Data Protection Policy - Gauss Control Mexico
1. Introduction and Legal Framework
At Desert Point S.A. de C.V. (“Gauss Control”), we are firmly committed to protecting your privacy and your right to informational self-determination. This Policy governs the processing of personal information in strict compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (“LFPDPPP”) and its Regulations.
The processing of your personal data is governed by the principles of lawfulness, purpose limitation, fairness, consent, data quality, proportionality, transparency, and accountability.
2. Purpose
The purpose of this Policy is to establish the principles, guidelines, and responsibilities applicable to the processing of personal data carried out by Gauss Control. It also applies to employees, executives, contractors, and third parties involved in personal data processing activities.
3. Definitions
LFPDPPP: Federal Law on the Protection of Personal Data Held by Private Parties.
ISMS: Information Security Management System in accordance with ISO 27001.
ARCO Rights: (Access, Rectification, Cancellation, and Objection) are the legal rights that enable individuals to maintain control over their personal data. They guarantee the right to know what information a company holds about you, correct it if it is inaccurate, request its deletion, or object to its processing.
4. Roles and Responsibilities
Management shall appoint a Data Protection Officer responsible for coordinating security controls and ensuring compliance with the LFPDPPP. The Officer’s primary responsibilities shall include the timely handling of ARCO rights requests and the mitigation of risks associated with personal data processing.
5. Our Role: Data Controller vs. Data Processor
For legal purposes, it is essential to distinguish the role assumed by Gauss Control with respect to personal data:
- Data Controller: When you interact directly with us (for example, by visiting our website, completing a contact form, or working directly for Gauss Control), Gauss Control acts as the “Data Controller,” determining how your personal data is used and protected.
- Data Processor: In the provision of our corporate technology services (such as Gauss Alert, Cognus, or Gauss Fleet), Gauss Control acts as the “Data Processor.” This means that we process information relating to drivers and operators solely and exclusively on behalf of and under the instructions of their employer (our corporate client), who legally acts as the “Data Controller” of the database.
6. Contractual Management of Data Processors and Sub-Processors
Gauss Control shall enter into the necessary agreements with Data Processors and Sub-Processors establishing obligations regarding confidentiality, information security, and personal data protection. Such arrangements shall be governed through our ISMS.
7. Security Breach Management
Gauss Control shall implement procedures to identify, address, document, and, where applicable, report security breaches. Such procedures shall be governed through our SGS.
8. Data Retention, Blocking, and Deletion
Personal data shall be retained only for as long as necessary to fulfill the applicable purposes and legal obligations.
9. Training and Awareness
Gauss Control shall promote periodic training programs for individuals involved in the processing of personal data. Such programs shall be governed through our ISMS.
10. Oversight and Continuous Improvement
Gauss Control may conduct periodic reviews or audits of its privacy processes and controls in order to strengthen its compliance program.
11. Personal Data and Sensitive Personal Data
In the development and provision of its services, Gauss Control may process different categories of personal data, whether acting as Data Controller or Data Processor, as applicable in each case.
Personal data processed by Gauss Control may include, without limitation:
- Identification data.
- Contact data.
- Employment-related data.
- Authentication and platform access data.
- Data related to the operation and monitoring of vehicles or equipment.
- Data generated by the systems and technological devices used in the provision of the services.
Likewise, depending on the services contracted by the client and the configuration of the devices or platforms used, Gauss Control may process categories of sensitive personal data, including biometric information and certain information related to the physical condition or health status of Data Subjects, where such processing is necessary for risk prevention, operational safety, or the provision of the contracted services.
Gauss Control shall ensure that the processing of personal data is limited to data that is adequate, relevant, and strictly necessary to fulfill the authorized purposes, while at all times observing the principles and obligations established under applicable law.
When Gauss Control acts as a Data Processor, personal data shall be processed exclusively in accordance with the documented instructions of the Data Controller and the terms established in the corresponding contractual instruments.
This information is available through the Data Governance Department, together with the classification of sensitive personal data and the corresponding risk levels.
12. Security and Confidentiality Measures
Gauss Control has established and maintains appropriate administrative, technical, and physical security measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, taking into account technological developments and the sensitivity of the data.
Any person involved in any stage of personal data processing at Gauss Control is subject to a strict duty of confidentiality, which shall remain in effect indefinitely even after the termination of their legal relationship with us. In the event of a security breach that significantly affects your rights, Gauss Control (or your employer, as applicable) shall notify you promptly.
13. ARCO Rights and Blocking Period
You have the right to exercise your ARCO Rights at any time:
- Access: To know what personal data we hold about you and the conditions under which it is processed.
- Rectification: To request the correction of your personal data if it is inaccurate or incomplete.
- Cancellation: To request the deletion of your personal data from our systems.
- Objection: To object, on legitimate grounds, to the processing of your personal data.
Note on Cancellation: In accordance with Article 24 of the LFPDPPP, the cancellation of personal data shall result in a legally required blocking period. During this period, the data shall be retained in an isolated state solely for the purpose of determining potential legal or contractual liabilities and shall be securely deleted or destroyed once the applicable limitation period has expired.
¿Cómo ejercerlos? Si Gauss Control actúa como Responsable de sus datos (ej. usuarios web), envíe su solicitud detallando el derecho que desea ejercer al correo, pd@gausscontrol.com. Si Gauss Control actúa como Encargado (conductores o empleados de nuestros clientes), usted deberá ejercer sus derechos ARCO directamente ante el departamento de recursos humanos de su empleador (el Responsable), y nosotros acataremos la instrucción de modificación o cancelación que ellos nos indiquen.
14. Data Transfers and Remissions
Gauss Control may disclose personal data to third parties or allow third parties to participate in personal data processing activities where necessary for the provision of its services, compliance with legal or contractual obligations, or the performance of its operational activities.
When third parties process personal data on behalf of Gauss Control and in accordance with its instructions, such relationship shall be considered a data remission or processing arrangement involving a Data Processor. In such cases, Gauss Control shall implement contractual and organizational mechanisms designed to ensure the confidentiality, security, and appropriate protection of personal data.
Where personal data is transferred to third parties other than Data Processors, such transfers shall be carried out in accordance with applicable law and subject to appropriate security measures for the protection of the information.
