VATedge acts in two different capacities. We are a “controller” in respect of Personal Information we collect for our own purposes – for example, inquiries submitted through our website, event registrations, business contacts, job applications, and our own security and audit records. We are a “processor” in respect of Personal Information we process on behalf of our business customers in providing the Services – including expense and invoice documents, customer account and user records, bank details used for refund payouts, powers of attorney and support tickets – which we process in accordance with the Data Processing Agreement with the relevant customer. If you have any questions or requests regarding Personal Information we process as a processor, please contact your organization directly in the first instance.
When we submit a VAT refund claim with a tax authority as our customer’s appointed VAT agent, we determine what is submitted and how, exercising our own professional judgment. To that extent (and only to that extent) we act as an independent controller rather than as a processor. The receiving tax authorities are independent controllers in respect of the information they receive (for the purpose of accepting or rejecting an applicable submission).
Acceptance of this Privacy Policy
We encourage you to read this Privacy Policy before accessing and using the Services. It explains what Personal Information we collect, why we collect it, the legal bases on which we rely, who we share it with, and the rights available to you under the GDPR.
Where we rely on your consent for a specific processing activity, we will ask for it separately and you may withdraw it at any time by contacting us at info@vatedge.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
What types of information do you collect?
Non-Personal Information: “Non-Personal Information” is un-identified and non-identifiable information pertaining to a user, which may be made available to us, or collected automatically via your use of the Services which does not enable us to identify the person from whom it was collected. This Non-Personal Information, which is being gathered, consists of behavioral information mainly of technical and aggregated non-identifiable usage information, such as system data related to your operating system and browser version, screen resolution, language, duration of usage of the Services, etc.
Personal Information: “Personal Information” is information that identifies an individual or may with reasonable efforts or together with additional information we have access to, enable the identification of an individual, or may be of a private or sensitive nature relating to an identified or identifiable natural person. Identification of an individual also includes the association of such an individual with a persistent identifier such as a name, an identification number, etc. Personal Information does not include information that has been anonymized or aggregated and can no longer be used to identify a specific natural person. Personal Information that is collected by us consists of the following types of Personal Information:
- Customer Account Users
- We collect account registration and authentication information from our customers’ authorized users, such as name, organization email address, phone, role, profile image, log-in credentials (stored in hashed form) and Google sign-in profile details, together with log-in timestamps and technical log data.
- Expense and Invoice Documents
- In delivering the Services we process the expense receipts and invoices our customers submit to us. These documents routinely contain Personal Information relating to our customers’ employees and to representatives of their suppliers — including names, addresses, travel and accommodation details, VAT numbers, amounts and dates. We process this information as a processor on the instructions of the relevant customer, who is the controller. We also process the bank account details our customers provide so that recovered VAT can be paid to them. These are usually the details of a business account and do not constitute Personal Information; where the account holder is a named individual, such as a sole trader, we treat those details as Personal Information and apply additional restrictions to them.
- Prospect and Business Contact Data
- We collect the name, business email, organization, role, country and telephone number of representatives of businesses who are prospective customers or partners of VATedge, together with any free-text message they choose to send us and the IP address from which a form was submitted (used solely to prevent abuse of our forms). We collect this information through the ‘free consultation’, ‘contact us’, and event-registration forms on our website, and through business cards and attendee lists at conferences and events.
- Employees and Candidates
- We collect name, email, phone, CVs and related information necessary for evaluation of candidates who are interested in working at VATedge.
We collect Personal Information only where we have a legal basis to do so under Article 6 of the GDPR, as set out in Section 5 below.
How do you collect information from me?
- We collect information through your use of the Services. In other words, we are aware of your usage of the Service and may gather, collect and record the information relating to such usage, as further detailed below.
- We collect information that you provide us voluntarily. For example, we collect Personal Information that you voluntarily provide when you request to provide us with your name and email upon your initial registration for the Services.
Why do you collect and process my information?
- To provide, operate and improve our Services and related offers and to manage our business.
- To provide you with a better user experience, more fitted to their specific needs.
- To be able to contact with users who requested such contact to be made, for the purpose of providing them with further information on VATedge and its Services.
- To prevent, detect, mitigate, and investigate fraud, security breaches or other potentially prohibited or illegal activities, whether suspected or actual.
- To comply with any applicable rule or regulation and/or response or defend against legal proceedings versus us or our affiliates.
- To be able to send you our newsletters and information in connection with the Services, where you registered to receive such messages or have otherwise provided us with their consent, or otherwise to provide important notices with respect to Services to which you have registered.
- To market our Services (including via our marketing service providers), and to be able to track and evaluate our marketing activities and their results and attribute different marketing achievements to the respective marketing efforts.
- To act upon and comply with requests you may make pursuant to this Privacy Policy and the privacy laws that apply to you.
- To perform functions or services as otherwise described to you at the time of collection.
What are your legal grounds for collecting my Personal Information?
- Performance of a contract
- Performance of a contract or steps taken at your request prior to entering a contract: to create and operate customer accounts, authenticate users, deliver the Services, process expense documents and claims, execute powers of attorney, pay refunds, respond to support requests, and to respond to demo requests and enquiries you submit to us.
- Compliance with a legal obligation
- To retain tax and claim records for the periods required by applicable tax law, to maintain accountability records under Article 5(2) GDPR, and to respond to data subject requests and lawful requests from public authorities.
- Our legitimate interests
- To keep the Services secure and available, including detecting and preventing fraud, abuse and technical issues; to limit the rate of form submissions using IP addresses; to improve and troubleshoot the Services; to conduct business-to-business marketing and outreach to representatives of prospective customers; to run our internal operations; and to establish, exercise or defend legal claims. We balance these interests against your rights and freedoms before relying on this basis, and you may object to such processing as described in Section 8.
- Your consent
- Where we ask for it for a specific purpose, such as sending you marketing communications where consent is required. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Where do you transfer or store my information?
We host and store Personal Information within the European Union and may access it from Israel, where we are registered. Access from Israel is a transfer outside the EEA and outside the United Kingdom. We rely on the European Commission’s adequacy decision for Israel in respect of Personal Information subject to the EU GDPR, to the extent that decision applies to the processing in question, and on the safeguards described below in respect of Personal Information subject to the UK GDPR. Our production systems, databases, file storage, backups and AI processing all run in Google Cloud’s europe-west1 region in Belgium, and the categories of service providers we use are described in Section 6 above.
Transfers outside the European Economic Area. In limited circumstances Personal Information may be transferred outside the EEA: (i) when we submit a VAT refund claim with a tax authority in a country outside the EEA, which is necessary for the establishment and exercise of your organization’s legal claim to a VAT refund (Article 49(1)(e) GDPR); and (ii) when we use internal business tools hosted in the United States for our own operations, as described in Section 6.
Where a transfer is made to a country that the European Commission has not found to provide an adequate level of protection, we rely on one of the following:
- For Personal Information subject to the EU GDPR: an adequacy decision of the European Commission in respect of the destination country; or
- For Personal Information subject to the EU GDPR: application of Standard Contractual Clauses approved by the European Commission, together with any additional measures identified by a transfer impact assessment; or
- For Personal Information subject to the UK GDPR: UK adequacy regulations in respect of the destination country; or
- For Personal Information subject to the UK GDPR: the International Data Transfer Agreement issued by the UK Information Commissioner, or the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, together with any additional measures identified by a transfer risk assessment (referred to in UK legislation as a “data protection test”).
What are my rights?
Where VATedge is the controller of your Personal Information, you have the following rights under the GDPR. These rights are not absolute and may be subject to conditions and exceptions under applicable law.
You may exercise any of the rights described below by sending a request via email to info@vatedge.com. We will respond within the timeframe required by applicable law. We reserve the right to verify your identity before processing any request.
Your rights may include:
- Right of Access
- You have the right to request confirmation of whether we process Personal Information about you, and to receive a copy of that information, along with details of how and why it is processed. We will respond within one month of receipt of your request, which may be extended by up to two further months where the request is complex.
- Right to Rectification / Correction
- You may have the right to request correction of inaccurate or incomplete Personal Information we hold about you. We endeavor to keep your information accurate and up to date, and will address correction requests promptly.
- Right to Erasure / Deletion
- In certain circumstances, you may have the right to request that we delete Personal Information we hold about you — for example, where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where retention is not otherwise required by law.
- Right to Data Portability
- Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you may have the right to receive your Personal Information in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
- Right to Restriction of Processing
- In certain circumstances, you may have the right to request that we restrict the processing of your Personal Information — for example, while the accuracy of the data is being contested, or where processing is unlawful but you prefer restriction over deletion.
- Right to Object
- Where we process your Personal Information on the basis of our legitimate interests, you may have the right to object to that processing. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the establishment, exercise, or defense of legal claims.
- Right to Withdraw Consent
- Where we rely on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.
- Right to Lodge a Complaint
- You have the right to lodge a complaint with a data protection supervisory authority in the EU or EEA state. If you are in the United Kingdom, you may lodge a complaint with the Information Commissioner’s Office (ico.org.uk). Lodging a complaint does not affect any other remedy available to you, including your right to a judicial remedy.
Limitations on Rights. Not all rights apply in all jurisdictions, and some rights are subject to conditions and exceptions under applicable law. VATedge may decline to fulfill a request where: (i) we are unable to verify your identity; (ii) the request would adversely affect the rights or freedoms of others; (iii) we are required or permitted to retain the data under applicable law; or (iv) fulfilling the request would prevent us from providing a service you have requested.
Data We Process as a Processor. Where VATedge processes Personal Information on behalf of its customers (your organization) as a data processor, we do not control that processing and cannot directly fulfill data subject requests relating to it. Please direct any such requests — including access, correction, or deletion requests — to the relevant VATedge customer (your organization) in the first instance.
Do you use cookies or similar tracking technologies?
We may use certain monitoring and tracking technologies, including ones offered by third-party service providers. These technologies are used in order to maintain, provide and improve our Services on an ongoing basis, and in order to provide a better experience to our users. For example, these technologies enable us to: (i) keep track of our users’ preferences and authenticated sessions, (ii) secure our Services by detecting abnormal behaviors, (iii) identify technical issues and improve the overall performance of our Services, and (iv) create and monitor analytics.
Specifically, we may use cookies in connection with our Services. A “Cookie” is a small data file that is downloaded and stored on your computer or mobile device when you visit our Services.
The cookies we use can be classified in one of the following categories:
- Strictly Necessary cookies
- We use these cookies to enable you to use our Services features, such as enabling movement between pages and remembering information you enter on forms. Without these necessary cookies, our Services will not be possible and our Services will not perform as it should. Because these cookies are strictly necessary to provide a service you have requested, they are exempt from the consent requirement in Article 5(3) of the ePrivacy Directive.
- Security cookies
- We use these cookies to help identify and prevent security risks.
- Performance and Analytics cookies
- We may use these cookies to collect information about your use of our Services and to help improve the way it works.
- Functionality and Preference cookies
- We use these cookies to remember the choices you make such as which language you prefer and to provide you with personalized features.
Learn more about your choices and how to opt-out of tracking technologies:
Please note though that if you do block or restrict tracking technologies on your device, you will still be able to use the Services, but various features and functionality of the Services may be impaired. Most browsers allow you to control cookies, including whether to accept them and how to remove them. You may set most browsers to notify you if you receive a cookie, or to block or remove cookies altogether. In order to delete or block any tracking technologies, please refer to the “Help” area on your internet browser for further instructions, or you may also opt out of third party tracking technologies by following the instructions provided by each third party service provider in its privacy policy, or by visiting www.youronlinechoices.eu or www.aboutads.info/choices. Please note that because the cookies we use are strictly necessary, blocking or deleting them will prevent you from signing in and using the Services.
How do you keep my information secure?
We have implemented administrative, technical and organizational safeguards appropriate to the risk, as required by Article 32 of the GDPR. These include encryption in transit (TLS 1.2 or above) and at rest (AES-256), role-based access controls that restrict each user to their own organization’s data, rate limiting and abuse protection on our public endpoints, and audit logging of access and changes.
Despite these measures, VATedge cannot provide absolute information security or eliminate all risks associated with Personal Information, and security breaches may happen. If there are any questions about security, please contact us at info@vatedge.com.
How long will you retain my information?
We retain Personal Information only for as long as necessary for the purposes for which it was collected. Security, audit and accountability records are retained as evidence of our compliance. Where we rely on your consent and you withdraw it, we will delete the relevant Personal Information unless we are required or permitted to retain it to comply with a legal obligation or to establish, exercise or defend legal claims.
How do you protect the privacy of children?
To use our Services, you must be over the age of eighteen (18). Therefore, we do not knowingly collect Personal Information from individuals under the age of eighteen and do not wish to do so. We reserve the right to request proof of age at any stage so that we can verify that individuals under the age of eighteen are not using the Services. If you believe that we might have any information from or about an individual under the age of eighteen, please contact us at info@vatedge.com.
How do we use the information of job candidates?
We welcome qualified candidates to apply to any of the open positions posted on our Services by sending us your contact details and CV or resume (“Candidate Information”). Since privacy and discreetness are very important to our candidates, we are committed to keep Candidate Information private and will use it solely for our internal recruitment purposes (including for identifying candidates, evaluating their applications, making hiring and employment decisions, and contacting candidates by phone or in writing).
Please note that we may retain Candidate Information submitted to us even after the applied position has been filled or closed. This is done so we could re-consider candidates for other suitable positions and opportunities at VATedge; so we can use Candidate Information as a reference for future applications; and in case the candidate is hired, for additional employment and business purposes related to their employment with us.
Direct marketing
Where you have given us your business contact details, we may contact you about our Services and related updates, relying on your consent or on our legitimate interest in business-to-business marketing. You may object to this or withdraw your consent at any time, at no cost, by sending a written notice to VATedge by email to info@vatedge.com, or by clicking the “Unsubscribe” button displayed in the email you received.
Updates to this Privacy Policy
This Privacy Policy is subject to changes from time to time at our sole discretion. The most current version will always be posted on our Services. You are advised to check for updates regularly. VATedge may provide you with notices concerning this Privacy Policy by using the e-mail address you provide in connection with your account registration on the Services. By continuing to access and use our Services after any updates become effective, you accept and agree to be bound by the updated Privacy Policy.
General information
This Privacy Policy, its interpretation, and any claims and disputes related hereto, shall be governed by the laws set out in the Terms and Conditions, without respect to its conflict of law principles. Such claims and disputes shall be brought before the court of competent jurisdiction set out in the Terms and Conditions. Nothing in this Section limits your rights under the EU GDPR or the UK GDPR, including your right to lodge a complaint with a supervisory authority or to bring proceedings in the courts of your country of residence, nor does it override any mandatory provision of the law of the country in which you are habitually resident.
How can I contact you?
If you wish to exercise any of the aforementioned rights or receive more information, please email us at info@vatedge.com.
VATedge Ltd. · Tel Aviv, Israel · info@vatedge.com