Effective date: September 23, 2026
Last updated: September 23, 2026
X-Cargo (“X-Cargo,” “Service Provider,” “we,” “our,” or “us”) operates FLOWER, available through https://flower.x-cargo.co/ (the “Application”).
FLOWER is an operational and administrative platform designed to support X-Cargo and authorized organizations in the management, processing, automation, monitoring, and integration of logistics, accounting, document, customer, operational, and related business processes.
This Privacy Policy explains how personal and business-related information may be collected, used, stored, processed, shared, and protected when authorized users access or use FLOWER.
By accessing or using the Application, you acknowledge that information may be processed as described in this Privacy Policy and in accordance with applicable data protection laws.
FLOWER is primarily intended for authorized users, employees, contractors, customers, suppliers, partners, affiliates, administrators, and other persons who require access to the platform as part of an authorized business process.
Depending on the specific service or process:
X-Cargo may act as the data controller, determining the purposes and means for processing personal information.
X-Cargo may act as a data processor or service provider when processing information on behalf of a customer, partner, or other organization.
Customers or organizations using FLOWER may act as data controllers for information they enter, upload, transmit, or manage through the platform.
The responsibilities of each party may also be defined by contractual agreements, data-processing agreements, service agreements, or applicable law.
The information processed by FLOWER depends on the modules, integrations, services, and permissions enabled for each organization and user.
FLOWER may process information such as:
Full name
Identification type and number
Email address
Telephone or mobile number
Company or organization
Position, department, or business area
Customer, supplier, affiliate, or partner information
Contact and notification information
Only information required for an authorized business process should be collected or processed.
We may process:
Username or registered email address
Authentication credentials
User roles and permissions
Organization or company associated with the account
Login dates and times
Session information
Authentication events
Account status
Security and audit records
Passwords and authentication secrets are protected using appropriate security mechanisms and are not intended to be stored in plain text.
Depending on the enabled modules, FLOWER may process information associated with logistics and operational activities, including:
Shipment or transportation information
Tracking information
Internal reference numbers
Operational statuses
Customer and recipient information
Origin and destination information
Service information
Carrier or transportation provider information
Operational events and movements
Delivery, dispatch, reception, or processing records
Incident and exception information
Operational observations
Reconciliation information
Processing timestamps
This information may originate directly from users or from systems integrated with FLOWER.
When accounting, treasury, reconciliation, invoicing, or related modules are enabled, FLOWER may process:
Invoice information
Accounting documents
Payment-related information
Accounts receivable or payable information
Transaction references
Tax-related information
Accounting classifications
Customer or supplier financial information
Reconciliation records
Supporting documents
Information required for legally authorized accounting or tax processes
FLOWER is not intended to collect financial information beyond what is reasonably necessary for the corresponding authorized business process.
Authorized users or integrated systems may upload, generate, transfer, or process documents such as:
Invoices
Accounting documents
Transportation documents
Shipping or logistics documents
Operational supporting documents
Certificates
Customer or supplier documentation
Images
PDFs
Spreadsheets
Reports
Electronic documents
Other files required for an authorized process
Documents may contain personal, commercial, financial, tax, or confidential information.
Access is restricted according to user permissions, roles, organizational policies, contractual obligations, and applicable law.
When users access FLOWER, we may automatically collect technical information including:
Device type
Operating system
Browser type and version
IP address
Application version
Language and regional settings
Session information
Login information
Error and diagnostic records
API request information
Security events
Application activity
Audit logs
This information is primarily used to operate, protect, monitor, troubleshoot, and improve the Application.
FLOWER may receive information from external or internal systems that have been authorized to exchange information with the Application.
Depending on the configured integrations, such information may include:
Logistics information
Shipment statuses
Tracking updates
Accounting information
Electronic invoice information
Documents
Customer information
Operational information
Authentication information
Notifications
Records generated by automated business processes
Information received through integrations is processed only for the purposes associated with the corresponding service or business process.
FLOWER may use automation, artificial intelligence, optical character recognition (“OCR”), algorithms, or other automated technologies to assist with certain processes.
These capabilities may be used to:
Extract information from documents
Read or classify invoices
Identify information contained in uploaded files
Validate document information
Organize and categorize information
Generate summaries
Detect inconsistencies
Support operational processes
Assist users with repetitive administrative tasks
Generate recommendations or alerts
Route information between systems
Automate authorized workflows
Automated or AI-generated results may contain errors and may require human verification.
Where a decision may have a significant legal, financial, contractual, employment, or operational impact, appropriate human review should be performed when required by applicable law or organizational policy.
Information processed through artificial intelligence services will only be transmitted when required for the enabled functionality and subject to appropriate security and contractual controls.
Personal information will not be intentionally used to train external general-purpose artificial intelligence models unless the relevant parties have been informed and an appropriate legal basis or authorization exists.
Information processed through FLOWER may be used to:
Authenticate and manage users
Control roles and permissions
Provide authorized Application functionality
Process operational workflows
Manage logistics information
Process and validate documents
Support accounting and administrative processes
Perform reconciliations
Generate reports
Track operational events
Exchange information with authorized systems
Automate repetitive processes
Send operational notifications
Detect errors or inconsistencies
Provide technical support
Maintain Application availability
Monitor system performance
Maintain audit records
Investigate incidents
Detect unauthorized activity
Prevent fraud or misuse
Protect the security and integrity of FLOWER
Meet contractual obligations
Comply with legal, accounting, tax, regulatory, or judicial requirements
Establish, exercise, or defend legal claims
Improve the Application and its authorized features
Information will not be intentionally processed for purposes incompatible with those described in this Privacy Policy without appropriate notice or authorization when required.
Depending on the applicable jurisdiction and specific circumstances, personal information may be processed based on:
The user’s prior, express, and informed authorization
Performance of a contract or service agreement
Compliance with legal or regulatory obligations
Legitimate business interests, where permitted by applicable law
Protection of X-Cargo systems, users, customers, and operations
Prevention of fraud and unauthorized access
Protection of vital interests
Other legal grounds permitted by applicable law
In Colombia, personal information is processed in accordance with Law 1581 of 2012, its regulatory provisions, and other applicable data protection regulations.
Information processed through FLOWER may be shared with:
X-Cargo personnel authorized to perform relevant functions
The organization responsible for the information
Customers, suppliers, affiliates, or business partners involved in an authorized process
Logistics or transportation service providers
Technology and infrastructure providers
Cloud hosting providers
Document-storage providers
Authentication providers
Email and notification providers
Accounting or invoicing service providers
Artificial intelligence and document-processing providers
Monitoring and technical-support providers
Professional advisers subject to confidentiality obligations
Government entities, regulators, judicial authorities, or tax authorities when legally required
Other parties authorized by the relevant organization or data subject
We do not sell or rent personal information.
Service providers may process information only as necessary to provide their contracted services and are expected to maintain appropriate confidentiality and security safeguards.
FLOWER may integrate with third-party platforms necessary to provide specific business functionality.
Depending on the configuration, these services may include:
Cloud infrastructure providers
Document storage platforms
Email services
Authentication providers
Accounting systems
Electronic invoicing services
Logistics and tracking providers
Communication platforms
Artificial intelligence services
OCR and document-processing services
Analytics, monitoring, and error-reporting tools
Customer or enterprise systems
The specific third-party providers may change depending on the services used by X-Cargo and participating organizations.
Third-party providers may process information according to their own privacy policies, applicable contractual agreements, and applicable law.
FLOWER uses application programming interfaces (“APIs”) and other integration mechanisms to communicate with authorized internal and external systems.
Through these integrations, FLOWER may automatically receive or transmit information required to complete an authorized business process.
Technical safeguards may include:
Authentication tokens
API credentials
Encrypted connections
Access controls
Network restrictions
Logging
Request validation
Role-based authorization
Integration credentials and secrets are intended solely for authorized system communication and must not be publicly disclosed.
We implement reasonable administrative, technical, and organizational safeguards designed to protect information against:
Unauthorized access
Unauthorized disclosure
Accidental loss
Destruction
Alteration
Misuse
Fraud
Unauthorized system activity
Security controls may include:
Encryption in transit
Secure authentication
Role-based access controls
Restricted administrative privileges
Audit logs
Security monitoring
Network protections
Backups
Access-control policies
Application monitoring
Database security controls
Secure infrastructure practices
However, no electronic storage system or method of internet transmission can guarantee absolute security.
Users are responsible for protecting their credentials and must report suspected unauthorized access as soon as possible.
FLOWER may maintain logs of system activity for operational, security, compliance, troubleshooting, and auditing purposes.
Logs may include:
User authentication events
User actions
Changes to records
API activity
Automated process executions
Processing errors
Security events
System events
Dates and times
IP addresses or technical identifiers
Access to these records is restricted to authorized personnel.
Information will be retained only for as long as reasonably necessary to:
Provide FLOWER services
Complete operational processes
Maintain accounting or financial records
Meet contractual requirements
Maintain audit records
Investigate incidents
Maintain information security
Resolve disputes
Enforce agreements
Comply with legal, accounting, tax, judicial, or regulatory obligations
Retention periods may vary depending on the type of information, the organization responsible for the information, contractual requirements, and applicable law.
When information is no longer required, it may be deleted, anonymized, archived, or securely restricted as appropriate.
Some technology or infrastructure providers used by FLOWER may process or store information outside Colombia or outside the country in which the user is located.
When international transfers occur, appropriate safeguards required by applicable law will be implemented.
These measures may include:
Contractual protections
Data-processing agreements
Security controls
User or organization authorization when required
Verification of applicable data protection standards
Subject to applicable law, individuals may have the right to:
Access their personal information
Request correction of inaccurate information
Request updating of incomplete information
Request evidence of authorization
Obtain information regarding the use of their personal data
Submit inquiries or complaints
Request deletion where legally applicable
Revoke authorization where legally applicable
Object to or restrict certain processing activities
Request appropriate human review of relevant automated processing
File complaints before the competent data protection authority
In Colombia, these rights are governed primarily by Law 1581 of 2012 and its regulatory provisions.
Some information may need to be retained despite a deletion request when retention is required for legal, accounting, contractual, tax, operational, security, audit, or judicial purposes.
FLOWER is primarily an enterprise and organizational platform.
User accounts may be created, managed, suspended, or removed by authorized administrators.
Users who wish to request deletion or deactivation of an account may contact:
The organization that provided the account; or
X-Cargo using the contact information provided in this Privacy Policy.
Deactivating an account does not necessarily require the immediate deletion of all records associated with that account.
Certain operational, accounting, tax, contractual, security, audit, or legal information may need to be retained after account access has been disabled.
FLOWER may contain confidential business information belonging to X-Cargo, its customers, suppliers, affiliates, and partners.
Users must access and process such information only for authorized purposes.
Users must not:
Share credentials with unauthorized individuals
Extract information without authorization
Disclose confidential information
Attempt to bypass security restrictions
Use FLOWER information for unauthorized purposes
Access data outside the permissions assigned to their account
Unauthorized access or use may result in suspension of access and other measures permitted by applicable agreements and law.
FLOWER is an enterprise application intended for authorized business users and is not directed to children under the age of 13.
We do not knowingly collect personal information directly from children through general access to the Application.
If information relating to a minor is processed as part of a legitimate customer, beneficiary, shipment, contractual, or administrative process, such processing must comply with applicable data protection requirements concerning minors.
Organizations using FLOWER are responsible for:
Ensuring that information submitted to FLOWER has been collected lawfully
Providing required privacy notices
Obtaining authorization where applicable
Assigning appropriate user permissions
Maintaining accurate information
Protecting user credentials
Preventing unauthorized access
Complying with applicable privacy and data protection laws
Users must not upload or process personal or confidential information unless they are authorized to do so.
We may update this Privacy Policy periodically to reflect:
Changes to FLOWER functionality
New integrations
New legal or regulatory requirements
Changes to our data-processing practices
Security improvements
Changes to third-party providers
Updates will be published with a revised “Last updated” date.
Where required by law, users or relevant organizations may receive additional notice regarding material changes.
Continued use of FLOWER following an update constitutes acknowledgment of the revised Privacy Policy, except where express authorization or consent is legally required.
If you have questions, requests, complaints, or concerns regarding this Privacy Policy or the processing of personal information through FLOWER, please contact us:
Application: FLOWER
Website: https://flower.x-cargo.co/
Service Provider: X-Cargo
Email: julian-desarrollo@x-cargo.co
Country: Colombia
Users may also contact the organization responsible for providing their FLOWER account when the request relates to information controlled by that organization.