NIT900.616.123-7
AddressCarrera 38 # 26-41, oficina 1133, Medellín, Antioquia, Colombia
Phone+57 314 791 7609
Email[email protected]
The Data Controller is Fly North S.A.S., tax ID (NIT) 900.616.123-7, domiciled at Carrera 38 # 26-41, oficina 1133, Medellín, Antioquia, Colombia, phone +57 314 791 7609, email [email protected].
This policy applies to the processing of personal data carried out by Fly North S.A.S. on the Scout Online platform and in the Scout software, and is adopted in compliance with Colombian Law 1581 of 2012, Decree 1074 of 2015 (which incorporated Decree 1377 of 2013) and any rules developing or amending them.
As CONTROLLER. For the data of the people who use the platform —first name, last name, corporate email, the company they belong to and the record of their activity— Fly North determines the purposes and answers to you directly under this policy.
As PROCESSOR. For the material a client uploads or commissions —aerial photographs, orthophotos, thermal imagery, 3-D models, point clouds and 360 tours— the Controller is the client that owns the inspected asset. Fly North processes it under their instructions and does not determine its purposes. If you appear incidentally in that material and wish to exercise your rights, write to us anyway at the address in section 6: we will tell you who the Controller is and forward your request.
Platform users: first name, last name, email address, password (always stored hashed, never in clear text), company, language, account creation date and last sign-in date.
Technical and audit records: the IP address and user agent from which the platform documents were accepted, and the download log, which records which user requested which file, from which campaign, when and from what address.
Platform usage log: for each minute of activity, which user and from which company, in which campaign, which platform feature was requested, how many times, how much server time it took and how much data was transferred. It does not include the content of what is viewed nor the IP address.
Data that may appear incidentally in aerial material: images of people, vehicles, licence plates and private property captured during an inspection flight, and the associated geographic coordinates. Street-level 360 tours are the most likely to contain them.
Professional contact data a client records in a task or a report, such as the name of the person assigned to a finding.
Fly North does NOT request or deliberately process sensitive data in the sense of article 5 of Law 1581 —racial or ethnic origin, political views, religious beliefs, union membership, health data, sexual life or biometric data— nor data of children and adolescents. No facial recognition or any processing aimed at identifying the people appearing in aerial material is applied.
Creating and administering your account, authenticating it and controlling which campaigns you may access.
Delivering the contracted inspection and analysis service: processing, storing and making available the geospatial material, the findings, the measurements and the reports.
Sending operational communications about the service: password recovery, records of acceptance of the platform documents and notices about the campaigns you have access to.
Complying with legal and contractual obligations and responding to requests from competent authorities.
Keeping the platform secure: preventing unauthorised access, investigating incidents and preserving traceability of what leaves it.
Demonstrating compliance with this policy by retaining evidence of the authorisations granted.
Measuring how the platform is used —which features and campaigns are viewed, for how long and how much load they produce— to improve the service, address performance problems and plan its capacity. Fly North does this measurement on its own server, without third-party analytics tools, and does not use it for advertising.
To know, update and rectify your personal data.
To request proof of the authorisation you granted, except where the law does not require one.
To be informed, upon request, about the use made of your personal data.
To file complaints with the Superintendency of Industry and Commerce for breaches of Law 1581 of 2012, once the query or claim procedure before Fly North has been exhausted.
To revoke your authorisation and request the deletion of your data, where no legal or contractual duty requires their retention.
To access your personal data free of charge.
Answering questions about sensitive data, or about data of children and adolescents, is optional. Fly North asks none.
Write to [email protected], or to the physical address in section 1, stating your full name, the email through which you deal with Fly North, a description of your request and any supporting documents. If the request is incomplete, you will be asked to complete it within the following five (5) days.
QUERIES. Answered within a maximum of ten (10) business days from receipt. Where that is not possible, you will be informed before the term expires and the query will be answered within the following five (5) business days at the latest.
CLAIMS. Answered within a maximum of fifteen (15) business days from the day after receipt. Where that is not possible, you will be informed before expiry and the term is extended by up to eight (8) further business days. While a claim is pending, the data concerned is flagged with the notice «claim in process».
If the claim concerns data Fly North processes as a Processor —a client's aerial material— we will forward it to the Controller within the following two (2) business days and inform you.
Authorisation is collected inside the platform, on screen, the first time you sign in and each time a new version of the document is published. The data-processing authorisation checkbox is separate and independent from the confidentiality commitment: they are two distinct purposes and are not accepted with a single click.
Each acceptance is recorded in a row of its own holding the person, the document, its version, the language it was shown in, the date and time in UTC, the IP address, the browser and the SHA-256 fingerprint of the exact text displayed on screen. That fingerprint is what makes it verifiable years later that what was accepted was that text and not another version.
A PDF record is also emailed to the address you signed in with, containing the full text, and it remains available on the platform.
The platform runs on Hetzner servers located in the United States, which hold your account and the records of your activity. Platform information is stored on the infrastructure of Cloudflare, Inc. (R2 service), which operates data centres outside Colombian territory, and transactional email is routed through Google LLC servers. This means your personal data leaves Colombia.
By accepting the Data Processing Authorisation you expressly authorise that international transfer. Fly North maintains the corresponding processor relationship with these providers and requires of them security standards no lower than those described in section 10.
Fly North does not sell, rent or assign your personal data to third parties for commercial or advertising purposes.
Access is segmented by company and by campaign: a person only sees the campaigns assigned to their company, and within them only what their role enables.
Downloading raw data —the original flight photographs and the source files— is restricted to the validator and administrator roles. Other users work the material inside the platform and may take away work products such as reports and exports of findings.
Every download is logged with the user, the file, the campaign, the date and the IP address it was requested from.
Passwords are stored hashed and never in clear text; Fly North can neither read nor recover them.
Object storage is private: there is no public access to client material, and each file is delivered through a signed, limited-lifetime link generated only for someone with permission over that campaign.
Each campaign's databases are stored encrypted.
All communication with the platform travels over HTTPS.
Sign-in attempts are rate-limited per email address, and sensitive actions remain attributable to the user who performed them.
No security measure is infallible. Fly North undertakes to apply those reasonable under the state of the art and to report incidents as described in section 12.
Your account data is kept while the account exists. When an account is deleted, its associated acceptance records are deleted with it; when it is deactivated, the account and its records are kept.
Material from a deleted campaign moves to a recycle bin and is permanently destroyed after thirty (30) days, unless the client asks for it back sooner.
Audit records —acceptances and downloads— are kept for as long as the legitimate interest in demonstrating compliance and investigating security incidents subsists. Their value is precisely after the fact, so they are not deleted by the mere passage of time.
The usage log is kept in per-minute detail for ninety (90) days; it is then summarised per day, and that summary is kept for two (2) years, after which it is deleted.
Fly North's personal databases remain in force while the relationship with the data subject subsists and, once ended, for the statute of limitations of any legal actions arising from it.
If you detect or suspect unauthorised access, the loss of a device holding downloaded information or the improper circulation of material, write immediately to [email protected].
Fly North will investigate the incident, adopt containment measures, inform affected data subjects and clients, and report the event to the Superintendency of Industry and Commerce where the law requires it.
This policy is in force from 2026-11-03 and its current version is 1.2. Fly North may amend it; where the change affects the purposes of processing, you will be informed and asked to accept the new version of the Data Processing Authorisation the next time you sign in, with your previous acceptance remaining on record with the version and date it carried.
The version in force is always published at this same address.