Personal Data Protection Policy - Gauss Control Peru
1. Introduction and Legal Framework
At Gauss Control, we value your privacy and are committed to safeguarding your fundamental right to the protection of your personal data. This Policy governs the processing of personal information collected through our website and in connection with the provision of our services, in strict compliance with Law No. 29733, Peru’s Personal Data Protection Law, and its implementing regulations.
2. Our Role and Key Definitions
For legal purposes in Peru, responsibilities regarding personal information are divided as follows:
- Personal Data Bank Owner: When you interact directly with us (e.g., as a website visitor or direct employee), Gauss Control acts as the entity that determines the purposes and scope of the processing of your personal data.
- Personal Data Bank Processor: When providing technology services to our clients (such as Gauss Alert, Cognus, or Gauss Fleet), Gauss Control acts as the “Processor.” This means that we process information, including biometric and telemetry data, exclusively on behalf of your employer (our client), who is the Personal Data Bank Owner.
3. Guiding Principles
All personal data processing activities carried out by us within Peruvian territory are governed by the principles established under Peruvian law:
- Lawfulness: We do not collect personal data through fraudulent or unlawful means.
- Consent: All processing requires the consent of the Data Subject.
- Purpose Limitation: Personal data is used solely for the explicit purpose for which it was collected.
- Proportionality and Data Quality: We process personal data that is accurate, truthful, and strictly necessary for the relevant operational purpose.
- Security and Adequate Level of Protection: We implement technical measures and safeguards consistent with international standards.
4. Processing of Personal Data and Sensitive Data
In the provision of our occupational safety and fatigue prevention services, our devices may capture information classified by law as Sensitive Data. This includes biometric data (facial recognition) and health-related information (breath alcohol testing).
- Consent Requirement: For the processing of such sensitive data, Peruvian law requires consent to be prior, informed, express, unequivocal, and provided in writing.
- Gauss Control requires its clients (the Personal Data Bank Owners) to ensure that such written consent has been obtained from their drivers and operators before using our devices.
5. Security and Confidentiality Measures
Gauss Control has adopted the technical, organizational, and legal measures necessary to ensure the security of personal data banks and prevent their alteration, loss, unauthorized processing, or unauthorized access. Likewise, all of our employees, suppliers, and any other persons involved in any stage of the processing are subject to a strict duty of confidentiality, which shall remain in effect indefinitely even after the termination of the relevant employment or commercial relationship.
6. Cross-Border Transfer of Personal Data
Because our technology infrastructure operates in the cloud to ensure high standards of redundancy and availability, we carry out what the law defines as cross-border flows of personal data (international transfers). Gauss Control ensures that destination servers and jurisdictions maintain adequate levels of protection comparable to those required under Law No. 29733.
7. Data Subject Rights (ARCO Rights)
If you are a Data Subject whose personal data is managed by us, applicable law grants you access to administrative and judicial mechanisms to enforce your rights. You may exercise the following rights at any time:
- Right to Information and Access: To know what personal data concerning you is being processed, how it was collected, and for what purpose.
- Right to Erasure (Cancellation): To request the deletion of your personal data when it is no longer necessary for the original purpose or when the applicable processing period has expired.
- Derecho de Supresión (Cancelación): Pedir la eliminación de sus datos cuando hayan dejado de ser necesarios para el fin original o haya vencido el plazo para su tratamiento.
- Right to Object: To object to the processing of your personal data on legitimate and well-founded grounds.
How to Exercise These Rights: To exercise these rights, you may submit your request through our official contact channel at pd@gausscontrol.com. If you do not receive a satisfactory response, you have the right to seek further protection by filing a complaint with the National Authority for Personal Data Protection (National Directorate of Justice of the Ministry of Justice).
