Privacy policy and personal data processing

Last updated: 2026-05-21 · Applicable jurisdiction: Republic of Ecuador

1. Data controller

Ultimate Track acts as the data controller for the data needed to operate the platform. When a customer loads data about their own drivers, vehicles or operators, Ultimate Track acts as data processor under the service contract. For inquiries contact manager@ultimatetrack.org.

2. Public site (this landing)

This site is static and does not collect personal data. We do not use tracking cookies, third-party analytics, pixels or browser fingerprinting. Contact links open your mail client: the message travels directly from your device, never through our servers.

3. Data processed in the platform

• Account data: name, email, role and assigned license.
• Device data: identifiers, operational profile and verification code.
• Geolocation data: GPS traces and operational events generated by devices authorized by the customer. Per art. 4 LOPDP, geolocation data may be personal data when it allows identification of a natural person.
• Technical and audit data: authentication and operation logs needed for security and compliance.

4. Lawful bases (art. 7 LOPDP)

Processing relies, as applicable, on:

• Free, specific, informed and unambiguous consent of the data subject.
• Execution of pre-contractual measures or of a service contract.
• Compliance with a legal obligation of the controller.
• Legitimate interest of the controller or a third party, duly balanced.

5. Purposes

• Deliver the contracted GPS and operational monitoring service.
• Generate reports, alarms and operational metrics for the customer.
• Ensure platform security and prevent fraud or unauthorized use.
• Comply with legal, contractual and tax obligations.

We do not make automated decisions producing legal effects on data subjects within the meaning of art. 16 LOPDP.

6. Multi-tenant isolation

All information is scoped by license: no customer can access data belonging to another organization. General administrators (owners) access only for operational support and are bound by confidentiality agreements and professional secrecy (art. 41 LOPDP).

7. Retention and deletion

We retain data for the time necessary to fulfill the described purposes and applicable legal periods. Account data is kept while the license is active; GPS traces are kept according to the contracted plan. Once the retention period elapses, data is deleted or anonymized following the data minimization principle (art. 10 LOPDP).

8. Data subject rights (arts. 12 and following LOPDP)

As a data subject you may exercise at any time the following rights:

• Access to your data and information about its processing.
• Rectification of inaccurate or incomplete data.
• Erasure (right to be forgotten), where applicable.
• Objection to processing.
• Cancellation and revocation of consent.
• Portability in a structured, commonly used format.
• Suspension of processing.
• Not being subject to automated decisions, including profiling.

To exercise them, write to manager@ultimatetrack.org identifying yourself (name, ID number, copy of your ID document) and describing the right you are exercising. We will respond within a maximum of fifteen (15) days from receipt, extendable as provided in art. 30 LOPDP when the request requires it.

If you consider that your rights were not properly addressed, you may file a complaint with the Superintendence of Personal Data Protection (SPDP) of Ecuador.

9. Sensitive data

Ultimate Track does not require or request sensitive data (art. 25 LOPDP: ethnicity, religion, political affiliation, health, biometric data, sexual orientation, etc.) to deliver the service. If the customer chooses to load such data in custom fields, it will be responsible for obtaining the strengthened lawful bases the law requires.

10. International transfers

Ultimate Track infrastructure may operate in countries recognized by the SPDP as providing an adequate level of protection or, failing that, under standard contractual clauses, binding corporate rules or other mechanisms provided in arts. 56 to 62 LOPDP. To consult the detail of processors (cloud, observability) write to the contact address.

11. Information security (art. 37 LOPDP)

We apply technical and organizational measures proportional to risk: encryption in transit (TLS), role-based access control, two-factor authentication, device verification codes, audit logs, encrypted backups and centralized observability.

12. Security breaches (art. 43 LOPDP)

In the event of a security breach affecting data subjects' rights and freedoms, we will notify the Superintendence of Personal Data Protection within a maximum of five (5) days of becoming aware of it, and affected data subjects without undue delay when there is a high risk.

13. Data Protection Officer (DPO)

Ultimate Track's DPO/data protection officer contact is manager@ultimatetrack.org.

14. Minors

The platform is not directed at minors. If processing of data of children or adolescents without consent from their legal representative is detected (art. 22 LOPDP), the data will be deleted.

15. Changes to this policy

This policy may be updated. Substantial changes will be notified through the usual channels with at least 30 days' notice.

Disclaimer: the content of this document is provided for informational purposes and does not replace legal advice. References to the LOPDP, its Regulation and SPDP resolutions may evolve; we recommend consulting the official texts on the Ecuadorian SPDP portal.

← Back to home