This is an informational translation provided for convenience. The Spanish-language version is the only legally binding one under Peruvian law. If anything here conflicts with the Spanish original, the Spanish original controls.
1. Data controller
MULTISERVICIOS KADA EIRL (RUC 20612829579), the operator of factsimil, is the controller for personal data collected through this website and the Service. For any questions about this policy, write to info@factsimil.com.
2. Legal framework
We process personal data in accordance with Law No. 29733, Peru's Personal Data Protection Law, its implementing regulation approved by Supreme Decree No. 003-2013-JUS, and other applicable Peruvian regulations.
3. Data we collect
We collect personal data at these points:
- Contact form, access requests, and the app waitlist: name, email address, company, and the content of the message you send us.
- factsimil's Complaints Book: name, ID type and number, address, phone, email, and the details of your complaint, to record and answer it as required by Peru's Consumer Protection and Defense Code.
- Service account: name and email of the users you manage within your tenant, your company's legal name and RUC, and technical access metadata (IP address, login date and time) for security purposes.
4. Data we process on your behalf
When you use the API to issue payment receipts, factsimil processes your end customers' data (for example, name, RUC/DNI, and address of the buyer) as a data processor — that is, on your behalf and under your instructions, as the controller of that data. You, as the Customer, are responsible for having sufficient legal basis with your own customers for that processing. The same applies to your company's Complaints Book (/reclamos/your-username): we process the complainants' data on your behalf, and you are responsible for answering each complaint.
5. Purpose of processing
We use the data we collect directly to:
- Respond to access requests, support inquiries, and sales questions.
- Create and manage your account, and provide the contracted Service.
- Issue factsimil's own payment receipts (for billing the Service) when applicable.
- Prevent fraud, abuse, and unauthorized access (for example, via anti-bot verification on forms).
- Comply with legal and tax obligations.
- Understand aggregate website usage through analytics, to improve it.
One of these purposes involves an automated decision: if your subscription payment fails, access to your account is automatically suspended (section 12 of the Terms and Conditions) and we notify the registered billing contact by email. You can request human review of that suspension by writing to info@factsimil.com.
6. Legal basis
Processing is based on performance of the service agreement with the Customer, your consent when submitting the contact form, compliance with legal obligations applicable to factsimil, and our legitimate interest in keeping the platform secure and improving the website.
7. Cookies
We use essential, anti-bot verification, and analytics cookies. Details on each one, its purpose, and how to disable it are in our Cookie Policy.
8. Processors and third parties
We share personal data with the following third parties, only to the extent necessary to provide the Service:
- SUNAT, as the legal recipient of the electronic receipts transmitted through your account.
- Infrastructure and hosting providers, which store and process data under confidentiality agreements.
- Izipay, as the payment gateway for your factsimil subscription -- it processes your email, amount, and card details (we never receive them).
- Culqi and Izipay, in your own online store (Negocio Plus plan): if you sell through your online store, you configure your own Culqi or Izipay account to charge your buyers. factsimil stores those credentials encrypted only to call the gateway you chose at the time of each charge -- it never receives or stores your buyers' card details, which go directly to the gateway you configured.
- Expo (Expo Push) and Google Firebase Cloud Messaging, to deliver receipt status alerts to the mobile app -- they receive a device identifier and the alert text.
- Sentry, for error monitoring -- from the mobile app it also receives the phone model and OS version when the app crashes.
- Cloudflare (Turnstile), for anti-bot verification on the contact form.
- Google Analytics, for aggregate website usage statistics.
- Microsoft Clarity, for heatmaps and session recordings of the public website -- only activates if you accept the cookie notice, and never inside your account panel.
- Google Maps, only if you click “Show map” on the contact page — at that moment Google receives your IP address (see the Cookie Policy).
We don't sell personal data to third parties or use it for advertising unrelated to the Service.
9. International data transfer
Some of our infrastructure providers and the services mentioned above may process data outside Peru. In those cases, we require reasonable contractual or technical guarantees (encryption in transit and at rest, confidentiality agreements) equivalent to the protection level required by Peruvian regulation.
10. Retention period
We retain your account data and issued receipts while the contractual relationship is active and, afterward, for the period required by Peruvian tax regulation for retaining electronic payment receipts (currently 5 years). Contact-form data is retained for up to 24 months from the last contact, unless you exercise your cancellation right sooner. Our internal audit log (who did what action, when, and from which IP address) is retained for up to 24 months and then automatically deleted. Cookie consent records (what you chose and when) are retained for as long as that choice remains in effect, as proof that it was informed.
11. Security measures
We apply reasonable technical and organizational measures to protect personal data: encryption in transit (TLS) for all communication with the API and web panel, encryption at rest for our customers' digital certificates (.p12) — decrypted only in memory at the moment of signing —, hashed passwords, and role-based access control within each tenant.
12. Your rights (ARCO)
As a data subject, you have the right to access, rectify, cancel, and object to the processing of your data (ARCO rights), as well as to request portability where applicable. For access and portability over your own account, you can download your data yourself from "My Account → Your Data" inside the panel, without waiting on a manual request. For the other rights (rectification, cancellation, objection), or if you'd rather handle it by email, write to info@factsimil.com, stating your name, the right you wish to exercise, and attaching a means to verify your identity. We'll respond within the timeframes set by Law No. 29733.
For the cancellation right over your whole account, if you're the one who manages it you can also exercise it yourself, immediately, without waiting on a manual reply: from the web panel, under Company settings → Close my account, or from the app, under My account → Delete my account. This deletes the data of your account's users, your SOL/GRE credentials, and your billing contact, and revokes your digital certificate; it's irreversible. Your electronic receipts and the records tax regulation requires us to keep aren't deleted (see the retention period in section 10), but you can keep downloading them as explained in the Terms and Conditions.
13. Minors
The Service is aimed at businesses and professionals, and isn't intended for minors. We don't intentionally collect data from minors.
14. Changes to this policy
We may update this policy to reflect regulatory changes or changes in our data-processing practices. We'll publish the current version on this same page along with the last-updated date.
15. Contact and supervisory authority
For questions about this policy or the processing of your data, write to info@factsimil.com. If you believe your rights haven't been addressed, you can file a complaint with Peru's Autoridad Nacional de Protección de Datos Personales (Ministry of Justice and Human Rights).