Privacy Policy

The data controller for your personal data is Azirgo SAS, RUC 0993292605001, domiciled in Ecuador, email: contacto@factuplan.com (hereinafter "Factuplan", "we", "us", or "our").

This Privacy Policy is issued in compliance with Ecuador's Organic Law on Personal Data Protection (LOPDP), published in Official Supplement Register No. 459 of May 26, 2021, and its Regulations.

We collect the following types of personal data:

The LOPDP defines "sensitive data" as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or sexual orientation.

Factuplan does not collect or process sensitive data from its users in providing the electronic invoicing service. Should it ever become necessary to process such data, we will request your express and informed consent in accordance with Article 23 of the LOPDP.

The processing of your personal data is governed by the principles established in Article 10 of the LOPDP:

• Lawfulness, fairness and transparency: we process your data lawfully, fairly, and transparently.
• Purpose limitation: data is collected for specified, explicit, and legitimate purposes and not processed in a manner incompatible with those purposes.
• Data minimisation: we collect only the data strictly necessary for the purposes of processing.
• Accuracy: we keep data accurate and up to date; we take reasonable steps to rectify or erase inaccurate data.
• Storage limitation: we retain data only for as long as necessary for its purposes.
• Integrity and confidentiality: we process data in a manner ensuring its security through appropriate technical and organisational measures.
• Accountability: we can demonstrate compliance with these principles through documented policies, procedures, and records.

We process your personal data for the following purposes:

• Providing the electronic invoicing service and associated features
• Account management, authentication, and security
• Payment processing and subscription management
• Sending transactional communications (confirmations, alerts, receipts)
• Technical support and customer service
• Compliance with legal and tax obligations before the SRI and other competent authorities
• Service improvement through usage analysis (aggregated and anonymized data)
• Sending commercial communications, subject to prior consent (you may unsubscribe at any time)

We process your data under the following legal bases in accordance with Article 6 of the LOPDP:

• Contract performance (Art. 6 b): processing is necessary to provide the contracted service.
• Legal obligation (Art. 6 c): to comply with Ecuadorian tax regulations and SRI requirements.
• Legitimate interest (Art. 6 f): to improve the service and ensure its security, where your fundamental rights do not override.
• Consent (Art. 6 a): for optional commercial communications; you may withdraw consent at any time.

We retain your personal data for as long as necessary to fulfill the described purposes and applicable legal obligations:

• Account data: while your account is active and up to 5 years after cancellation
• Electronic receipts: 7 years as required by SRI tax regulations (Art. 41 RLORTI)
• Billing data: 7 years for accounting and tax compliance
• Access logs: 12 months

Under Articles 20–28 of the LOPDP, you have the following rights:

• Access (Art. 20): know what personal data we process, its origin, purposes, and disclosures made.
• Rectification (Art. 21): correct inaccurate, incomplete, or outdated data.
• Erasure (Art. 22): request deletion of your data when no longer necessary, when you withdraw consent, or when processing is unlawful.
• Objection (Art. 23): object to processing of your data under certain circumstances, especially for direct marketing.
• Portability (Art. 25): receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Restriction of processing (Art. 26): request restriction of processing while data accuracy is verified or an objection is resolved.
• Right not to be subject to automated decisions (Art. 24): not to be subject to decisions based solely on automated processing that produce significant legal or similarly significant effects on you.

To exercise these rights, write to us at contacto@factuplan.com stating your name, registered email, and the right you wish to exercise. We will respond within 15 business days in accordance with LOPDP Art. 29.

The LOPDP established the Superintendencia de Protección de Datos Personales as the supervisory authority responsible for overseeing compliance with data protection regulations in Ecuador.

If you believe that the processing of your personal data infringes the LOPDP or any applicable regulation, you have the right to lodge a complaint with the Superintendencia de Protección de Datos Personales, without prejudice to any other administrative or judicial remedy.

More information at: www.protecciondatos.gob.ec

Some of our service providers (cloud infrastructure, payment processors, analytics tools) may be located outside Ecuador. In accordance with Article 49 of the LOPDP, international data transfers are only carried out when:

• The recipient country offers an adequate level of data protection recognised by the competent Ecuadorian authority, or
• Adequate safeguards have been adopted through standard contractual clauses, binding corporate rules, or other approved mechanisms.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or disclosure, including:

• Data encryption in transit (TLS 1.2+) and at rest (AES-256)
• Two-factor authentication available
• Role-based access control (RBAC)
• Continuous security audits and monitoring
• Encrypted and geo-replicated backups
• Security breach notification in accordance with LOPDP Art. 44 where applicable

We use cookies and similar technologies to improve your experience. See our Cookie Policy for detailed information on which cookies we use and how to manage them.

Factuplan is not directed at persons under 18. We do not intentionally collect personal data from minors. If you detect that a minor has provided data without parental or guardian authorisation, contact us at ${CONTACT_EMAIL} for immediate deletion in accordance with LOPDP Art. 38.

We may update this Privacy Policy when necessary. We will notify you of material changes by email or through a prominent notice on the platform at least 15 days before they take effect.

For questions about this Privacy Policy, to exercise your rights, or for any matter related to the protection of your personal data, contact us at:

Azirgo SAS — RUC 0993292605001

Email: contacto@factuplan.com