Privacy Notice

Optima Connect Logistics, S.A. de C.V. (“OCL” or “OCL Cargo”, our trade name), domiciled in Mexico City, Mexico, is the data controller (responsable) for your personal data under this notice.

For any privacy matter you can reach us at contacto@oclcargo.com (subject “Derechos ARCO”), by WhatsApp or phone at +52 (55) 4269-3273, or at oclcargo.com.

This notice is issued under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette (DOF) on March 20, 2025 and in force since March 21, 2025 (repealing the 2010 law), its Regulations, and the Privacy Notice Guidelines.

The competent authority for personal data in the private sector is the Secretaría Anticorrupción y Buen Gobierno, through its Dirección General de Datos Personales en el Sector Privado (see section 15).

We use the law’s terms: the “data subject” (titular) is you, the person the data belongs to; the “controller” (responsable) decides how data is processed; a “processor” (encargado) processes data on the controller’s behalf; a “transfer” means sharing data with a separate third party; a “remission” means sharing data with a processor.

We collect only the data needed for each channel. We do not ask for sensitive data.

If you give us another person’s data (for example your driver’s or the contact at destination), you confirm you have informed them of this notice.

We do not collect sensitive personal data (health, biometrics, ethnic origin, beliefs, sexual orientation, etc.). If an operational document incidentally contained any, we do not use it for any purpose.

GPS location: we process the driver’s or vehicle’s location only while a shipment is being executed and for operational purposes (status, ETA, alerts, delivery evidence and trip audit). We do not use location to profile people outside the trip.

Messages and calls: text, audio and voice conversations with our AI workers are logged to execute the trip and keep evidence. At the start of a call we disclose that an automated assistant is speaking and that the conversation is recorded.

Necessary (primary) purposes

These give rise to and are essential for the relationship with you or your company. They need no additional consent.

• Handle your demo, diagnostic, report, webinar or carrier sign-up request and follow up commercially on that request.
• Create and manage your account, authenticate you and provide support.
• Deliver the contracted service: receive requests, book and tender with carriers, plan and track shipments, capture proof of delivery, and audit freight invoices (CFDI, Carta Porte 3.1, rate card, GPS, POD) before payment.
• Communicate with drivers and carriers by WhatsApp, phone or app to coordinate a trip.
• Invoice, collect payment, and meet tax, accounting and legal obligations.
• Platform security: prevent fraud, unauthorized access and abuse; keep logs.
• Handle ARCO requests and requests from authorities.

Optional (secondary) purposes

These are not needed for the service. You can decline without affecting the relationship.

• Send you newsletters, webinar invitations, and content about logistics and our product.
• Measure and improve the site and our campaigns with analytics.
• Show you relevant ads on Google, Meta and LinkedIn (remarketing).
• Prepare internal statistics and studies with aggregated or anonymized data.

OCL puts “AI workers” (software agents) to work on routine operational tasks: reading a request, quoting against a rate card, negotiating with carriers by WhatsApp or phone within rules set by the customer, tracking the trip, reviewing delivery photos, and matching invoices against evidence.

• AI workers operate within rules and limits defined by your company (for example a rate ceiling or a list of verified carriers).
• Your team decides exceptions: when something does not match, the AI worker opens a ticket and a person resolves it.
• We do not make decisions that produce legal effects on a person or significantly affect them based solely on automated processing without human review. For example, holding an invoice payment or rejecting a delivery is confirmed by a person at the customer.
• To run the AI we use language-model and voice providers as processors (section 7). By contract they may only use the data to provide the service to us and not to train their own models.

You can ask us about the general logic an AI worker uses in a process that involves you, and object to that processing, through the channels in section 12.

To operate we use providers that process data on our behalf (processors). Sharing data with them is a remission, not a transfer, and does not require your consent; we remain the controller. Each one is bound by contract to use the data only to provide the service to us, keep it confidential and secure, and not use it for their own purposes.

Because some processors are outside Mexico, your data may be processed abroad. We contractually require a level of protection equivalent to this notice and to Mexican law.

A transfer means sharing your data with a third party that is not our processor. We only make the following:

• To carriers, drivers, customers and consignees involved in a shipment, to the extent needed to execute it (for example the driver’s name and phone to the consignee, or delivery details to the carrier). This transfer is necessary for the legal relationship and does not require consent.
• To competent authorities (tax, judicial, administrative) when required by law or by a duly grounded order.
• To an acquirer or successor in a merger, acquisition, restructuring or sale of assets, bound to honor this notice.

Consent clause for transfers

If you do not want your data transferred to third parties other than those listed as necessary or required by law, tell us at contacto@oclcargo.com with the subject “Derechos ARCO”. If you do not, we will understand that you consent to the described transfers that require it.

We use cookies, pixels (web beacons) and similar technologies. Some are necessary for the site and platform to work; others are analytics or advertising and you can turn them off.

You can also delete or block cookies in your browser settings (Chrome, Safari, Firefox, Edge). If you block necessary cookies, some features may not work.

Once the period ends, data is blocked (kept only to address liabilities) and then securely deleted or anonymized.

We apply administrative, technical and physical measures to protect your data against damage, loss, alteration, destruction, or unauthorized use or access:

• Encryption in transit (TLS) on the site, the platform and integrations.
• Role- and tenant-based access control; hashed passwords; expiring sessions.
• Access and activity logs, and monitoring.
• Contractual confidentiality with staff and processors; least-privilege principle.
• Backups and continuity plans.

If a security breach significantly affects your economic or moral rights, we will inform you without undue delay through the contact channel we have, stating the nature of the incident, the data involved, the measures taken and our recommendations.

You have the right to Access your data, Rectify it if inaccurate, Cancel it when no longer needed, and Object to its processing (ARCO rights). You can also withdraw your consent and limit the use or disclosure of your data.

How to submit your request

• Email contacto@oclcargo.com with the subject “Derechos ARCO”, or message us on WhatsApp at +52 (55) 4269-3273.
• Include: your name and a way to reply to you (email or phone); a document proving your identity (INE, passport) or, if acting for someone else, proof of representation; a clear description of the data and the right you want to exercise; and anything that helps us locate your information (company, email you signed up with, trip number).
• For rectification, attach the document supporting the change.

Timelines

• We will confirm receipt and reply within a maximum of 20 business days from receiving your complete request. This may be extended once by another 20 business days if justified; we will let you know.
• If your request is granted, we will make it effective within 15 business days after the reply.
• Exercising your rights is free. We may only charge justified shipping or copy-reproduction costs.

Withdrawing consent and limiting use

You can withdraw any consent you gave us at any time and ask us to limit the use or disclosure of your data (for example, no commercial communications). Contact us through the same channels; we will record your request in our exclusion list. We cannot revoke processing that is necessary to deliver the service or comply with the law.

When a shipper, 3PL or carrier hires OCL, that company decides why and how the data of its employees, providers, drivers and consignees is used inside the platform. In that case the customer company is the controller and OCL acts as processor: we process the data following its instructions and our contract.

• If you are an employee, driver, provider or consignee of an OCL customer and want to exercise your rights over data we process on its behalf, address your request to that company; we will help it respond within the legal timelines.
• If you write to us directly, we will guide you and notify the customer acting as controller.
• OCL is the controller (not the processor) for data of website visitors, prospects, its own users and customers, and for the contractual relationship with carrier companies that hire the driver app.

Our site and platform are intended for companies and people over 18. We do not knowingly collect data from minors. If we find we are processing a minor’s data without parental or guardian authorization, we will delete it.

If you believe your right to personal data protection has been violated by any act or omission of ours, or suspect a breach of the law, you may file a complaint with the Secretaría Anticorrupción y Buen Gobierno, through the Dirección General de Datos Personales en el Sector Privado. We suggest contacting us first so we can resolve it directly.

This notice may change due to new legal requirements or changes in our services or practices. We will publish the current version at oclcargo.com/privacy, with the last-updated date and version number. If a change affects purposes or transfers that require your consent, we will notify you by email or in the platform before applying it.

• Controller: Optima Connect Logistics, S.A. de C.V. (OCL Cargo)
• Address: Mexico City, Mexico
• Privacy and ARCO email: contacto@oclcargo.com (subject “Derechos ARCO”)
• Phone / WhatsApp: +52 (55) 4269-3273
• Website: https://oclcargo.com
• Version 1.0 · Last updated: September 15, 2026