Data Processing Agreement

1. Parties and purpose

This agreement is part of Flashpi’s Terms of Service. Its parties are:

• The customer, acting as controller.
• SIGNIADIGITAL S.A. (“Flashpi”), RUC 0993411372001, acting as processor.

It governs the processing of the personal data the customer sends to Flashpi, through the API or the console, to issue its electronic tax documents. On data protection matters, this agreement prevails over the terms.

2. Duration

It applies while the customer uses the service and until Flashpi finishes returning or deleting the data under section 13.

3. Nature and purpose of the processing

Flashpi processes the data only to provide the service:

• reading the RUC or the cédula and the name of its holder or organization from the customer’s signature certificate, to propose the issuer’s details when the customer adds an issuer or renews its signature;
• generating the electronic documents, signing them with the customer’s certificate and sending them to the SRI;
• checking their authorization and storing the response;
• generating the RIDE PDF;
• emailing the RIDE and XML to recipients, when the customer asks for it;
• notifying status changes to the webhook URLs the customer sets up;
• storing the documents so the customer can look them up and download them;
• giving technical support when the customer asks for it.

Flashpi does not use this data for its own purposes, does not sell it and does not combine it with other sources.

4. Data subjects and data categories

• Data subjects: buyers, suppliers, withholding subjects, carriers and recipients of the customer’s documents, and the holder of the electronic signature certificate.
• Data: ID type and number (cédula, RUC or passport), name or legal name, address, email, vehicle plate, transaction details and amounts, any additional information the customer includes in the documents, and the signature certificate’s data.

The customer must not include sensitive data in the documents, for example in the additional information fields.

5. Customer obligations

The customer:

• has a legal basis to give the data to Flashpi and for each processing it entrusts to it;
• tells the data subjects, in its own privacy notice, that it uses a processor with servers outside Ecuador;
• provides accurate data, limited to what is needed;
• answers the data subjects’ requests, with the help from Flashpi described in section 10.

6. Instructions

Flashpi processes the data only on the customer’s documented instructions. The terms, this agreement, the requests the customer makes through the API and the settings it chooses in the console are instructions.

If Flashpi believes an instruction breaks the law, it will tell the customer and may hold off until the customer confirms or changes it. Flashpi will also process the data when a law or a court order requires it, and will tell the customer unless the law forbids it.

7. Confidentiality

Only the Flashpi people who need the data to provide the service can access it. Those people are bound by confidentiality, which continues after they leave Flashpi.

8. Security

Flashpi applies technical and organizational measures suited to the risk, including:

• encryption in transit (TLS 1.2 or later) and at rest, with AWS KMS keys that rotate automatically;
• the signature certificate and its password encrypted (AES-256-GCM), which only the signing service can decrypt;
• the database on a private network with no internet access, and a web application firewall in front of the site and the API;
• limited staff access, with two-step verification and logging of their lookups;
• daily database backups, kept for 7 days.

9. Sub-processors

The customer authorizes Flashpi to use as sub-processor:

Flashpi binds each sub-processor to data protection obligations equivalent to this agreement’s and is responsible for their compliance. It will give the customer 30 days’ notice before adding or changing a sub-processor. If the customer objects on reasonable grounds, it may end the contract before the change takes effect.

The SRI is not a sub-processor: it receives the documents because of the customer’s tax obligation. Certification authorities only receive certificate data to check whether it is valid.

10. Data subjects’ rights

If a data subject sends Flashpi a request about the customer’s data, Flashpi will forward it to the customer within 2 business days and will not answer it on its own, unless the customer asks it to. Flashpi will help the customer answer access, rectification, deletion, objection, portability and suspension requests, as far as the service allows.

11. Security breaches

If Flashpi becomes aware of a security breach affecting the customer’s data, it will notify the customer without delay and at most within 2 business days, with the information available:

• what happened and when;
• which data and data subjects may be affected;
• what measures it took or proposes.

Flashpi will help the customer meet its own duty to notify Ecuador’s Superintendencia de Protección de Datos Personales and the data subjects.

12. Audits and assistance

Flashpi will make available to the customer the information needed to show that it complies with this agreement. The customer may audit it once a year, with 30 days’ notice, at its own cost and under confidentiality, or sooner if an authority requires it. Flashpi will also help the customer with its impact assessments and with the Superintendencia’s requests related to this service.

13. Return and deletion of the data

While its account is active, the customer can download its documents (XML and RIDE) through the API or the console. When the contract ends, it has 30 days to download them. After that, Flashpi will delete the customer’s data, including its copies, except what a law requires it to keep. Backups are deleted when their retention period ends.

14. Record of processing activities

Flashpi keeps a record of the processing it carries out on behalf of its customers, where the law requires it.

15. Liability

Each party is liable for breaching its obligations under the LOPDP and this agreement. Flashpi is liable to the customer for damage it causes when it breaches this agreement or acts outside its instructions. The terms’ limits of liability apply, except where the LOPDP does not allow liability to be limited.

16. Acceptance

The customer accepts this agreement electronically, together with the terms. For any question about it, write to privacidad@flashpi.com.ec.

17. Changes to this agreement

This agreement is part of the terms and changes as they do (section 19 of the terms). We publish each version on this page with its effective date.

Versions

• October 29, 2026: we added to the purposes reading the RUC or the cédula and the holder from the signature certificate, to propose the issuer’s details when the customer adds an issuer or renews its signature (section 3).
• October 21, 2026: first version.