Privacy Policy and Data Processing Agreement (DPA)
Version v1.0-2026-11 · Last updated: November 2026
1. Legal Framework and Separation of Roles under Organic Law No. 172-13
This Privacy Policy and Personal Data Processing Agreement (hereinafter, the "Policy and DPA") governs the processing of personal data carried out by AHORRATECH, EIRL (domiciled in the Municipality of Esperanza, Valverde Province, Dominican Republic, email [email protected]) through its corporate website (ahorratech.com) and its Ahorra POS SaaS platform, in strict compliance with Organic Law No. 172-13 on the Protection of Personal Data of the Dominican Republic.
Pursuant to the definitions set forth in Article 6 of Law No. 172-13, the parties establish a strict legal separation of roles according to the nature of the data: (a) AHORRATECH acts as DATA CONTROLLER (Responsable del Tratamiento) solely and exclusively with respect to the contact details, business registration data, plan billing records, and legal acceptance logs of its own direct clients (the merchants subscribing to Ahorra POS) and prospects or promoters who submit forms on our website; and (b) AHORRATECH acts strictly as DATA PROCESSOR (Encargado del Tratamiento) with respect to all personal and tax data of third parties (the merchant end buyers, national ID numbers, RNC tax IDs, passports, delivery addresses, phone numbers, accounts receivable credit histories, employees, cashiers, delivery drivers, and suppliers) that the Client merchant enters, stores, or processes within its isolated workspace (tenant) in Ahorra POS.
2. Data Processed as Direct Controller and Purpose of Processing
With respect to our subscribing clients and website visitors, we collect only the data necessary to provide and bill for the SaaS service: first and last name of the representative or administrator, company legal name and RNC, email address, phone or WhatsApp number, fiscal address, and immutable technical audit records (IP address, browser user agent, UTC timestamp, and accepted terms version).
Such data is used exclusively to: (a) create and administer the organization account in Ahorra POS; (b) process subscription payments and issue the corresponding fiscal invoices for the contracted plan; (c) send critical transactional notifications (registration verification links, user invitations, digital certificate expiration or e-NCF sequence depletion alerts, and billing notices); and (d) respond to commercial inquiries or technical support requests.
3. Obligations as Data Processor (DPA) and Indemnity Before Pro Consumidor and Third Parties
In its role as Data Processor of the data of end customers, employees, and suppliers entered by the subscribing merchant into Ahorra POS, AHORRATECH agrees to: (a) process such data solely in accordance with the automated instructions executed by the merchant through the software interface, never using it for its own marketing purposes nor selling or disclosing it to third parties; (b) maintain strict logical isolation by organization (tenant_id) across all database queries and repositories; and (c) return or enable the export of data and proceed with its permanent deletion following the thirty (30) day window after agreement termination pursuant to the SLA.
The Client merchant, in its capacity as sole Data Controller before its own buyers, debtors, employees, and suppliers, represents and warrants that it holds the lawful basis and consent required under Law No. 172-13 and Consumer Protection Law No. 358-05 to record their data and issue fiscal receipts or account statements to them. Consequently, the Client agrees to indemnify, defend, and hold harmless AHORRATECH, EIRL from and against any claim, complaint, inspection, or sanction brought by end buyers, employees, or suppliers before the National Institute for the Protection of Consumer Rights (Pro Consumidor), the General Directorate of Internal Revenue (DGII), or the courts of the Dominican Republic arising from the content or use made by the merchant of the data hosted in its account.
4. Technical Security Measures, Sub-Processors, and Exercise of ARCO Rights
AHORRATECH applies industry-standard technical and organizational security measures: encryption in transit via TLS/HTTPS, user password storage using high-resistance one-way cryptographic hashing algorithms, an AES-256-GCM vault with unique nonces and organization-bound authenticated data for digital certificates (.p12/.pfx), role-based access control with granular permissions, anti-bot protection via Cloudflare Turnstile, and immutability triggers in PostgreSQL.
To operate its cloud infrastructure, AHORRATECH engages top-tier technology sub-processors (cloud server providers, Cloudflare content delivery and security networks, and transactional email delivery services) under strict confidentiality and security agreements. Direct data subjects of AHORRATECH may exercise at any time their rights of Access, Rectification, Cancellation, and Opposition (ARCO rights) enshrined in Law No. 172-13 by sending a written request to [email protected]. Whenever an ARCO request originates from an end buyer or employee of a subscribing merchant, AHORRATECH will forward it to the administrator of such merchant in its capacity as Data Controller.