Orbion, homeOrbion, home

Personal Data Processing Policy

Version 1.0 · Effective date: November 1, 2026 · Published at https://orbion.cloud/privacy-policy

This policy explains how personal data processed through Orbion, the platform for managing fuel stations, fleets and IoT devices, is collected, stored, used, shared and deleted. It is issued under Colombian Statutory Law 1581 of 2012 (Ley 1581 de 2012) and Decree 1074 of 2015, Part 2, Book 2, Title 2, Chapter 25 (formerly Decree 1377 of 2013), in particular its article 2.2.2.25.3.1, which sets the minimum content of every data processing policy. This English text is a translation; if it differs from the Spanish text, the Spanish text prevails.

1. Data controller

  • Legal name: Gasoleo Technology S.A.S. ("GT"), the provider of Orbion.
  • Tax ID (NIT): 901.938.828-6
  • Registered office and address: Cra 65GG # 24 47, Medellín, Antioquia, Colombia
  • Email for personal data matters: privacy@gasoleotechnology.com
  • Telephone: +57 300 2022479

1.1. When GT is the controller and when it is the processor

GT is the controller (responsable) of the data of visitors to this site, users of its portal, and the contacts of its customers and suppliers.

The fuel stations and companies that subscribe to Orbion (the "customers") decide which data about their drivers, vehicles, employees and fleet clients they record in the platform, and why. For that data the customer is the controller and GT acts as processor (encargado): it processes the data on the customer's behalf, only to provide the service, and following the customer's instructions (Law 1581 of 2012, article 3(d) and article 18). If your data reached Orbion through a station or through the company you work for, you may exercise your rights with them or with GT; GT will forward your request to the customer that controls the data and help resolve it within the legal deadlines.

2. Personal data we process

Orbion processes only the data it needs to provide the service. Depending on your relationship with us:

  • Portal and station terminal (HMI) users: name, user name, email address, telephone, password (stored only as a one-way hash), roles, the company the user belongs to, and the shifts the user opens and closes at the terminal.
  • Fleet customers: the company's legal name and tax ID (NIT), the users it authorises, contracts, credit limits, balances, holds, payments and internal invoices.
  • Drivers and equipment operators: name and the fleet they belong to.
  • Vehicles and equipment: licence plate or registration, model, tank capacity and cost centre. A plate is personal data when it can identify its owner or driver.
  • Fuelling authorisation identifiers: the value read by the station's readers (RFID card, NFC tag, barcode or QR code, plate, or an identity document such as a Colombian citizenship card, foreign resident card, passport or NIT), its type, validity and status.
  • Transactions: the date, station, dispenser, product, volume and amount of each sale, and the company, fleet or vehicle it is attributed to when it is a fleet credit sale.
  • Online payments: the reference and status returned by the payment gateway (Stripe or PayU). Orbion never receives or stores card numbers: the gateway captures them directly.
  • Field-service evidence: photographs, videos, documents and signatures that technicians attach to verify an installation or a service, together with the user who captured them. A signature or a photograph of a person is personal data.
  • Technical and security data: IP address, browser, date and time, pages visited and operations performed, sign-in attempts, and audit records of changes.
  • Cookies on this site and the portal (section 9).

Sensitive data. Orbion does not request or process sensitive data as defined in article 5 of Law 1581 of 2012: it collects no biometric or health data, no data on racial or ethnic origin or on political or religious views, and no geographic location of people or vehicles. Nobody is required to provide sensitive data.

Children and adolescents. Orbion is a business-to-business service and is not directed at minors. If a minor's data were exceptionally recorded, it will be processed respecting the minor's best interests and fundamental rights, with the authorisation of their legal representative (Law 1581 of 2012, article 7).

3. Purposes of processing

  1. Create and manage user accounts, authenticate people and control their permissions.
  2. Operate fuel stations: open and close shifts, authorise fuel dispensing, record sales and print receipts.
  3. Identify a fleet's vehicle, driver or card at the island, check that the fuelling is authorised, and attribute it to the company's account.
  4. Manage fleet credit: contracts, limits, holds, balances, statements, collections, payments and reconciliation.
  5. Produce consumption and activity reports by company, fleet and vehicle for the customer.
  6. Provide technical support, monitor and maintain the platform and the devices installed at stations, and announce service changes.
  7. Verify and document installations and technical services carried out in the field through photographs, videos, documents and signatures, and send notifications by text message (SMS) and email.
  8. Protect information security, prevent fraud and unauthorised access, and keep audit records.
  9. Invoice and collect GT's services and meet accounting, tax and legal obligations.
  10. Answer queries, claims and requests from competent authorities.

Data is not sold and is not used for advertising. Any other purpose will require a new authorisation.

4. Authorisation

Processing requires the data subject's prior, express and informed authorisation, except in the cases of article 10 of Law 1581 of 2012 (for example, public data or information required by a public body exercising its functions). Authorisation may be given in writing, orally, or through unequivocal conduct from which it can reasonably be concluded that it was given (Decree 1074 of 2015, article 2.2.2.25.2.4). Silence is never taken as authorisation. GT and its customers must keep proof of it (article 2.2.2.25.2.5).

When a customer records the data of its drivers, employees or fleet clients in Orbion, that customer, as controller, must obtain the data subjects' authorisation before recording it.

Authorisation text (the Spanish wording is the one presented to data subjects):

"I authorise Gasoleo Technology S.A.S. (GT), tax ID 901.938.828-6, and, where applicable, the station or company that registered me in Orbion, to collect, store, use, share and delete my personal data for the purposes described in the Personal Data Processing Policy published at https://orbion.cloud/privacy-policy, including its storage on servers located in the United States of America. I acknowledge that I was told I am not required to provide sensitive data or data about children and adolescents, and that I may access, update, correct and delete my data, revoke this authorisation, and file complaints with the Superintendencia de Industria y Comercio, by writing to privacy@gasoleotechnology.com."

5. Data subjects' rights

Under article 8 of Law 1581 of 2012, you have the right to:

  1. Access, update and correct your data, including data that is partial, inaccurate, incomplete, fragmented or misleading.
  2. Request proof of the authorisation you gave, except where the law does not require it.
  3. Be informed, on request, of how your data has been used.
  4. File complaints with the Superintendencia de Industria y Comercio (SIC) for breaches of the law, once you have completed the query or claim procedure with the controller or processor (article 16).
  5. Revoke the authorisation at any time and request deletion of your data, especially when the constitutional and legal principles, rights and guarantees are not respected (article 9 of Decree 1377 of 2013, compiled in Decree 1074 of 2015, Chapter 25). Revocation and deletion do not apply where there is a legal or contractual duty to remain in the database.
  6. Access your personal data being processed free of charge.

6. How to exercise your rights

Responsible area: GT's personal data protection area handles petitions, queries and claims. You can reach it at privacy@gasoleotechnology.com, by telephone on +57 300 2022479, or at Cra 65GG # 24 47, Medellín, Antioquia, Colombia. Requests may be filed by the data subject, their successors, their representative or attorney, or by whoever stipulated in favour of another.

From the Orbion portal: any user can open the "Personal data" option in their user menu. There they can "Request Personal Data" to download a copy of their account's data, or "Delete Personal Data" to ask for it to be erased. No email to us is needed.

6.1. Queries

Queries about the data held in our databases are answered within ten (10) business days of receipt. If that is not possible, we will tell you why and when you will receive an answer, which will not exceed five (5) additional business days (Law 1581 of 2012, article 14).

6.2. Claims

If you believe your data should be corrected, updated or deleted, or you notice a breach of the law, you may file a claim stating your identification, a description of the facts, an address for notices, and any documents you wish to rely on (Law 1581 of 2012, article 15).

  • If the claim is incomplete, we will ask you to complete it within five (5) days of receipt. If two (2) months pass without the missing information, the claim is deemed withdrawn.
  • Within two (2) business days of receiving a complete claim, the database will carry the note "claim in progress" ("reclamo en trámite") and its reason until the claim is decided.
  • Claims are resolved within fifteen (15) business days from the day after receipt. If that is not possible, we will tell you why and when you will receive an answer, which will not exceed eight (8) additional business days.
  • If GT receives a claim about data it does not control, it will forward the claim to the controller within two (2) business days and inform you that it did so.

6.3. Revoking the authorisation or requesting deletion

You may revoke your authorisation or request deletion of your data at any time, without having to give a reason, except where there is a legal or contractual duty to keep the data; in that case we will tell you what it is. The procedure is the claim procedure (section 6.2):

  1. Send your request to the email address or postal address in section 6, or use "Delete Personal Data" in the portal (this option deletes your account). State that you wish to revoke the authorisation, whether in full or only for certain purposes, and attach your identification.
  2. Within two (2) business days of receiving the complete request we will record the claim and the note "claim in progress" ("reclamo en trámite").
  3. We will resolve it within fifteen (15) business days at most, extendable by eight (8) more with notice of the reasons, and confirm in writing which data was deleted or why it was not possible.

7. Where data is stored, and international transfers

Orbion is hosted outside Colombia, in the United States of America: in Microsoft Azure, in the Central US region (Iowa), where the database, storage and keys are, and in the South Central US region (Texas); and on a dedicated server from the provider Nocix in Kansas City (Missouri). Those providers act as processors: they may process the data only to provide the hosting service, following GT's instructions. Sending data to them is an international transmission to a processor, governed by articles 2.2.2.25.5.1 and 2.2.2.25.5.2 of Decree 1074 of 2015, and not a transfer to another controller.

In addition, the United States of America is among the countries with an adequate level of data protection under the Superintendencia de Industria y Comercio's External Circular 005 of 2017 (Law 1581 of 2012, article 26), and the authorisation text in section 4 states that storage expressly.

Online payments are processed by the gateway that GT's customer contracts (the company or station that holds the account with the gateway): Stripe or PayU. Those gateways act under their own privacy policies as independent controllers for their own purposes, including fraud prevention and compliance with legal obligations. GT neither receives nor stores the card number or the security code; it keeps only the transaction reference, the amount and its status.

The following may also receive data, as processors and only for the corresponding purpose: Microsoft Azure Communication Services, which sends the platform's text messages (SMS) and email and therefore receives telephone numbers and email addresses, and authorities that require it in the exercise of their legal functions.

8. Security and retention

GT applies technical, human and administrative measures to protect data against tampering, loss, and unauthorised or fraudulent access or use (security principle, article 4(g)): encrypted connections, passwords stored as one-way hashes, permission-based access control, separation of each customer's data, and audit records.

Data is kept while the relationship with the data subject, or with the customer that recorded it, lasts, and afterwards for as long as accounting, tax and commercial rules require or as needed to handle claims. When that period ends, it is deleted or anonymised. The databases remain in force for as long as the Orbion service is provided, plus those retention periods.

9. Cookies

This site and the portal use cookies that are necessary for them to work: keeping you signed in, protecting forms against request forgery, remembering your chosen language, and recording your cookie choice. We use no advertising cookies. You can delete or block cookies in your browser; if you block the necessary ones, sign-in will not work. Some pages may include third-party content, which would set its own cookies under that third party's policies.

10. Changes to this policy

Any substantial change to this policy will be announced on this site, and by email to registered users, before it applies. If a change affects the purposes of processing, a new authorisation will be requested.

11. Applicable law and authority

This policy is governed by article 15 of the Colombian Constitution, Statutory Law 1581 of 2012, Decree 1074 of 2015 and the instructions of the Superintendencia de Industria y Comercio, Colombia's personal data protection authority (www.sic.gov.co).