Privacy Policy

INTRODUCTION

This Privacy Policy explains how Axxon processes information about individuals, including personal data, in connection with the axxon.co website and Axxon's fleet management, dashcam, video telematics and related services (the "Services").

Who controls your personal data

Axxon operates through two entities:

Axxon B.V., a company registered under number 133383 with the Chamber of Commerce and Industry of Curacao, with registered office at Bon Bini Business Center Unit 1-10, Curacao. Axxon B.V. is the controller of personal data collected through the axxon.co website, from prospective customers, and in connection with commercial relationships entered into with Axxon B.V.

Axxon Latam S.A.S., a company incorporated under the laws of the Republic of Colombia, NIT 901.911.215-4, domiciled at Calle 15 Norte #6N-34, Edificio Alcazar, Oficina 901, Cali, Colombia. Axxon Latam S.A.S. is the controller of personal data processed in connection with commercial relationships entered into with Axxon Latam S.A.S., and is the Responsable del Tratamiento for the purposes of Colombian law.

References to "Axxon", "we", "us" and "our" in this Policy mean the entity that controls the personal data in question, as set out above.

Two different roles

Axxon processes personal data in two distinct capacities, and this Policy treats them separately.

As a controller. Axxon determines the purposes and means of processing personal data relating to website visitors, prospective customers, account administrators, and billing and commercial contacts. Sections 1.A, 2 and 3 of this Policy describe that processing.

As a processor. When a customer uses the Services, Axxon processes personal data relating to that customer's drivers, employees, contractors and users on the customer's behalf and on its documented instructions. In respect of that data, the customer is the controller, the Responsable del Tratamiento under Colombian law, and Axxon is the processor, or Encargado del Tratamiento. Axxon does not determine the purposes of that processing and does not process that data for its own purposes. Section 1.B of this Policy describes that data. The purposes set out in Section 2 do not apply to it.

If you are a driver, employee or contractor of an Axxon customer, the organisation that operates your vehicle or issued your account is the controller of your personal data. Requests concerning that data should be directed to that organisation in the first instance. Axxon will assist its customer in responding, and will not respond directly unless required by law or instructed to do so by the customer. Axxon's contact details are set out in Section 11 if you are unable to identify or reach the relevant organisation.

This Policy is a notice. It describes how Axxon processes personal data. It is not a contract, and reading or using the website does not constitute authorisation for the processing of your personal data. Where authorisation is required, Axxon obtains it separately, in the manner described in Section 3.

1. INFORMATION WE PROCESS

1.A Personal data Axxon processes as a controller

1.A.1 Account and commercial data. When you set up an account, request a quotation, or place an order, you provide us with:

• full name;
• e-mail address;
• phone number;
• job title and employer;
• billing and shipping address;
• payment information;
• any other information you choose to provide for this purpose.

1.A.2 Communications. Correspondence between you and Axxon, including support requests, sales enquiries, and records of meetings and calls held in connection with a commercial relationship.

1.A.3 Website data. When you visit axxon.co we may process:

• your IP address;
• device and browser type and version;
• pages visited and actions taken on the website.

1.A.4 Marketing data. Where you have subscribed to a newsletter, blog or similar communication, your contact details and your subscription status.

1.B Personal data Axxon processes on behalf of its customers

The following categories of personal data are processed by Axxon solely as configured and instructed by the customer, in connection with fleet management, compliance, operational and driver safety purposes determined by that customer. Axxon does not determine the purposes of this processing and does not use this data for its own purposes.

1.B.1 Vehicle and operational data, including make, model, mileage, technical status, fuel and temperature sensor readings, and other telemetry generated by the customer's fleet.

1.B.2 Location and journey data, including GPS position, routes, speed, direction and journey history.

1.B.3 Driving behaviour data, including events detected by Axxon's systems such as harsh braking, acceleration, cornering, speeding, distraction and signs of drowsiness.

1.B.4 Video and image data, where the customer has enabled camera functionality, including footage of the road, the vehicle interior, and individuals inside or near the vehicle.

1.B.5 Audio data, where the customer has enabled audio recording. Audio recording is enabled by default.

1.B.6 Driver and user identifiers, where enabled and populated by the customer, including name, e-mail address, phone number, employee or driver identification number, and driving licence number.

1.B.7 Account and access data relating to the customer's users, including login credentials, access permissions, and activity logs within the Services.

Axxon does not perform facial recognition and does not process biometric data for the purpose of uniquely identifying any individual. Where Axxon's systems analyse images of a driver, they do so to detect behaviour and conditions relevant to road safety, and not to identify the individual.

1.C Third-party integrations

A customer may choose to connect third-party services to its Axxon account. Where such an integration is enabled, the relevant third-party provider may receive or transmit data in connection with the Services. The customer is responsible for the configuration of any such integration and for reviewing the privacy terms of the third-party provider.

2. PURPOSES OF PROCESSING

This Section applies only to the personal data described in Section 1.A. It does not apply to personal data Axxon processes on behalf of its customers under Section 1.B.

Axxon processes personal data as a controller for the following purposes:

• to register you for the use of the Services, verify your identity, and create and administer your account;
• to provide the Services under a contract with you or the organisation you represent;
• to issue invoices and process payments;
• to communicate with you, respond to enquiries and requests, and provide support;
• to manage and develop the commercial relationship, including sales and account management;
• to analyse the use of the axxon.co website in order to maintain and improve it;
• to send commercial communications about Axxon's products and services, where you have authorised us to do so;
• to protect the legal interests of Axxon, its customers and third parties, including enforcing contractual terms, establishing, exercising or defending legal claims, and preventing fraud and misuse of the Services;
• to comply with legal, accounting, tax and regulatory obligations.

Axxon does not sell personal data. Axxon does not use personal data processed on behalf of its customers under Section 1.B for its own product development, analytics, marketing or advertising purposes.

3. LEGAL GROUNDS FOR PROCESSING

Axxon processes personal data only where it has a lawful basis to do so. The applicable basis depends on the category of data and the purpose of processing, and the same data may be processed for several purposes on more than one basis.

3.1 Contract. Where processing is necessary to enter into or perform a contract with you or with the organisation you represent.

3.2 Legal obligation. Where processing is necessary for Axxon to comply with an obligation imposed by applicable law, including commercial, accounting, tax and regulatory obligations, or to respond to lawful requests from public authorities.

3.3 Legitimate interests. Where processing is necessary for the legitimate interests of Axxon or a third party, provided those interests are not overridden by the rights and freedoms of the data subject. Axxon relies on this basis for maintaining and securing the Services, preventing fraud and misuse, and managing commercial relationships. This basis is not available in Colombia; see the Colombia Addendum.

3.4 Consent or authorisation. Where you have given consent, or, in Colombia, prior express and informed authorisation. Axxon relies on this basis for newsletters, marketing communications and non-essential cookies. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Where Axxon acts as a processor under Section 1.B, the lawful basis for processing is determined by the customer as controller. The customer is responsible for establishing that basis and for obtaining any authorisations or providing any notices required by law, including in relation to the use of camera and audio recording functionality.

4. SENSITIVE DATA

The Services are not intended for the collection or processing of sensitive personal data.

Axxon does not perform facial recognition, does not process biometric data for the purpose of uniquely identifying an individual, and does not intentionally collect data revealing health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation.

Camera functionality, where enabled by a customer, produces continuous or event-triggered video that may incidentally capture information capable of being classified as sensitive under applicable law, including images of individuals. Behaviour detection systems analyse images of a driver in order to detect conditions relevant to road safety, such as distraction or signs of drowsiness. These systems do not identify individuals.

Where sensitive data is incidentally captured through the use of the Services, the customer, as controller, is responsible for establishing an appropriate legal basis and for satisfying all applicable legal requirements, including any notice or authorisation obligations owed to drivers and other affected individuals.

You are not obliged to authorise the processing of sensitive data. Where Axxon requests authorisation for the processing of sensitive data, it will inform you that the data is sensitive, identify the purposes of the processing, and make clear that providing authorisation is optional.

5. SHARING PERSONAL DATA WITH THIRD PARTIES

5.1 Service providers acting on Axxon's instructions. Axxon engages third parties to provide services necessary to operate its business and deliver the Services. These include hosting and infrastructure providers, fleet management and video telematics platform providers, communication and content delivery networks, security providers, billing and payment processors, analytics and e-mail distribution providers, and professional advisors.

These providers receive only the personal data necessary to perform the service requested, act on Axxon's documented instructions, and are bound by written agreements imposing data protection obligations no less protective than those Axxon owes to its own customers.

5.2 Independent recipients. Where a third party receives personal data and processes it for its own purposes rather than solely on Axxon's instructions, that third party acts as an independent controller. Axxon will identify any such recipient, the categories of data concerned, and the purposes involved, and will ensure that the legal requirements applicable to such a disclosure are satisfied before it takes place.

5.3 Legally required disclosures. Axxon may disclose personal data where required by applicable law, court order, or a lawful request from a public authority. In such cases Axxon will disclose only the minimum data strictly necessary, maintain a record of the disclosure, and notify the affected individual or the relevant customer where legally permitted.

5.4 Corporate transactions. Personal data may be disclosed in connection with a merger, acquisition, reorganisation or sale of assets, subject to appropriate confidentiality protections and to the recipient assuming obligations no less protective than those in this Policy.

6. INTERNATIONAL TRANSFERS

Axxon operates across Curacao, Colombia and the wider Caribbean, and engages service providers located in the European Union, the United States and other jurisdictions. Personal data may therefore be transferred outside the country in which it was collected.

Where personal data is transferred to a country that does not provide a level of protection equivalent to that of the country of origin, Axxon implements appropriate safeguards, which may include:

• transfer to a jurisdiction recognised as providing an adequate level of protection by the competent authority;
• contractual guarantees imposing obligations equivalent to those required by the law of the country of origin, including the European Commission's Standard Contractual Clauses where applicable;
• the express and informed authorisation of the data subject, having been informed of the destination and the level of protection available.

Additional requirements apply to transfers from Colombia. See the Colombia Addendum.

Axxon maintains records of international transfers and will make them available to a competent supervisory authority on request.

7. RETENTION

Axxon retains personal data only for as long as necessary for the purposes for which it was collected, or for as long as required by applicable law.

• Commercial and contractual data: duration of the relationship, plus the applicable statutory limitation period.
• Financial, accounting and tax data: as required by the applicable commercial and tax law of the relevant jurisdiction.
• Website and analytics data: up to 24 months from collection.
• Marketing and newsletter data: until consent is withdrawn or the subscription is cancelled.
• Data processed on the basis of legitimate interests: for as long as the interest persists, subject to periodic review.
• Support and correspondence records: duration of the relationship, plus 3 years.

Personal data processed on behalf of a customer under Section 1.B is retained in accordance with that customer's instructions and configuration of the Services, as set out in the applicable data processing agreement. Video recordings are retained for approximately thirty (30) days unless otherwise configured by the customer.

On expiry of the applicable retention period, Axxon will securely delete or anonymise the personal data, unless retention is required or permitted by applicable law, including for the purposes of a legal hold or the establishment, exercise or defence of legal claims.

8. SECURITY

Axxon implements technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures are appropriate to the nature of the data, the risks involved and the state of the art, and include:

• encryption of personal data in transit and at rest;
• access controls and authentication mechanisms;
• role-based access restrictions limiting access to personnel who require it;
• logging and monitoring of system access and activity;
• confidentiality obligations binding on all personnel with access to personal data;
• backup and restoration controls;
• incident response and escalation procedures;
• periodic review of security measures.

No system is entirely secure, and Axxon does not warrant that its measures will prevent every incident. Axxon reviews and updates these measures over time and will not make changes that materially reduce the overall level of protection.

9. SECURITY INCIDENTS

Where Axxon becomes aware of a security incident affecting personal data it processes as a controller, it will assess the incident and, where required by applicable law, notify the competent supervisory authority and the affected individuals without undue delay.

Where an incident affects personal data Axxon processes on behalf of a customer, Axxon will notify that customer without undue delay in accordance with the applicable data processing agreement, and will cooperate with the customer in its own notification obligations. Axxon will not notify the customer's data subjects or a supervisory authority directly unless required by law or instructed to do so by the customer.

Axxon maintains records of security incidents affecting personal data and preserves evidence reasonably necessary for investigation and remediation.

10. YOUR RIGHTS

Subject to the conditions and exceptions of applicable law, you have the right to:

• obtain confirmation of whether Axxon processes your personal data, and to access that data;
• request correction of inaccurate, incomplete or outdated data;
• request deletion of data that is no longer necessary for the purposes for which it was collected, or where you have withdrawn authorisation and no legal obligation requires its retention;
• withdraw consent or authorisation at any time, without retroactive effect on processing already lawfully carried out;
• object to or request restriction of processing, where applicable law provides for this;
• request portability of data you have provided, where applicable law provides for this;
• obtain evidence of the authorisation granted for the processing of your data, where applicable;
• be informed of the use made of your personal data;
• lodge a complaint with Axxon or with the competent supervisory authority.

To exercise any of these rights, contact Axxon using the details in Section 11. Axxon may need to verify your identity before responding and may request additional information for that purpose.

Axxon will respond within the period required by applicable law. Specific deadlines apply in Colombia; see the Colombia Addendum.

If you are a driver, employee or contractor of an Axxon customer, please see the Introduction to this Policy. Requests concerning data processed on that customer's behalf should be directed to that organisation.

Providing personal data is necessary in order to enter into a contract with Axxon and to receive the Services. Where Axxon requests personal data for a purpose that is not necessary for the provision of the Services, providing it is optional, and declining will not affect your access to the Services.

11. CONTACT

For questions about this Policy, to exercise your rights, or to lodge a complaint:

For processing in Colombia and by Axxon Latam S.A.S.: Calle 15 Norte #6N-34, Edificio Alcazar, Oficina 901, Cali, Colombia. Phone: +57 (304) 354-7106.

For all other processing and by Axxon B.V.: Bon Bini Business Center Unit 1-10, Curacao.

12. CHANGES TO THIS POLICY

Axxon may amend this Policy, for example where it introduces new services or features, or where required by a change in applicable law.

Axxon will give notice of any material change at least thirty (30) days before it takes effect, by publishing the updated Policy on this page and, where a commercial relationship exists, by notifying the relevant contact by e-mail. Non-material changes, including the correction of clerical errors, take effect on publication.

Where a change introduces a new purpose of processing that requires your consent or authorisation, Axxon will obtain that consent or authorisation before processing your personal data for the new purpose. Continued use of the Services does not constitute authorisation for a new purpose.

The date of the most recent revision appears at the top of this Policy.

COLOMBIA ADDENDUM

This Addendum supplements and forms an integral part of the Axxon Privacy Policy (the "Policy") and applies exclusively to the processing of personal data carried out in the Republic of Colombia and to the personal data of Colombian data subjects (the "Processing of Data in Colombia").

In the event of any conflict between the Policy and this Addendum, this Addendum prevails, exclusively with respect to the Processing of Data in Colombia.

This Addendum states only those provisions that deviate from or supplement the Policy. All other provisions of the Policy apply unchanged.

Responsable del Tratamiento: Axxon Latam S.A.S., NIT 901.911.215-4, Calle 15 Norte #6N-34, Edificio Alcazar, Oficina 901, Cali, Colombia. Phone: +57 (304) 354-7106.

C.1 Legal grounds (deviation from Section 3)

Under Law 1581 of 2012, the processing of personal data requires the prior, express and informed authorisation of the data subject (Titular), obtained by any means capable of subsequent verification. This authorisation is the primary legal basis for processing in Colombia.

C.1.1 Contract. A contractual relationship provides a valid context for obtaining authorisation but does not, by itself, replace the requirement of authorisation. Axxon obtains the data subject's authorisation at or before the time of collection, which may be incorporated into the contractual documentation.

C.1.2 Legal obligation. Under Article 10 of Law 1581 of 2012, authorisation is not required where:

• the information is required by a public or administrative authority in the exercise of its legal functions, or by court order;
• the data is of a public nature;
• there is a medical or sanitary emergency;
• the processing is authorised by law for historical, statistical or scientific purposes;
• the data relates to the Civil Registry.

In all such cases Axxon complies with all other obligations under Colombian data protection law.

C.1.3 Legitimate interests. Legitimate interest does not exist as an autonomous legal basis under Colombian data protection law. Any processing that would otherwise rely on Section 3.3 of the Policy requires prior, express and informed authorisation in Colombia, unless an Article 10 exception applies.

C.1.4 Requirements of authorisation. Authorisation must be prior, obtained before processing begins; express, given through an affirmative and unambiguous act; and informed, meaning the data subject must be clearly advised of the data collected, the purposes of processing, their rights, and the identity of the Responsable.

Axxon maintains records of all authorisations obtained and makes them available for consultation. Authorisation may be revoked at any time, without retroactive effect on processing already lawfully carried out.

C.2 Sensitive data (supplements Section 4)

Under Article 5 of Law 1581 of 2012, sensitive data (datos sensibles) is data affecting the intimacy of the data subject or whose misuse may give rise to discrimination, including data revealing health, racial or ethnic origin, political orientation, religious or philosophical convictions, trade union membership, biometric data and data concerning sex life.

Under Article 6, the processing of sensitive data is prohibited except where the data subject has given express authorisation, having first been informed that the data is sensitive, of the purposes of processing, and that they are not obliged to authorise its processing.

Axxon does not request authorisation for the processing of sensitive data in connection with the Services. Where camera functionality enabled by a customer incidentally captures data capable of being classified as sensitive, the customer, as Responsable, is responsible for obtaining any required authorisation from the affected data subjects and for informing them that authorisation is optional.

Where Axxon processes sensitive data of its own employees or contractors, it does so under a separate privacy notice applicable to that relationship.

C.3 Sharing personal data (replaces Section 5)

Under Law 1581 of 2012 and Decree 1074 of 2015, the sharing of personal data with third parties is governed by two distinct mechanisms, which must be distinguished:

Transmision. Where a third party processes personal data exclusively on Axxon's instructions and on its behalf, the arrangement constitutes a transmision and requires a written data processing agreement (contrato de transmision de datos personales) setting out, at a minimum: the scope and purpose of processing; the security measures to be implemented; the obligation to process data solely within the scope authorised by the data subject; the prohibition on further transfers without Axxon's prior written consent; and the obligation to assist Axxon in responding to data subject requests. Separate authorisation from the data subject is not required, provided the processing remains within the scope of the authorisation originally granted to Axxon.

Transferencia. Where a third party receives personal data in order to process it for its own purposes, the arrangement constitutes a transferencia and requires the express and prior authorisation of the data subject, unless an exception under Article 10 of Law 1581 of 2012 applies. The authorisation must expressly cover the transfer to the specific recipient or category of recipients.

Axxon classifies each third-party relationship in accordance with this distinction and implements the corresponding mechanism before any data is shared. A transmision agreement is executed prior to any transfer of data.

Legally required disclosures are governed by Section 5.3 of the Policy.

C.4 International transfers (replaces Section 6)

Any transfer of personal data from Colombia to a recipient located abroad is governed exclusively by the Colombian international transfer regime under Law 1581 of 2012, Decree 1074 of 2015, and the guidelines issued by the Superintendencia de Industria y Comercio (SIC).

Such transfers are permitted only where:

• the recipient country has been determined by the SIC to provide an adequate level of protection; or
• Axxon has implemented contractual guarantees with the recipient ensuring a level of protection equivalent to that required under Colombian law; or
• the data subject has granted express and informed authorisation for the international transfer, having been informed of the destination country and the level of protection available.

Axxon maintains records of all international transfers and makes them available to the SIC on request.

C.5 Retention (supplements Section 7)

For the Processing of Data in Colombia, the following retention periods apply in place of the corresponding entries in Section 7:

• Commercial and contractual data: duration of the relationship, plus ten (10) years.
• Financial, accounting and tax data: minimum ten (10) years, as required by Colombian commercial and tax law.
• Health, occupational safety and social security records: up to 20 years.

C.6 Rights of data subjects (replaces Section 10)

Under Article 8 of Law 1581 of 2012, data subjects whose personal data is processed in Colombia have the following rights, exercisable at any time and free of charge:

• Access (consulta): to obtain confirmation of whether their data is being processed and to receive a complete and intelligible copy of the data held;
• Rectification: to request correction of inaccurate, incomplete, fragmented or outdated data;
• Deletion (supresion): to request deletion of data no longer necessary for the purposes for which it was collected, or where authorisation has been revoked and no legal obligation requires retention;
• Revocation of authorisation: at any time, without retroactive effect on processing already lawfully carried out;
• Proof of authorisation: to obtain evidence of the authorisation granted;
• To be informed: of the use made of their personal data, on request;
• To lodge a claim: before Axxon or before the SIC.

C.7 Procedure for queries and claims

C.7.1 Consultas (queries). A query may be submitted by e-mail or in writing to the address set out above. The query should identify the data subject and describe the information requested.

Axxon will respond within ten (10) business days of receipt. Where it is not possible to respond within that period, Axxon will inform the data subject of the reasons and the date on which the query will be answered, which will not exceed five (5) further business days from the expiry of the initial period.

C.7.2 Reclamos (claims). A data subject who considers that data held by Axxon should be corrected, updated or deleted, or who considers that Axxon has breached its obligations under Law 1581 of 2012, may submit a claim. The claim must contain the identification of the data subject; a description of the facts giving rise to the claim; the address of the data subject; and any supporting documents.

Incomplete claims. If the claim is incomplete, Axxon will require the data subject to correct the deficiency within five (5) days of receipt. If the data subject does not provide the required information within one (1) month of that request, the claim will be deemed abandoned.

Claims addressed to the wrong party. If Axxon is not competent to resolve the claim, it will forward it to the appropriate party within two (2) business days and inform the data subject.

Annotation. Once a complete claim is received, Axxon will include a note stating "reclamo en tramite" and the reason for it in the relevant database record, within two (2) business days. The annotation is maintained until the claim is resolved.

Response. Axxon will resolve the claim within fifteen (15) business days of the day following receipt. Where it is not possible to resolve the claim within that period, Axxon will inform the data subject of the reasons and the date of resolution, which will not exceed eight (8) further business days from the expiry of the initial period.

C.7.3 Escalation to the SIC. A data subject may lodge a complaint with the Superintendencia de Industria y Comercio only after having submitted a claim directly to Axxon and having received an unsatisfactory response, or no response within the applicable period, in accordance with Article 16 of Law 1581 of 2012. Complaints may be submitted through www.sic.gov.co.

C.8 Security incidents (supplements Section 9)

Axxon will report to the SIC any security incident affecting the personal data it holds as Responsable, in accordance with the requirements and timeframes established by Colombian law and by the SIC.

Where Axxon acts as Encargado on behalf of a customer, it will notify that customer and cooperate with the customer in fulfilling the customer's own reporting obligations before the SIC.

C.9 Governing law

This Addendum and the Processing of Data in Colombia are governed exclusively by the laws of the Republic of Colombia, including Law 1581 of 2012 (Ley Estatutaria de Proteccion de Datos Personales); Decree 1074 of 2015 (Decreto Unico Reglamentario del Sector Comercio, Industria y Turismo), Book 2, Part 2, Title 2, Chapter 25; and any other applicable Colombian law, regulation, circular or guideline issued by the Superintendencia de Industria y Comercio in its capacity as the national data protection authority, in each case as amended, supplemented or replaced from time to time.

C.10 Effective date

This Addendum takes effect on August 1, 2026, and remains in force until amended or replaced in accordance with applicable law.