The Virtual Complaints Book is not just another contact form; in Peru, it is a strict legal requirement regulated by the Consumer Protection and Defense Code (Law No. 29571) and overseen by INDECOPI. From a software engineering perspective, its implementation requires a precise data architecture, the generation of immutable receipts, and automated notifications.
The technical regulations and an architectural proposal for its development from scratch are detailed below.
Which websites are required to have it?
INDECOPI’s general rule states that any provider offering goods or services to end consumers (B2C) through digital means must have a Virtual Complaints Book. This includes:
- E-commerce platforms: Any online store with a shopping cart that processes transactions for physical products (e.g., selling gifts, sweets, spare parts) must have the book accessible.
- Paid Service Directories and Portals: If a news portal or industry directory sells subscriptions, advertising space or premium registrations directly to users, it is subject to the regulation.
- Professional Digital Services: Consulting firms, agencies, and educational platforms that bill the consumer directly.
Exception: Purely informative portals (such as a blog or news website that does not directly market anything on the platform) are not legally required, although having a contact channel is recommended.
Interface (UI/UX) Requirements
- Visibility: The link or button must be on the homepage (generally in the footer or a floating panel) and must include the official logo of the Complaints Book established by INDECOPI.
- Differentiation: The form must clearly require the user to choose between a Claim (dissatisfaction directly related to purchased goods or services provided) and a Complaint (discontent or dissatisfaction regarding customer service, not directly related to the product).
Backend Logic and Workflow
If a custom solution is developed using Vanilla PHP or a lightweight framework, the server flow must guarantee traceability and immediate notification.
- Sequential Code Generation: The law requires a unique and sequential code for each record. A best practice is to concatenate the current year with a sequential number padded with zeros (e.g., 000015-2026). This logic must be transactional to prevent duplicates if two users submit a form in the same millisecond.
- Automated Acknowledgement: Upon processing the POST request, the backend must immediately send an email to the consumer with an exact copy of their complaint form, ideally in PDF format (using libraries such as FPDF or mPDF) or as an immutable HTML email.
- Response Times: Current regulations require that complaints be answered within a maximum of 15 business days. At the system level, it is recommended to implement a cron job that sends internal alerts to the customer service team after 7 and 12 days if the ticket remains open.
Proposed Database Schema (MySQL)
To comply with all the mandatory fields of the INDECOPI Annex, the relational schema in MySQL must be structured as follows:
| Columna | Tipo de Dato (MySQL) | Descripción y Restricciones |
| id_reclamacion | INT AUTO_INCREMENT | Llave primaria interna. |
| codigo_correlativo | VARCHAR(20) UNIQUE | Código oficial visible (ej. 00001-2026). |
| fecha_registro | DATETIME | Timestamp exacto de la recepción. |
| tipo_documento | ENUM(‘DNI’,’CE’,’Pasaporte’) | Documento de identidad del consumidor. |
| numero_documento | VARCHAR(15) | Número de identidad validado. |
| nombre_completo | VARCHAR(150) | Nombre o Razón Social del consumidor. |
| email_contacto | VARCHAR(100) | Obligatorio para el acuse de recibo. |
| telefono_contacto | VARCHAR(20) | Teléfono del consumidor. |
| menor_edad | TINYINT(1) | Booleano (1 si es menor, requiere datos del apoderado). |
| apoderado_nombre | VARCHAR(150) NULL | Obligatorio si menor_edad es 1. |
| bien_contratado | ENUM(‘Producto’,’Servicio’) | Definición de lo que se comercializó. |
| monto_reclamado | DECIMAL(10,2) NULL | Valor de la transacción en Soles. |
| descripcion_bien | TEXT | Qué compró exactamente (ej. Pack de fiesta). |
| tipo_incidencia | ENUM(‘Reclamo’,’Queja’) | Clasificación legal. |
| detalle_incidencia | TEXT | Relato del consumidor. |
| pedido_consumidor | TEXT | Qué exige el consumidor (ej. Devolución). |
| estado_ticket | ENUM(‘Abierto’,’Resuelto’) | Control interno del sistema. |
| fecha_respuesta | DATETIME NULL | Cuándo se cerró el caso. |
Technical and Safety Considerations
- Input Sanitization: As a large public form, it is a classic target for SQL injection and Cross-Site Scripting (XSS) attacks. In PHP, it is imperative to process all text fields using Prepared Statements (with PDO) and sanitize the HTML output (htmlspecialchars).
- Personal Data Protection (Law No. 29733): The form collects sensitive information from Peruvian citizens. You must include a mandatory, non-pre-checked checkbox where the user accepts the “Privacy and Personal Data Processing Policy.”
- Storage and Retention: INDECOPI requires that complaint forms be kept for a minimum of two years. The database must include this historical record, and it is advisable to perform regular backups of this specific table.