Privacy Notice

Who is responsible

VORAX Logistics, S.A.S., based in Querétaro, Mexico, tax ID (RFC) VLO260715TY0, is the controller of your personal data. For anything related to this notice, including exercising your rights, write to legal@voraxlog.com or call +52 55 7226 9368.

What data we collect

We receive it directly from you (through the site's forms, in writing, or when you onboard as a client or carrier) or from the company you represent. We do not collect sensitive data: nothing about health, beliefs, ethnicity, union membership, political views or sexual orientation. If we receive a document with sensitive data we didn't request, we remove it from your file and never add it to our databases.

• Identification and contact: name, email, phone, official ID and the authority of whoever signs or requests a quote.
• If you're a carrier: federal driving licence, permits, and driver and unit details, including their IMSS registration status and rest/duty-hour records.
• Tax data: RFC, tax regime and compliance status, to issue and receive invoices.
• Financial data: bank account and CLABE, only with your express consent when signing the corresponding contract.

What we use it for

Necessary for the relationship: validating your onboarding file, preparing quotes, executing contracts and Service Orders, verifying permits and insurance, issuing tax invoices with Carta Porte, processing payments, complying with counterparty and beneficial-owner identification duties under anti-money-laundering rules, documenting the absence of an employment relationship with the carrier's drivers, and handling incidents or authority requests. Secondary and optional: sending commercial information, survey invitations or building internal statistics. You may opt out any time by writing to legal@voraxlog.com with the subject "NEGATIVA FINALIDADES SECUNDARIAS"; we act on it within 5 business days, without affecting the service you already contracted.

Who we share it with

We do not sell your data or share it for advertising. Only those necessary to run the site or deliver the service are involved, each receiving strictly what its role requires:

• HubSpot: the CRM where we store your request and the history of our conversation.
• Supabase and Vercel: the database and hosting that run the site.
• Google Analytics: measures site usage in aggregate, without identifying you by name.
• The cargo insurer covering your shipment, when your operation requires coverage.
• The final client or the origin/destination facility, for access control at their premises.
• The assignee financial institution, only if your company takes part in our accounts-receivable financing programme.
• Tax, labour or judicial authorities, when required by law.
• Our accountants, lawyers and auditors, under contractual confidentiality.

International transfers

HubSpot, Supabase, Vercel and Google run infrastructure in the United States, so data the site collects (forms, analytics) is stored and processed outside Mexico. Your operational data as a client or carrier (permits, insurance, bank accounts) is handled within Mexico; if that ever changed, we would update this notice before making the transfer.

Cookies and analytics

The site uses first- and third-party cookies to remember your language, measure site usage (Google Analytics) and recognize you if you return after one of our emails (HubSpot). You can block or delete them from your browser settings; the site works fine without them.

How long we keep it

We keep your data for as long as a business relationship exists and, afterward, for the following periods, after which we block and delete it:

• Onboarding file, contracts and Service Orders: 10 years from the end of the relationship.
• Carrier labour documentation and incident files: 5 years.
• Data used only for commercial purposes: until you opt out.

Security measures

We maintain reasonable administrative, technical and physical safeguards: need-to-know access control, two-factor authentication on our platforms, and a callback verification protocol for any change to a bank account. If a breach significantly affects your rights, we will notify you immediately, with details of the incident and the steps taken.

Your data rights

You can request Access, Rectification, Cancellation or Objection regarding your personal data at any time, withdraw your consent, or ask us to limit its use or disclosure. Write to legal@voraxlog.com with the subject "DERECHOS ARCO", stating your name and what you want to exercise. We respond within 20 business days, and act on the decision within 15 further business days. There is no charge, other than justified shipping or reproduction costs.

Changes to this notice

If we change how we handle your data, we will publish the updated text on this same page with its effective date. For substantial changes, we will notify you by email at least ten calendar days in advance.

Authority

If you believe your right to data protection has been harmed by VORAX, you may file a complaint with Mexico's competent data protection authority.