Privacy policy

1. Who is responsible

Responsible for the data of this site, of our customers and of Mercado's buyers:

• Trade name: VihaPOS
• E-mail: eng.valtervalik@gmail.com
• WhatsApp: +5350532316

For any privacy question, write to us at eng.valtervalik@gmail.com or WhatsApp +5350532316.

2. What data we process and why

Visitors to this site:

• This site has no forms. If you write to us by WhatsApp or e-mail, we use your name, number or address and your message only to answer you and, if you ask, prepare a proposal.
• Visit statistics (Google Analytics) only if you accept them in the cookie notice: pages viewed, device type and approximate location. Without your permission they don't load.
• The business address you type in "Already using VihaPOS?" is not stored: it only takes you there.

Businesses that use VihaPOS, and their users:

• The business's contact and billing details, and the name, login and e-mail of each person who signs in, to provide, support and bill the service.

Data each business keeps in VihaPOS (its customers, staff, sales, stock):

• The business decides on it and controls it: it is the controller. We process it only on its behalf, to provide the service, as a processor.
• Each business has its own database. Our staff only enter it when the business asks for support, for maintenance or for security, and never use the data for anything else.
• If you are a customer of a business that uses VihaPOS and want to exercise your rights, contact that business. If you write to us, we'll help pass your request on.

Mercado VihaPOS buyers:

• Name, phone, address (only for home delivery) and the note you write, so the shops in your order can prepare it, deliver it and contact you. Only those shops see them.
• After 90 days the name, phone, address and note are deleted; the order stays without personal data. You can delete them sooner from the order page once it is delivered or cancelled.
• An encrypted fingerprint of your IP address, to limit orders to 10 an hour and prevent abuse. It is deleted with the rest after the same days.
• If you rate a shop, your first name, the stars and the comment are shown on the shop's page.

Loyalty card:

• Its page shows only what the card shows (shop, name, balance and code). It opens from a private link and is hidden from search engines.

Businesses' WhatsApp campaigns:

• Businesses must only send them to customers who agreed to receive promotions; the system records when and where they agreed. Every message says how to stop them: reply BAJA and you get no more.

3. Legal basis

We process data with your consent (statistics, promotions), because it is needed for the contract or order you ask for (service, delivery), to meet legal duties (accounting and tax) or for a legitimate interest in keeping the site and the service secure. You can withdraw consent at any time; it doesn't affect what was done before.

4. Who we share data with

Only who is needed to provide the service, and only what they need:

• Our servers, and a second server for backups.
• If a business turns on AI with a cloud provider (Google Gemini, Groq, OpenRouter, Mistral, Anthropic or another it picks), that provider gets the product data or campaign text it is asked to write about. AI is off by default and, when on, runs on our own server by default.
• TropiPay, if the business takes payments with it: the payment and payer details the gateway asks for.
• The social networks the business posts to (Facebook, Instagram, Threads, X, LinkedIn, Pinterest, TikTok, Google, Bluesky, Telegram): they get what is posted.
• WhatsApp: campaign messages and posts go out through WhatsApp from the business's number.
• Google Analytics, only if you accept statistics on this site.
• elTOQUE gives us exchange rates and gets no personal data.
• Authorities, when a law requires it.

Some of these providers are outside Cuba. Data only goes to them when the business turns that feature on.

5. How long we keep it

• Service data: for as long as the contract lasts.
• Backups: 14 daily copies, replaced as new ones are made.
• When a contract ends: we hand the business its data if it asks, delete its database, and its final backup is deleted after 90 days.
• Mercado buyers: 90 days, or sooner if you delete them.
• Messages you send us: up to 12 months after the last conversation, unless they lead to a contract.
• Invoices and accounting records: as long as the law requires.

6. Your rights

You can ask us to access, correct, update or cancel (delete) your data, object to a use of it, or withdraw your consent. Write to us at eng.valtervalik@gmail.com or WhatsApp +5350532316, say what you ask for and how we can identify you. We answer within 30 days, free of charge.

These rights are recognised by article 97 of the Constitution of the Republic of Cuba and Law 149/2022 on Personal Data Protection.

7. How we protect it

Encrypted connections (HTTPS), a separate database per business, password rules, role-based permissions, backups on another server, and staff access only when needed.

8. Minors

VihaPOS is a service for businesses and is not aimed at anyone under 18. On Mercado, a minor must order with a parent's or guardian's permission. We don't knowingly collect minors' data; if you think we have, write to us and we'll delete it.

9. Cookies

The cookie policy explains which cookies we use and how to choose.

10. Changes

If we change this policy, we'll post the new version here with its date and, for important changes, tell our customers beforehand.