Privacy Policy

Privacy Policy of the Factuvoz Platform

This Privacy Policy regulates the processing of personal data carried out by APLIMEDIA, S.L. (hereinafter, "APLIMEDIA") through the online invoicing platform "Factuvoz" (hereinafter, the "Platform" or the "Service").

The use of the Platform involves data processing under two distinct legal scopes:

APLIMEDIA as Data Controller: Regarding registration, profile, platform usage, and billing data of the Client itself (platform user).

APLIMEDIA as Data Processor: Regarding third-party data (clients, suppliers, employees) that the Client inputs into the Platform to issue invoices or manage their business. This processing is governed by the Data Processing Agreement attached to the Terms and Conditions.

This Privacy Policy refers exclusively to the first scope (APLIMEDIA as Data Controller).

1. Identity of the Data Controller

Corporate Name: APLIMEDIA, S.L.
Tax ID (NIF): B95064432
Registered Address: C/Mitxel Labegerie, Lonja 2, 48005 - Bilbao (Vizcaya)
Contact Email: administracion@aplimedia.com

2. Purpose of Processing and Legal Basis

APLIMEDIA will process the Client's personal data (first and last name, Tax ID/NIF, contact details, professional data, payment data, and Platform usage) based on the following purposes and legal bases:

Purpose of Processing	Legal Basis (Art. 6.1 GDPR)
Account registration and maintenance management: Creation of the user profile, credential validation, and provision of the Factuvoz SaaS service.	Performance of a contract: Processing is strictly necessary to provide the requested service.
Invoicing and payment collection: Management of payment for service usage, issuance of invoices under the Client's name, and accounting management.	Performance of a contract and Legal obligation (tax and accounting regulations).
Technical support and customer service: Resolution of incidents, inquiries, or technical issues related to the use of the Platform.	Performance of a contract and Legitimate interest in ensuring the proper operation of the service.
Service improvement and analytics: Statistical and anonymized analysis of Platform usage to detect errors and improve user experience.	Legitimate interest of APLIMEDIA to optimize and evolve its product.
Commercial communications: Sending newsletters, product updates, or similar services from APLIMEDIA.	Legitimate interest (Art. 21.2 LSSI) for current clients regarding similar products, or Consent if expressly requested.

3. Data Retention Period

he Client's personal data will be retained for as long as the Factuvoz account remains active and the contractual relationship is in force.

Once the account is canceled or the contract is terminated, APLIMEDIA will keep the data duly blocked during the applicable legal statute of limitations periods (generally, 5 years for civil liability and 6 years for tax and accounting obligations).

After these periods have elapsed, the data will be securely destroyed.

4. Data Recipients and Sub-processors

For the proper provision of the Factuvoz service, APLIMEDIA relies on technology service providers acting as Data Processors (Sub-processors), who are required to comply with strict security and confidentiality measures.

4.1. Artificial Intelligence (AI) Providers

Factuvoz integrates AI features to facilitate document reading and invoicing assistance. Data processed by these tools is NOT used to train or improve the providers' AI models. The AI providers used are:

OpenAI OpCo, LLC (USA)
Google LLC / Google Cloud (USA)
Mistral AI (France / EU)
Perplexity AI, Inc. (USA)

4.2. Payment Gateway (Stripe)

Payment for the service is processed through the secure gateway provided by Stripe Payments Europe, Ltd. or its affiliated entities.

Stripe acts as Data Processor for APLIMEDIA to process subscription payments.

Additionally, Stripe acts as an independent Data Controller regarding payment data for its own legal obligations related to fraud prevention (KYC) and anti-money laundering (AML). You can review Stripe's privacy policy at: https://stripe.com/privacy.

5. International Data Transfers

The use of the providers mentioned above involves international data transfers outside the European Economic Area (EEA), specifically to the United States (OpenAI, Google, Perplexity, Stripe).

APLIMEDIA guarantees that all international transfers are carried out under the appropriate safeguards required by the GDPR (Art. 46), specifically through the execution of Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the providers' adherence to the EU-U.S. Data Privacy Framework.

6. Exercise of Rights

The Client may at any time exercise their rights of access, rectification, erasure, restriction, objection, and data portability regarding their personal data.

To exercise these rights, the Client must send a written request to administracion@aplimedia.com, for which documentation proving their identity may be requested if necessary.

Furthermore, if the Client considers that the processing of their personal data violates current regulations, they have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) through its website: https://www.aepd.es/.

7. Data Accuracy and Client Responsibility

The Client guarantees that the personal data provided for registration and billing is true, accurate, complete, and up to date. The Client shall be solely responsible for any direct or indirect damage or harm caused to APLIMEDIA or any third party due to filling out the forms with false, inaccurate, incomplete, or outdated data.

Regarding third-party data entered into the Platform by the Client, the Client guarantees that they possess the appropriate legal basis (consent, contract, etc.) for its processing and for entrusting such processing to APLIMEDIA as Data Processor, indemnifying and holding APLIMEDIA harmless from any liability arising from non-compliance with this obligation.