Privacy policy
Last reviewed:
Text pending completion
This page still contains owner details or sections that are not completed or reviewed. Pending fields: companyName, taxId, address
1. Data controller
[PENDIENTE: razón social], tax ID [PENDIENTE: NIF], with its address at [PENDIENTE: domicilio fiscal], is the controller of the personal data of users registered in the DiroTPV app (the staff of customer companies), of support staff, and of people who write to us from this website. Privacy contact: privacidad@dirotpv.com.
Each company that uses the app is in turn the controller of the personal data of its own customers that it enters into the app (name, tax ID, address). For that data, DiroTPV acts as a processor, under the terms of service.
2. Data we process
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| User account | Email, name and password (stored as a cryptographic hash); if you sign in with Google, the basic data of your Google account | Authentication and delivery of the service | Performance of a contract |
| Company data | Company name, tax ID, address, logo | Issuing invoices | Legal obligation and performance of a contract |
| The company’s customers | Name, tax ID, address, equivalence surcharge status | Issuing invoices (entered by the company, not by the end customer) | Legal obligation |
| Invoicing | Products, quantities, prices, payment method and invoice history | Issuing and legally retaining invoices | Legal obligation |
| Support | Content of the tickets sent from the app | Answering queries and incidents | Legitimate interest and performance of a contract |
| Technical | IP address and session tokens | Security and operation of the app | Legitimate interest |
| Contact form on this website | Name, email, subject and message | Replying to your enquiry | [PENDIENTE: revisión legal — base jurídica del formulario (consentimiento o interés legítimo) coherente con la casilla] |
We do not collect geolocation data or special categories of data (health, beliefs, etc.), and we do not use data for advertising or profiling.
3. Contact form on this website
When you use the contact form, your browser sends the data directly to the DiroTPV server, with no intermediaries: it does not go through any form service, analytics service or third party. Messages are kept for 12 months from receipt and then deleted automatically.
The website uses no cookies and no analytics tools; see the cookie policy for details.
[PENDIENTE: revisión legal — web server logs (for example IP address and date of each visit): confirm whether they are kept and for how long.]
4. Who we share data with
To provide the service we rely on these providers:
- Hetzner: hosts the application server and the database, in the European Union.
- IONOS: hosts this public website, in the European Union.
- Mailjet: sends the service’s transactional emails (access invitations and invoices sent by email).
- Google Firebase: provides Google sign-in and crash reports from the app (Firebase Crashlytics).
We do not sell or transfer personal data to third parties for commercial or advertising purposes.
Crash reports (Firebase Crashlytics)
When the app crashes, a technical report is sent to Google (Google Ireland Ltd.) with the internal user identifier, the active company identifier, the device model, the operating system and app versions, and the technical stack trace. Passwords, session tokens and customer or invoice data are never sent. Reports are kept in Firebase for 90 days. Legal basis: legitimate interest in keeping the service free of errors (Art. 6.1.f GDPR).
[PENDIENTE: revisión legal — international data transfers to Google (applicable safeguards), Firebase processing region, and the data processing agreement with Google.]
[PENDIENTE: revisión legal — Mailjet transfer countries and safeguards, and confirmation of the exact Hetzner and IONOS regions.]
5. Android app permissions
- Bluetooth (
BLUETOOTH_CONNECT,BLUETOOTH_SCAN): only to discover and connect the thermal receipt printer. It is not used for location and is not shared with third parties. - Internet: to communicate with our server.
6. How long we keep data
- Invoicing data is kept for the period required by Spanish commercial and tax law (currently up to 6 years from the last entry).
- User account data is kept while the account remains active.
- Support tickets are kept for the reasonable time needed to resolve the incident and as a service history.
- Messages from the website contact form are kept for 12 months.
- Firebase crash reports are kept for 90 days.
7. Your rights
You can access, rectify and erase your data, restrict or object to its processing, and request its portability by writing to privacidad@dirotpv.com. We will answer within the legal period of one month.
The app does not currently offer a full one-step data export: portability is requested by email to that same address. To ask us to delete your account, see the delete account page.
If the data was entered by a customer company about one of its own customers, you may also address the request to that company, which is the controller of that data.
When an erasure request affects data included in an invoice already issued, it cannot be fulfilled while the legal retention obligation lasts (section 6), without prejudice to anonymising any data that tax law does not require.
If you believe the processing does not comply with the rules, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).
8. Security
We apply reasonable technical measures: encryption in transit (HTTPS/TLS), passwords stored as cryptographic hashes (never in plain text), role-based access control and separation of each company’s data.
9. Changes to this policy
We may update this policy to reflect legal or service changes. The date of the last review is shown at the top of this page, and significant changes will be announced in the app itself.
10. Contact
For any question about this policy or the processing of your data: privacidad@dirotpv.com.