Privacy Policy
Last updated: September 29, 2026
This Privacy Policy explains how DIFVISION S.A.S. (RUC 1191797225001, Av. Padre Eliseo Arias Carrión y Paraguay, Catamayo (La Toma), cantón Catamayo, provincia de Loja, Ecuador) ("Primiox", "we") collects, uses and protects personal data in connection with the Primiox platform and websites (the "Service").
Two different roles — please read this first.
- For data about you as a Merchant / account user (the person who signs up and runs a store), we are the data controller and this Policy applies.
- For data about your Shoppers (your store's end customers), you (the Merchant) are the controller and we act as your processor under the Data Processing Addendum. What happens to Shoppers' data is governed by your store's privacy policy, not this one.
We handle personal data in accordance with Ecuador's Ley Orgánica de Protección de Datos Personales (LOPDP) and, where applicable, the EU/UK GDPR and other data-protection laws.
1. Data we collect (about Merchants / account users)
- Account data — name, email, password (hashed), company, country, phone, role.
- Billing data — plan, billing contact, transaction references and metadata. We do not store full card numbers; payments are handled by our payment processor.
- Usage data — log data, device/browser, IP address, pages and features used, diagnostics and performance data.
- Support data — messages you send us and their contents.
- Cookies and similar — see the Cookie Policy.
The Service is intended for businesses and adults. We do not knowingly collect personal data from children. If we learn we have collected data from a child below the age required by applicable law (for example, under 13 under the U.S. COPPA, or the minimum age set by the LOPDP or the GDPR), we will delete it. Personal data of a Merchant's Shoppers is handled under that Merchant's own privacy policy.
2. How we use it, and our legal bases
| Purpose | Legal basis (GDPR-style) |
|---|---|
| Provide, operate and secure the Service | Performance of a contract |
| Bill you and prevent fraud | Contract / legitimate interests |
| Support and communicate about the Service | Contract / legitimate interests |
| Improve and develop the Service (aggregated/diagnostic) | Legitimate interests |
| Send product or marketing emails | Consent or legitimate interests (you can opt out) |
| Comply with law, tax and legal claims | Legal obligation / legitimate interests |
Under the LOPDP the equivalent bases (contract, legitimate interest, consent, legal duty) apply.
3. Who we share it with (subprocessors and disclosures)
We share personal data only as needed to run the Service, with providers acting on our behalf under contract, including categories such as:
- Hosting / infrastructure — Vercel Inc. and Amazon Web Services (AWS)
- Payment processing — Stripe, Kushki, Payphone and Datafast (per market)
- Email / communications — Amazon SES and Google Workspace
- Analytics — not currently enabled; any analytics provider will be listed here and in the Cookie Policy before we use it
We may also disclose data: to comply with law or lawful requests; to protect our rights, safety and property; and in a merger, acquisition or sale of assets (with notice where required). We do not sell your personal data.
A current subprocessor list is available on request at contact@difvision.com.
4. International transfers
Your data may be processed in countries other than yours (including where our providers operate). Where required, we use lawful transfer mechanisms (e.g. Standard Contractual Clauses or an adequacy basis) to protect it.
5. Retention
We keep personal data for as long as your account is active and as needed to provide the Service, then for the period required to meet legal, tax, accounting and dispute-resolution obligations, after which we delete or anonymize it.
6. Security
We use reasonable technical and organizational measures to protect personal data (encryption in transit, access controls, least-privilege, monitoring). No system is perfectly secure; we cannot guarantee absolute security. If a breach affecting your personal data occurs, we will notify you as required by law.
7. Your rights
Subject to applicable law (LOPDP / GDPR / others), you may have the right to: access your data; correct it; delete it; restrict or object to processing; portability; and withdraw consent. To exercise these, contact contact@difvision.com. You also have the right to complain to your data-protection authority (in Ecuador, the Superintendencia de Protección de Datos Personales).
For Shopper data, direct such requests to the Merchant whose store you interacted with — they are the controller.
Your region. Primiox operates in Ecuador and the United States and may serve users in the EEA, the UK and elsewhere. We apply the protections required by the law that applies to you:
- Ecuador — the Ley Orgánica de Protección de Datos Personales (LOPDP); the supervisory authority is the Superintendencia de Protección de Datos Personales.
- European Economic Area / United Kingdom — the EU/UK GDPR; you may complain to your local supervisory authority, and cross-border transfers rely on Standard Contractual Clauses or an adequacy decision.
- United States (including California) — applicable state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA). We do not sell your personal data or "share" it for cross-context behavioral advertising; you may request access or deletion at contact@difvision.com.
- Other regions — we honor the mandatory data-protection rights that apply where you reside.
8. Cookies
Our websites use cookies and similar technologies as described in the Cookie Policy, including strictly necessary cookies and, with consent where required, analytics.
9. Marketing
We may send you service messages (which you cannot opt out of while you have an account) and, separately, product/marketing emails you can unsubscribe from at any time via the email or by contacting us.
10. Changes
We may update this Policy and will post the new version with an updated date; for material changes we will give reasonable notice.
11. Contact
Privacy questions or requests: contact@difvision.com · difvision.com Data controller: DIFVISION S.A.S. (RUC 1191797225001), legally represented by Diego Patricio Vicente Cabrera, Av. Padre Eliseo Arias Carrión y Paraguay, Catamayo (La Toma), cantón Catamayo, provincia de Loja, Ecuador. For any data-protection matter, including exercising your rights, write to contact@difvision.com. We will appoint a formal data-protection delegate if and when the LOPDP requires one for our processing.