection photo in which someone appears.
• Usage Data: the technical and activity information the Service generates when used: access logs, IP addresses, browser or device, dates and times, pages and features used, errors.
• Fees: the prices of the Service described in section 6 or agreed in writing with the Customer.

3. What VanTrack is and what it is not

VanTrack lets you record and organize the operation of a fleet of vans: the vehicle inventory, shop check-ins and check-outs, repairs with their invoices and who covers them, quotes, daily inspections from the phone with photos, fault reports, maintenance programs and their reminders, recalls published by NHTSA, driver assignments, reports and spend per van. The specific features may vary with the modules the Customer has enabled and evolve over time.

It is important that you understand what VanTrack is not:

• It is not an Amazon service and is not affiliated with Amazon. "Amazon", "Amazon DSP" and similar marks belong to Amazon.com, Inc. or its affiliates and are mentioned only to describe the kind of company VanTrack serves. Amazon does not endorse or operate VanTrack and is not a party to these Terms.
• It is not a regulatory compliance service or legal advice. VanTrack records what the Customer and its Users load. The Customer remains solely responsible for complying with the rules that apply to it (for example, those of the U.S. Department of Transportation, the FMCSA, state agencies such as the California Highway Patrol, labor laws and the contractual requirements of Amazon or others), for keeping the records the law requires in the format the law requires, and for deciding whether a vehicle is safe to operate.
• It is not a telematics or tracking system. VanTrack installs no devices in vehicles, does not track the location of vans or Users and does not read vehicle data in real time. Information exists because someone records it.
• It is not a payment or third-party billing system. The amounts, invoices and receipts loaded are the Customer's records; VanTrack does not process payments between the Customer and its shops or vendors.

Information VanTrack obtains from external sources (for example, VIN decoding or recalls from NHTSA, or distances computed with Google Maps) is shown as those sources deliver it and may contain errors or omissions. Verify it before relying on it.

4. Eligibility and business use

The Service is designed for businesses and is offered solely for commercial and professional purposes. It is not offered to consumers and is not directed at anyone under 18; the Customer warrants that no User is a minor. By using the Service you represent that the Customer is a legally organized business or a merchant acting in the course of its trade.

5. Accounts, authorized users and security

5.1 The Customer's workspace

We create a workspace for each Customer with a company code (its subdomain) and an initial administrator account. The Customer decides who gets access, with which role and for how long, and is responsible for creating, updating and deactivating its Users' accounts, especially when a person stops working with it.

5.2 Responsibility for Users

The Customer is responsible for everything done with its Users' accounts, whether or not it instructed it, unless the access results from a security failure attributable to the Provider. The Customer agrees to inform its Users of these Terms and the Privacy Policy, to obtain from them the authorizations the law requires to process their data (see section 8 and Annex A) and to ensure they use the Service lawfully.

5.3 Credentials

Each User must keep their password secret, not share their account and use reasonably strong passwords. Accounts are personal. The Customer must promptly notify us at brayan.desarrollo2270@gmail.com if it suspects unauthorized access, and we may temporarily suspend the affected accounts to protect the Service. To protect accounts, the Service temporarily blocks sign-in attempts after several consecutive failures.

5.4 Support inside the Customer's workspace

To resolve incidents, authorized Provider staff may enter the Customer's workspace with a support account identified as such. That access is used only to provide support or maintain the Service, is logged and is subject to the confidentiality in section 9. The Customer may ask that such access only happen with its prior authorization.

5.5 Users' account deletion requests

Since accounts are created by the Customer, the Customer deletes them. A User may request the deletion of their account from the mobile app ("More → Delete my account") or from the public page https://app.vantrack.cloud/eliminar-cuenta/; the Service notifies the Customer's administrators, who must handle it from "Users" within 15 business days at most. If the Customer does not do so within that period, the Provider is authorized to delete that User's personal data (name, username, email and access), keeping their operational records as the Customer's history, and to confirm it to the User. When the requester is the Customer's only administrator, the Provider will contact them to agree on the export and the closing of the workspace (section 17). Deleting an account does not terminate the Service nor release the Customer from payment obligations.

6. Free trial, price and payment

6.1 Free trial

We may offer a free trial period, for the duration we indicate when activating the workspace. During the trial the Service is provided "as is", with all features or with those we indicate. When the trial ends without a subscription, access is blocked and Customer Data is kept for the period in section 17.4 so the Customer can export it or subscribe.

6.2 Price

The Service has a single plan: a flat fee per registered van per month, in United States dollars, with unlimited users and no minimum term. The current fee is the one published at https://app.vantrack.cloud/ or stated in the Customer's proposal or activation email. The number of vans billed is the one the platform counts on the first day of each month in the Customer's workspace (retired vans do not count). If we agree in writing on a special price, a monthly minimum or a "founder" price for a term, that prevails for the agreed term.

6.3 Invoicing and payment

We invoice monthly, in advance or in arrears as stated on the invoice, through the payment methods we indicate. Invoices are due within fifteen (15) days of issue unless the invoice says otherwise. Fees exclude taxes, withholdings, levies and bank charges; the Customer bears those that apply to it, except taxes on the Provider's income. Amounts paid are non-refundable unless these Terms or the law say otherwise.

6.4 Late payment and suspension

If an invoice is not paid on time, we will notify you by email. If ten (10) days pass after the notice without payment, we may suspend access to the Customer's workspace until the account is settled. Suspension does not release the Customer from paying what is owed. We may charge late interest at the highest rate allowed by applicable law plus reasonable collection costs.

6.5 Price changes

We may change the Fees with at least thirty (30) days' notice by email or within the Service. The new price applies from the billing period following the notice. If you disagree, you may terminate the Service before that date without penalty. Prices agreed in writing for a fixed term do not change during that term.

7. Permitted and prohibited use

The Customer and its Users may use the Service only to manage the Customer's fleet and operation, in accordance with the law and these Terms. The following is not allowed:

• Using the Service for unlawful or fraudulent purposes or in a way that infringes third-party rights, or uploading content that is illegal, defamatory, discriminatory or that violates other people's privacy.
• Uploading third parties' personal data without the authorization or legal basis to do so, or uploading categories of data the Service is not designed to process (for example, health, biometric or financial data of individuals, Social Security or driver's license numbers in free-text fields).
• Attempting to access other Customers' workspaces, or systems or data without authorization, or testing or breaching the Service's security without our written permission.
• Copying, modifying, decompiling, reverse engineering or creating derivative works of the Service or the mobile app, except to the extent expressly allowed by law.
• Reselling, sublicensing, renting or lending the Service to third parties, or using it to operate a service for third parties, without a written agreement with us.
• Using bots, scrapers or automated means to extract data from the Service, or generating a disproportionate load that affects other Customers.
• Introducing viruses or malicious code, or circumventing technical limits, quotas or access controls.
• Using the Service to build a competing product by copying its features, design or look and feel.
• Removing or altering intellectual property notices, or using our marks without authorization.

We may investigate use of the Service to verify compliance with these Terms and take the measures in section 17 in case of a breach.

8. Customer Data and personal data

8.1 Ownership

Customer Data is and remains the Customer's. We acquire no rights in it except the limited license in section 8.2. The Customer is responsible for its accuracy, legality and content, and for having the rights needed to upload it.

8.2 License to provide the Service

The Customer authorizes us to host, copy, transmit, display and process Customer Data solely to provide, maintain, protect and improve the Service, to provide support, to comply with legal obligations and as instructed by the Customer. We may generate aggregated, anonymized statistics (which identify neither the Customer nor any person) about use of the Service in order to improve it.

8.3 Roles regarding personal data

For the personal data contained in Customer Data (for example, that of its drivers and employees), the Customer is the data controller (in the terms of Colombian law) or the business (in the terms of United States privacy laws such as California's CCPA/CPRA), and the Provider acts as data processor or service provider on the Customer's behalf. The conditions of that processing are in Annex A. For the Customer's contact details, billing, prospects and Usage Data, the Provider acts as controller, as explained in the Privacy Policy.

8.4 Customer obligations

The Customer warrants that it has informed its Users and any other person whose data it uploads about the processing it will carry out in VanTrack, and that it has obtained the necessary authorizations, consents or legal bases, including those relating to photos taken during inspections and fault reports. The Customer must handle its Users' requests about their data (access, correction, deletion) and we will assist as described in Annex A.

8.5 Export and return

While the Service is in force the Customer can export its data from the available reporting and export features, and can ask us for a full export of its workspace in a commonly used structured format. What happens to the data at termination is in section 17.4.

8.6 Backups

We make periodic backups of the database as part of operating the Service. Backups exist to recover the Service after a failure and do not replace the copies the Customer must keep for its own obligations; we recommend exporting your reports periodically.

9. Confidentiality

Each party will keep confidential the other's confidential information it accesses in connection with the Service (in our case, Customer Data and the Customer's business information; in the Customer's case, non-public information about the Service, special pricing and support materials), will use it only for the purposes of these Terms and will protect it with reasonable care, at least the care it applies to its own confidential information. Information is not confidential if it is public through no fault of the recipient, was already lawfully known to it, is received from a third party without a duty of confidence or is independently developed. Either party may disclose confidential information when required by law or an authority, giving the other reasonable advance notice where legally possible. This obligation lasts while the Service is in force and three (3) years afterwards, and for personal data, for as long as the legal obligation subsists.

10. Intellectual property

The Service, the mobile app, their code, design, databases (other than Customer Data), texts, logos, marks and documentation are the property of the Provider or its licensors and are protected by the intellectual property laws of Colombia and the United States and by international treaties. These Terms transfer no ownership rights; they only grant the Customer and its Users a limited, non-exclusive, non-transferable and revocable license to use the Service during its term, in accordance with these Terms.

If the Customer or its Users send us suggestions, ideas or feedback about the Service, we may use them freely, with no obligation of payment or attribution; this does not include Customer Data.

If you believe content available through the Service infringes your copyright, write to brayan.desarrollo2270@gmail.com identifying the work, the allegedly infringing content, your contact details and a good-faith statement; we will handle the notice under applicable law, including the U.S. DMCA where it applies.

11. Third-party services

The Service relies on third-party providers and services, for example: server hosting (Hostinger), email delivery (Brevo), Google Maps Platform for maps, addresses and distances (when the Customer has it enabled), fonts and libraries served by Google and Cloudflare, NHTSA's public databases to decode VINs and check recalls, and the Apple and Google app stores to distribute the mobile app. The current list and the location of each are in the Privacy Policy. When using features that depend on those services, the Customer and its Users also accept those third parties' terms to the extent they apply (for example, the Google Maps Platform Terms and the Google Privacy Policy). We are not responsible for the availability, accuracy or practices of those third parties, although we choose them with care and bind them contractually as described in Annex A.

The Service may contain links to external sites or tools (for example, a WhatsApp link to contact a person). Those sites are not under our control and are governed by their own terms.

12. Availability, support and changes to the Service

12.1 Availability

We make commercially reasonable efforts to keep the Service continuously available, but we do not guarantee uninterrupted or error-free availability. There may be interruptions for maintenance (which we will try to schedule outside peak hours and announce where possible), for failures of providers or networks, or for causes beyond our control. If at any time we offer a written service level agreement (SLA), its terms will prevail over this paragraph.

12.2 Support

We provide support by email and through the channels we indicate, during business hours, in Spanish and English, with reasonable response times according to the severity of the issue. Support covers the operation of the Service; it does not include extensive training, custom data migrations or bespoke development unless separately agreed.

12.3 Changes and improvements

We improve the Service frequently and may add, modify or retire features. If we retire a material feature, we will try to give reasonable advance notice. Features marked "beta", "trial" or "preview" may change or disappear at any time and are offered without additional warranties.

12.4 Mobile app versions

We may require the mobile app to be updated to a minimum version to keep connecting to the Service, for security or compatibility reasons. The app will say when an update is needed.

13. The mobile app

13.1 License

We grant each User a limited, non-exclusive, non-transferable and revocable license to install and use the "VanTrack" mobile app on devices they own or control, solely to access the Service under the Customer's account and in accordance with these Terms. App accounts are created and managed by the Customer; the app itself does not allow creating accounts.

13.2 Device permissions

The app requests access to the device's camera and photos only when the User chooses to attach a photo to an inspection, a fault or a receipt. It does not access location, contacts or the microphone. Permissions can be revoked from the device settings; without them, the photo feature will not be available.

13.3 App store terms

If you obtain the app through Google Play, the Google Play terms also apply. If you obtain it through Apple's App Store, the following applies, as Apple requires:

• These Terms are concluded between the User (and the Customer) and the Provider only, not with Apple. The Provider, not Apple, is solely responsible for the app and its content.
• The license is limited to use of the app on Apple-branded products that the User owns or controls, as permitted by the Usage Rules in the Apple Media Services Terms and Conditions.
• The Provider is solely responsible for providing maintenance and support for the app. Apple has no obligation whatsoever to furnish any maintenance or support services.
• The Provider is solely responsible for any product warranties, to the extent not disclaimed. If the app fails to conform to any applicable warranty, the User may notify Apple and Apple will refund the purchase price of the app (if any); to the maximum extent permitted by law, Apple will have no other warranty obligation whatsoever.
• The Provider, not Apple, is responsible for addressing any claims of the User or any third party relating to the app or its use, including product liability claims, claims that the app fails to conform to legal or regulatory requirements, and claims under consumer protection, privacy or similar legislation.
• If a third party claims that the app infringes its intellectual property rights, the Provider, not Apple, will be solely responsible for the investigation, defense, settlement and discharge of that claim.
• The User represents that they are not located in a country subject to a U.S. Government embargo or designated by the U.S. Government as a "terrorist supporting" country, and that they are not listed on any U.S. Government list of prohibited or restricted parties.
• The User must comply with applicable third-party terms when using the app (for example, their wireless data service agreement).
• Apple and Apple's subsidiaries are third-party beneficiaries of these Terms as they relate to the app and, upon the User's acceptance, Apple will have the right (and will be deemed to have accepted the right) to enforce these Terms against the User as a third-party beneficiary.
• Questions, complaints or claims about the app go to the Provider: VanTrack, Pereira, Risaralda, Colombia, brayan.desarrollo2270@gmail.com.

14. Warranties and disclaimer

We warrant that we will provide the Service with reasonable care and skill, with security measures appropriate to its nature (described in Annex A and in the Privacy Policy), and that we will not materially reduce its core functionality during a paid period without notice.

Except as stated in the previous paragraph and to the maximum extent permitted by law, the Service and the mobile app are provided "as is" and "as available", without warranties of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, title, non-infringement, accuracy or freedom from errors. We do not warrant that the Service will meet the Customer's requirements, that it will operate without interruption, that defects will be corrected, that information obtained from third parties is accurate, or that use of the Service ensures compliance with any rule, program or contract (including Amazon's requirements for its Delivery Service Partners, DOT or FMCSA rules, or those of any state authority).

Decisions about the safety, maintenance and operation of vehicles and about the people who drive them belong exclusively to the Customer, which must base them on physical inspections, on the judgment of qualified personnel and on the applicable rules, not solely on what the Service records.

15. Limitation of liability

To the maximum extent permitted by applicable law: (a) neither party will be liable to the other for indirect, incidental, special, consequential, punitive or exemplary damages, or for lost profits, revenue, business, anticipated savings, data (other than the Provider's obligation to restore from its backups) or goodwill, even if advised of the possibility of such damages; and (b) the Provider's total aggregate liability for all claims arising out of these Terms or the Service, on any theory (contract, tort, negligence or otherwise), will not exceed the total Fees actually paid by the Customer to the Provider in the twelve (12) months before the event giving rise to the claim, or one hundred United States dollars (USD 100) if the Customer has paid no Fees (for example, during the free trial), whichever is greater.

These limitations do not apply to: (i) damages caused by a party's willful misconduct, fraud or gross negligence; (ii) the indemnification obligations in section 16; (iii) the Customer's breach of the confidentiality obligations in section 9; (iv) the Customer's use of the Service beyond the license granted or its failure to pay the Fees; or (v) any liability that applicable law does not allow to be limited or excluded. The parties acknowledge that the Fees reflect this allocation of risk and that without it the Provider would not offer the Service at that price.

16. Indemnification

16.1 By the Customer

The Customer will defend and indemnify the Provider, its partners, employees and contractors against any third-party claim, and against the damages, penalties, costs and reasonable expenses (including attorneys' fees) resulting from it, where it arises from: (a) Customer Data or its use in the Service, including the lack of authorization from the people whose data is uploaded; (b) use of the Service by the Customer or its Users in breach of these Terms or the law; (c) the operation of the Customer's fleet, its vehicles, drivers or relationships with third parties (including Amazon, shops and vendors); or (d) disputes between the Customer and its Users or employees.

16.2 By the Provider

The Provider will defend and indemnify the Customer against third-party claims alleging that the Service, used in accordance with these Terms, infringes that third party's patent, copyright or trademark, or misappropriates its trade secret, and will pay the damages and costs awarded by a court or agreed in a settlement approved by the Provider. This obligation does not cover claims arising from Customer Data, from modifications not made by the Provider, from the combination of the Service with third-party products or from use in breach of these Terms. If the Service becomes the subject of such a claim, the Provider may, at its option, procure the right to continue using it, modify it so that it does not infringe, or terminate it and refund prepaid, unused Fees.

16.3 Procedure

The indemnified party will promptly notify the other of the claim, allow it to control the defense and settlement (without accepting obligations on behalf of the indemnified party without its consent) and cooperate reasonably at the indemnifying party's expense.

17. Suspension and termination

17.1 Termination by the Customer

The Customer may terminate the Service at any time by emailing us; termination takes effect at the end of the current billing period and gives no right to a refund of amounts already paid, except as provided in sections 6.5 or 12.3.

17.2 Suspension by the Provider

We may suspend all or part of the Customer's or a User's access, with notice where reasonably possible, if: (a) there is a breach of section 7 or a use that endangers the security or integrity of the Service or of third parties; (b) there are overdue invoices under section 6.4; (c) an authority or the law requires it; or (d) the free trial ends without a subscription. We will lift the suspension once the cause is gone.

17.3 Termination by the Provider

We may terminate these Terms: (a) if the Customer materially breaches them and does not cure within fifteen (15) days of our notice; (b) immediately, if the breach is serious or cannot be cured, or if the Customer becomes insolvent or enters liquidation; or (c) for convenience, with at least sixty (60) days' notice, in which case we will refund the pro-rated portion of prepaid, unused Fees.

17.4 Effects: data export and deletion

When the Service terminates or expires for any reason, the Customer loses access. During the following thirty (30) days it may ask us for a full export of its Customer Data, which we will deliver in a commonly used structured format. After that period, or earlier if the Customer asks in writing, we will delete Customer Data from our production systems, and it will disappear from backups within the following ninety (90) days through the normal rotation of those backups. We may retain information the law requires us to keep (for example, invoices and accounting records) and Usage Data, with the safeguards of the Privacy Policy. Sections that by their nature should survive (including 6, 8.1, 9, 10, 14, 15, 16, 17.4, 19 and 20) remain in force.

18. Changes to these Terms

We may modify these Terms. If a change is material, we will give at least fifteen (15) days' notice by email to the Customer's administrator or through a notice in the Service; the new version will state its date. Use of the Service after that date (including signing in, which records the version accepted) constitutes acceptance of the new Terms. If the Customer disagrees, it may terminate the Service before the effective date and, if it prepaid a period it will not use, we will refund the pro-rated portion. Changes required by law or for security reasons may take effect immediately.

19. Governing law and dispute resolution

19.1 Governing law

These Terms are governed by the laws of the Republic of Colombia, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply. Nothing above deprives the Customer or the Users of protections granted by mandatory rules of the place where they are located (for example, the privacy laws of their state in the United States).

19.2 Prior negotiation

Before starting any action, the affected party will notify the other in writing describing the dispute, and both will try to resolve it in good faith for thirty (30) days, including through a virtual meeting between people with decision-making authority.

19.3 Arbitration

Any dispute not resolved within that period and arising out of these Terms or the Service will be finally resolved by arbitration administered by the Center for Arbitration and Conciliation of the Bogotá Chamber of Commerce, under its international arbitration rules when the Customer is domiciled outside Colombia and its domestic arbitration rules otherwise. The tribunal will consist of one (1) arbitrator, the seat of arbitration will be Bogotá, Colombia, hearings will preferably be held virtually, and the language will be Spanish unless the parties agree on English. The award will be final and binding and may be enforced in any competent court, including courts of the United States under the 1958 New York Convention. Each party bears its own costs unless the award provides otherwise.

19.4 Exceptions

Either party may go to a competent court to (a) obtain injunctive or urgent protective relief for its intellectual property rights or confidential information, or (b) claim payment of liquidated, undisputed sums. Small claims may be brought in the competent small-claims court of the defendant's domicile where the law allows.

19.5 Individual claims

To the extent permitted by law, disputes will be resolved on an individual basis: neither party will participate in class, collective or representative actions against the other in connection with these Terms, and the arbitrator may not consolidate claims of different Customers or preside over class proceedings.

19.6 Time to bring claims

Unless applicable law imposes a longer period that cannot be shortened, any claim arising out of these Terms must be brought within two (2) years of the event giving rise to it.

20. General provisions

• Entire agreement. These Terms, with the Privacy Policy, Annex A and any order or written agreement incorporating them, are the entire agreement between the parties about the Service and replace any prior agreement or communication on the same subject. We are not bound by terms printed on the Customer's purchase orders or vendor portals.
• Language. These Terms are drafted in Spanish and also published in English for the Customer's convenience. Both versions have the same content; in case of a discrepancy in interpretation, the Spanish version prevails.
• Assignment. The Customer may not assign these Terms without our written consent, except to an acquirer of all of its business, with notice to us. We may assign them to an affiliate or to an acquirer of our business or the Service, with notice to the Customer.
• Force majeure. Neither party is liable for delays or failures (other than payment) caused by events beyond its reasonable control, such as widespread internet or cloud provider outages, large-scale cyberattacks, natural disasters, epidemics, acts of authority, war or civil unrest.
• Notices. Notices to the Provider go to brayan.desarrollo2270@gmail.com. Notices to the Customer go to the administrator's email registered in the Service or are shown within the Service, and are deemed received on the business day after sending. The Customer must keep that email current.
• Independence. The parties are independent contractors; these Terms create no partnership, agency, employment or franchise relationship.
• Severability and waiver. If any clause is held invalid, it will be enforced to the maximum extent possible and the rest remains in force. Failure to exercise a right is not a waiver of it.
• Export controls. The Customer will comply with the export control and sanctions laws that apply to it and will not use the Service from countries or for persons subject to United States or Colombian sanctions.
• Third parties. Except as provided for Apple in section 13.3 and for the indemnified persons in section 16, these Terms grant no rights to third parties.
• Headings. Headings and the opening summary are for convenience only and do not affect interpretation.

21. Contact

For any question about these Terms, for legal notices or to exercise the rights described here, write to brayan.desarrollo2270@gmail.com or to Pereira, Risaralda, Colombia. For questions about personal data, see the Privacy Policy, which states the channel and response times.

Annex A. Data Processing Terms

This Annex governs the processing the Provider carries out, on the Customer's behalf, of the personal data contained in Customer Data (the "Processed Data"). It prevails over the rest of the Terms with respect to that processing. It is drafted to comply, at the same time, with Colombia's Law 1581 of 2012 and Decree 1377 of 2013 (incorporated into Decree 1074 of 2015), with the California Consumer Privacy Act (CCPA, as amended by the CPRA) and its regulations, and with the other United States state privacy laws that require a contract between a business and its service provider or processor.

A.1 Roles and scope

The Customer is the data controller (or the "business" / "controller") and the Provider is the data processor (or the "service provider" / "processor"). The Customer determines the purposes and means of the processing; the Provider processes the Processed Data solely to provide the Service described in these Terms, in accordance with the Customer's documented instructions (these Terms, the Service's configuration and any additional reasonable written instructions).

A.2 Processing details

A.3 Provider obligations

• Process the Processed Data only for the specific business purpose of providing the Service to the Customer and in accordance with its instructions; for no other purpose, and not outside the direct business relationship with the Customer.
• Not sell or share the Processed Data (within the meaning of the CCPA/CPRA), not use it for targeted or behavioral advertising, not combine it with data from other Customers or other sources except where the law expressly allows it in order to provide the Service, and not retain, use or disclose it for purposes other than those stated.
• Ensure that persons authorized to process the data are bound by confidentiality and instructed on its protection.
• Apply appropriate technical, human and administrative security measures, described in A.6, to prevent alteration, loss, unauthorized or fraudulent consultation, use or access.
• Notify the Customer, without undue delay and no later than seventy-two (72) hours after confirming it, of any security incident affecting the Processed Data, with the available information about its nature, scope and the measures taken, and cooperate with the Customer in managing the incident and in the notifications the law requires of it. In Colombia, the Provider will also report to the Superintendence of Industry and Commerce where it must do so as processor.
• Assist the Customer, through reasonable means, in handling data subjects' requests (to know, access, update, rectify, delete, revoke authorization, port, restrict or object) within the legal deadlines, and promptly forward to the Customer any request it receives directly from a data subject concerning the Processed Data, without answering it on its own except to tell the data subject to contact the Customer.
• Inform the Customer if it considers an instruction infringes applicable data protection law, and if it can no longer meet the obligations in this Annex, in which case the Customer may suspend the transfer of data and require the Provider to stop and remediate unauthorized processing.
• Make available to the Customer the information reasonably necessary to demonstrate compliance with this Annex and allow, with reasonable prior notice and no more than once a year (except after an incident), reasonable audits or assessments at the Customer's expense, which may be satisfied through reports, certifications or questionnaires where proportionate.
• At the end of the Service, return or delete the Processed Data in accordance with section 17.4, except what the law requires to be kept.

A.4 Subprocessors

The Customer gives the Provider general authorization to use subprocessors to provide the Service (hosting, backup, email delivery, maps and the like). The current list, with each one's function and country, is in the Privacy Policy. The Provider will impose on each subprocessor, by contract, data protection obligations substantially equivalent to those in this Annex and remains liable to the Customer for their performance. We will give at least fifteen (15) days' notice (by email to the administrator or in the Privacy Policy) before engaging a new subprocessor that processes Processed Data; if the Customer has a reasonable objection and we find no alternative, it may terminate the Service without penalty.

A.5 International transfers and transmissions

The Provider operates from Colombia and hosts the Service on servers located in the United States. The Processed Data may be accessed from Colombia for support and operations. For the purposes of Law 1581 of 2012, the Customer, as controller, authorizes the transmission of the Processed Data to the Provider as processor, and this Annex serves as the transmission contract required by article 25 of Decree 1377 of 2013. The United States is on the list of countries with an adequate level of protection issued by Colombia's Superintendence of Industry and Commerce (External Circular 005 of 2017, incorporated into its Single Circular). The Provider will not transfer the Processed Data to other countries without ensuring an adequate level of protection or without the Customer's authorization.

A.6 Security measures

The Provider maintains, at a minimum: encryption of communications (HTTPS/TLS) between devices and the Service; passwords stored with strong hashing functions and never in clear text; isolation of each Customer's data in a separate database schema; role-based access control defined by the Customer; files (photos and receipts) served only to authenticated users; temporary lockout after failed sign-in attempts; access logs; security headers in the web application; daily database backups with rotation; security updates of the system and its dependencies; and Provider staff access limited to what is necessary, with individual credentials. We review these measures periodically and may improve them without reducing the level of protection.

A.7 Customer obligations

The Customer warrants that: it complies with the data protection law applicable to it as controller or business; it has informed the data subjects and has the authorization or legal basis to upload their data to the Service and to have it processed in the United States and Colombia; it will not upload sensitive data or data of minors; it will configure access and roles appropriately; and it will handle data subjects' requests. The Customer remains responsible to data subjects and authorities for the processing it directs, without prejudice to the Provider's liability for its own breaches.