Privacy Policy
1. Who is responsible
Compliant Receipts is operated by Smarter World e.U., Vienna, Austria, reachable at [email protected]. Operator details: Smarter World e.U., Sterngasse 4, 1230 Vienna, Austria · FN 630061 k, Handelsgericht Wien · UID ATU80909028 · [email protected] · +43 660 9673650. For the merchant account data described below we are the controller under the EU General Data Protection Regulation (GDPR). For your customers' data we act on your instructions as your processor (section 3); you remain the controller.
2. What we process
- Merchant account data
- The business details you enter at set-up (legal and trading name, address, VAT, tax and company register numbers, bank details, time zone, document language), your settings (mode, no-VAT status, prices-include-tax, usual rate, the contact field that holds customers' VAT numbers), your logo and accent colour, the identifiers of your CRM account, and the encrypted access tokens your CRM issued to us for that account.
- Customer and transaction data
- For each payment: the invoice or order lines (description, quantity, price, tax rate), amounts, currency, dates, the customer's name, company name, address, email, phone number and VAT number as they stand in your CRM, and the payment method summary (card brand and last four digits, or "cash", "bank transfer"). The resulting document, its PDF, and the record of where and when it was sent.
- Register checks
- The result of checking your registration number and your customers' VAT numbers with the public registers (VIES, HMRC, ABN Lookup): the number, whether it was confirmed, the register's reference and date, and the name and address the register returned.
- Enquiries from our website
- When you use the early-access form on compliantreceipts.com: your name, work email, company, who you are (agency, business, adviser), the countries you sell in and your message. We use them only to answer you and to tell you about the Service.
- Technical data
- Request logs (time, route, status, request id; never tokens, secrets or document contents) kept for 30 days to operate and secure the Service.
3. Processor clause
When we process your customers' data to issue, store and send documents, we do so only on your documented instructions, which are these Terms, your set-up choices and your use of the console; we keep that data confidential; we apply the measures in section 7; we engage only the sub-processors in section 5 and tell you of changes with 30 days' notice; we assist you with data-subject requests and with your own compliance obligations in so far as the data we hold is concerned; and at the end of the Service we keep the documents for the statutory retention period (section 6) and delete everything else. Where the law requires a written processing agreement, this section together with the Terms is that agreement; a signed copy is available on request.
4. Why we process it, and on what basis
- To issue and deliver your tax documents — performance of our contract with you (Art. 6(1)(b) GDPR) and, for the documents themselves, the legal obligations of the country you selected (Art. 6(1)(c)).
- To check registration numbers — our legitimate interest and yours in issuing correct documents (Art. 6(1)(f)), and the evidence duties of your country's rules.
- To keep the documents for the retention period — legal obligation (Art. 6(1)(c)).
- To answer your enquiry — your request and your consent on the form (Art. 6(1)(b) and (a) GDPR); you can withdraw consent at any time by emailing us.
- To operate and secure the Service — legitimate interest (Art. 6(1)(f)).
5. Where data goes
| Recipient | Purpose | Location |
|---|---|---|
| Railway Corp. (hosting) | Running the Service and its database. All documents and merchant data are stored here. | EU (Amsterdam region) |
| Your CRM platform provider | The platform your business account runs on. We read payments, invoices, orders and contacts from it and send documents through its email and messaging channels. | United States |
| Cloudflare, Inc. | Network and security service in front of the Service and the website: it passes requests through and may see IP addresses and request data in transit. | Global network (United States company) |
| Our own CRM account | Website enquiries are stored as contacts so we can reply. | United States |
| European Commission (VIES) | Checking EU VAT numbers | EU |
| HM Revenue & Customs | Checking UK VAT numbers | United Kingdom |
| Australian Business Register (ABN Lookup) | Checking ABNs | Australia |
Documents, PDFs and merchant data are hosted in the EU. Where data leaves the EEA — to your CRM provider, to Cloudflare, to our own CRM account for enquiries, to HMRC or to the ABR — the transfer rests on the necessity of performing your contract (Art. 49(1)(b)–(c) GDPR), on the UK and Australian registers' public nature for the numbers checked, and on the providers' standard contractual clauses where applicable.
6. How long we keep it
| Data | Kept for |
|---|---|
| Issued documents, their PDFs and register evidence | The retention period of your country: United Kingdom 6 years, Germany 8 years, Austria 7 years, Netherlands 7 years, Belgium 7 years, Australia 5 years — counted as that country counts it. They survive uninstalling, because they are tax records. |
| Merchant account data and settings | For as long as the Service is installed, then alongside the documents they identify, for the same period. |
| Access tokens for your CRM account | Until you uninstall, then revoked and deleted. |
| Set-up drafts that never became an account | 90 days. |
| Register-check cache | 24 hours; the result on a document stays with the document. |
| Request logs | 30 days. |
| Website enquiries | 24 months after our last contact, unless you become a customer. |
7. How we protect it
Data is encrypted in transit (TLS) and at rest. Access tokens are encrypted with a key held outside the database. Issued documents are protected against change and deletion at the database level. Access to production systems is limited to the operator, with individual credentials and logging. Documents and data of one business are kept separate from every other business's by account and by tenancy, so a reused CRM account never sees a previous occupant's records.
Reporting a security problem. If you find a vulnerability or suspect that data has been exposed, email [email protected] with "Security" in the subject. We reply within two working days. If a breach affects your data, we tell you without undue delay, so that you can meet your own duties, and we notify the authorities where the law requires it (for UK data, the Information Commissioner's Office within 72 hours).
8. Your rights, and your customers' rights
Under the GDPR you may ask for access to, correction of, deletion of, or a copy of your personal data, object to processing based on legitimate interest, and complain to a supervisory authority (in Austria, the Datenschutzbehörde). Email [email protected]. Two limits follow from the law: an issued tax document cannot be altered or deleted before its retention period ends, and a customer's request about data on such a document should be addressed to you as the controller — we assist you with it.
9. Changes
We may update this policy; the effective date above changes when we do, and material changes are announced in the console 30 days ahead.