Privacy policy
This is an English translation for convenience. The Spanish version prevails if there is any discrepancy.
This Privacy Policy governs the processing of personal data that TAX FACTORY, S.L. carries out through the website www.taxfactory.es and the channels linked to online contracting of its services, in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).
1. Controller
The controller of the personal data collected through the website www.taxfactory.es and the channels linked to online contracting of services is:
| Item | Value |
|---|---|
| Controller | TAX FACTORY, S.L. |
| Tax ID | B67123612 |
| Registered office | Calle Tenor Viñas, 14, Entresuelo 3.º, 08021 Barcelona |
| Tax address | Plaza de Terrassa Industrial, 4, floor 2, door 3, 08223 Terrassa |
| Contact email | guillem@taxfactory.es |
| Website | www.taxfactory.es |
TAX FACTORY, S.L. has not appointed a Data Protection Officer, as none of the cases requiring one under article 37 GDPR and article 34 LOPDGDD apply. Nevertheless, any question relating to the processing of personal data may be sent to the email address indicated. This assessment will be reviewed if processing or the law changes.
2. Personal data we may process
Depending on the relationship the user has with TAX FACTORY, S.L., the following categories of data may be processed:
Identifying and contact data: first name and surname, company name, NIF/DNI/NIE, email, telephone and details of the company or professional activity.
Data included in forms: information provided by the user in the contact form, quote requests, online contracting or equivalent communications.
Tax and billing data: tax address, data needed to issue invoices, tax obligations and administrative management of contracted services.
Banking and payment data: IBAN or other banking data needed to provide the service, and payment, subscription and billing data processed by Stripe. TAX FACTORY, S.L. does not receive full card details when these are processed directly by the payment gateway.
Advanced electronic signature data: data needed to verify the signatory’s identity and complete the advanced electronic signature after payment through Stripe, via e-Signature.eu and Veriff, including identity, date, time, email, IP address, browser, operation identifiers and acceptance, integrity and signature evidence.
Professional, employment and worker data: where the contracted service includes employment advice, payroll management, social-security contributions, contracts, registrations, deregistrations or clients’ employment obligations.
Tax, accounting, commercial and financial data: accounting, tax, banking, corporate, commercial and financial documentation provided by clients for the provision of services.
Litigation or legal data: information relating to claims, files, proceedings, demands, penalties, attachments, administrative communications or judicial or extra-judicial actions, where needed for the contracted service.
Special-category data: only where strictly necessary for the provision of the service, specially protected data may be processed, such as health data linked to sick leave, disability, accidents, incapacity, wage garnishments or other data derived from employment, administrative or litigation documentation. In these cases processing will be limited to what is strictly necessary.
Browsing and technical storage data: IP address, online identifiers, device type, browser, timestamps, anti-fraud identifiers, security logs and other technical data obtained through cookies or similar technologies, as indicated in the cookie policy. The site may store the language preference locally and, in sessionStorage, temporary contracting-access credentials, the contracting draft and the technical payment handoff.
TAX FACTORY, S.L. will not request the client’s digital certificate through the website. If access to documentation or completion of formalities with a digital certificate is needed at any time, this will be arranged through specific instructions and authorizations outside mere website browsing.
Controller versus processor. Some of the data indicated are processed by TAX FACTORY, S.L. on behalf of its clients. In particular, when the client is a company or an employer that provides data of its workers in order to process Social Security registrations and deregistrations, contracts, payroll or other employment obligations, the controller is the client itself and TAX FACTORY, S.L. acts as processor. In these cases, processing is governed by the data processing agreement entered into under article 28 GDPR, and the legal basis that legitimizes processing of those data belongs to the client controller.
3. Purposes and legal bases of processing
Personal data may be processed for the purposes and on the legal bases indicated below:
| Purpose | Data processed | Legal basis |
|---|---|---|
| Handle enquiries and information requests | Identifying, contact and message data of the user | Consent of the data subject and application of pre-contractual measures where the enquiry is intended to request a quote or contract a service. |
| Send requested quotes or commercial proposals | Identifying, contact, company or activity data and data needed to prepare the proposal | Application of pre-contractual measures requested by the data subject. |
| Manage online contracting of packs or services | Identifying, tax, contractual, billing, payment and advanced electronic signature data | Performance of the contract or application of pre-contractual measures. |
| Provide tax, accounting, employment, commercial, financial, administrative or consultancy services | Data needed to perform the contracted service, including tax, accounting, employment, banking, commercial or financial documentation | Performance of the contract; compliance with legal obligations; legitimate interest in the management and defense of rights where applicable. |
| Manage one-off and recurring payments and billing | Payment data, billing data and data processed by Stripe | Performance of the contract and compliance with legal obligations. |
| Manage the advanced electronic signature and retain evidence | Identity, date, time, email, IP address, browser, operation identifiers and acceptance, integrity and signature evidence | Performance of the contract and defense of rights. |
| Manage communications with clients by email, telephone or WhatsApp Business | Identifying, contact and communications-content data | Performance of the contract, pre-contractual measures or legitimate interest in maintaining necessary communications with clients or interested persons. |
| Send commercial communications, a newsletter or promotional information | Name, email, telephone and commercial preferences | Express consent of the user. Where applicable, a prior contractual relationship for similar services with a simple, free means of objection, in accordance with the LSSI-CE. |
| Comply with legal obligations | Data needed for tax, commercial, employment, accounting, fraud-prevention, administrative or judicial-request obligations | Compliance with legal obligations applicable to TAX FACTORY, S.L. |
| Prevention of money laundering and terrorist financing | Identifying data, documentation and customer due-diligence data of the client and, where applicable, of the beneficial owner | Compliance with legal obligations (Law 10/2010 of 28 April on the prevention of money laundering and terrorist financing). |
| Coordinate services with external collaborators, including Gabinete Gestor, S.L. (MLT Asesores) | Data needed to assess, refer or coordinate the provision of legal, litigation, commercial or financial services | Performance of the contract or pre-contractual measures. Collaborators that process data on behalf of TAX FACTORY, S.L. do so as processors. |
| Prevent fraud, protect the site and defend claims | Technical data, anti-fraud identifiers, Cloudflare Turnstile signals and security logs | Legitimate interest and compliance with legal obligations. |
When a purpose is based on consent, the user may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
4. Forms, online contracting and commercial communications
4.1. Contact forms
The contact form requests a name, email and message. Fields marked as mandatory are needed to handle the enquiry. If they are not provided, TAX FACTORY, S.L. will not be able to process the request adequately.
A telephone number is requested during contracting or when the person provides it through another channel to manage the service. Unnecessary sensitive data should not be included. Anti-fraud protection through Cloudflare Turnstile may process technical signals to verify the interaction.
4.2. Online contracting of services
The website allows the online contracting of certain TAX FACTORY, S.L. packs or services intended for companies, self-employed persons and professionals. Automated contracting is reserved for persons of legal age acting in the course of their activity. During the process, the identifying, tax, billing and contact data needed to formalize the contractual relationship are collected, including the telephone number. For companies, the person who represents them will be identified.
Before paying, the client can review the pack or service terms and the contractual texts, and must accept them expressly. Payment is made through the Stripe secure payment gateway. After payment confirmation, the signatory verifies their identity with Veriff and completes an advanced electronic signature (AES) in the browser, through e-Signature.eu. The service can be activated only when TAX FACTORY, S.L. receives and validates the signed document and the identity, acceptance and integrity evidence. A Stripe redirect does not activate the service.
Signature evidence may include identity, date, time, email, IP address, browser and operation identifiers. Once the contracting process and the advanced electronic signature have been completed, the client will receive at the email address provided a copy of the accepted contract or contractual document.
To prevent data from being lost if the form is closed, the tab may retain a contracting draft in sessionStorage for a maximum of four hours. It includes only the plan, customer type, payroll selection and the identifying, tax and contact data entered. The draft is deleted on expiry, when the tab is closed or when its data are cleared.
Separately, for a maximum of 30 minutes, sessionStorage may retain the technical handoff of a pending checkout so that the user can return from Stripe Checkout and resume the same request. It contains the request identifier, the validated contractual payload, the server-authorized tax breakdown and the internal return path; it is deleted on expiry, when an authenticated payment is confirmed or when tab data are cleared. The handoff does not store the Checkout URL, payment or security data or tokens, bootstrap codes or access tokens, credentials, or signature or provider links.
4.3. Commercial communications and newsletter
TAX FACTORY, S.L. will not send commercial communications, newsletters or promotional campaigns by email, WhatsApp or other equivalent electronic means unless the user has expressly authorized it, or where a prior contractual relationship exists in the terms permitted by the LSSI-CE and a simple, free means of objecting or unsubscribing is always offered.
Acceptance of the Privacy Policy and acceptance of commercial communications must, where applicable, be requested through separate boxes. The commercial-communications box must not be pre-ticked.
5. Recipients and collaborators
As a general rule, TAX FACTORY, S.L. will not disclose personal data to third parties except for a legal obligation, necessity to perform the contract, consent of the data subject or existence of a valid legal basis.
The following recipients or categories of recipients may access the data to the extent necessary:
- Public administrations, the Tax Agency, Social Security, public registries, administrative bodies, courts and tribunals, where necessary by legal obligation or for the provision of the contracted service.
- Cloudflare, for hosting, security, Turnstile, operational storage and delivery of the contact form.
- Stripe, for payments, subscriptions and the billing portal.
- Holded and the professional tools associated with the contracted plan.
- Microsoft 365 and professional communications providers.
- e-Signature.eu, to verify the signatory’s identity, manage the advanced electronic signature and generate the associated technical evidence.
- CARTO, for office-map tiles.
- WhatsApp Business, when the user or client uses this channel to communicate with TAX FACTORY, S.L.
- Gabinete Gestor, S.L. (MLT Asesores), which acts as a specialist collaborator and provider of TAX FACTORY, S.L. for the provision of certain legal, litigation, commercial or financial services that TAX FACTORY, S.L. does not provide directly. Gabinete Gestor, S.L. does not have a direct contractual relationship with the client and processes the data on behalf of TAX FACTORY, S.L. as a processor (or, where the data correspond to processing for which the client is the controller, as a subprocessor), with access limited to what is strictly necessary for the provision of the service.
- Other suitably qualified professional collaborators, where they are needed to provide specialist services requested by the client.
TAX FACTORY, S.L. will, where applicable, enter into the corresponding data-processing agreements with providers that process data on behalf of the company under article 28 GDPR. It will document the applicable processors and subprocessors. The list may change for operational needs; a change does not by itself expand the authorized purposes.
6. International data transfers
Some technology providers used by TAX FACTORY, S.L., such as Cloudflare, Microsoft 365, Stripe and WhatsApp Business, may involve international data transfers outside the European Economic Area.
When such transfers occur, they will be carried out on the basis of appropriate safeguards provided for in the GDPR, such as European Commission adequacy decisions, the EU-US Data Privacy Framework where the provider is certified, standard contractual clauses or other legally valid mechanisms, plus supplementary measures where necessary.
7. Retention periods
Personal data will be retained for the time needed to fulfil the purpose for which they were collected and, once that purpose has ended, for the periods needed to address possible legal, contractual, tax, commercial, employment or professional liabilities.
| Type of data or processing | Indicative retention period |
|---|---|
| Enquiries that do not result in contracting or a quote | For the time needed to handle the enquiry. Once management has ended, the data will be deleted to the extent technically possible, except retention in backups or a need to address liabilities. |
| Quotes or proposals that are not accepted | 12 months from sending or from the last related communication, unless an obligation or liability justifies a longer period. |
| Client data, contracts and signature evidence | During the term of the contractual relationship and, afterwards, during the applicable legal periods and limitation periods for liabilities. |
| Tax and billing data | Four years from the end of the filing period for the corresponding return (tax limitation, article 66 of the General Tax Law) and six years for accounting and commercial books and documentation (article 30 of the Commercial Code). |
| Anti-money-laundering documentation (due diligence) | Ten years from the end of the business relationship or from execution of the transaction (article 25 of Law 10/2010). |
| Employment data and data of clients’ workers | During the provision of the service and, afterwards, during the applicable limitation periods, generally four years in employment and Social Security matters, without prejudice to longer tax or liability periods. |
| Legal, litigation or administrative data | During the handling of the file and, afterwards, during the periods needed to address possible liabilities or claims. |
| Data processed on the basis of consent | Until the data subject withdraws consent, without prejudice to retention needed to evidence the consent given or to address liabilities. |
| Cookie, browsing and technical storage data | As indicated in the cookie policy. |
Deletion of data may not be immediate in technical backups, in which case the data will remain blocked and will be deleted in accordance with the ordinary retention cycles of those backups. Where information must be retained, it will be kept blocked and limited to the legal purpose.
8. Rights of data subjects
The user may exercise the following rights: access, rectification, erasure, objection, restriction of processing, portability and withdrawal of consent where processing is based on consent.
To exercise these rights, the data subject may send a request to guillem@taxfactory.es, indicating the right they wish to exercise and enclosing, where necessary, sufficient information to verify their identity. TAX FACTORY, S.L. will not request excessive documentation.
TAX FACTORY, S.L. will respond within a maximum of one month from receipt of the request, unless the complexity or number of requests makes it necessary to extend that period in accordance with the GDPR.
The data subject also has the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es) if they consider that processing of their personal data does not comply with applicable law.
9. Security measures
TAX FACTORY, S.L. will apply appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the nature of the data processed, the state of the art, the costs of implementation and the risks to the rights and freedoms of natural persons.
Those measures may include, among others, access control, separation of environments and capabilities, user management, encryption where appropriate, backups, technical logging, minimization, use of professional tools, provider review, confidentiality commitments and specific measures to limit access to sensitive or specially protected data.
No system offers zero risk. Incidents will be handled in accordance with applicable law.
10. Use of WhatsApp Business
TAX FACTORY, S.L. may use WhatsApp Business as a communication channel with clients or interested persons who contact through that channel or authorize its use. This channel will be used mainly for customer service, service coordination and operational communications related to requests or contracts.
Use of WhatsApp for commercial or promotional communications will require the user’s prior consent, unless a valid legal basis exists under the LSSI-CE. The user may request at any time that WhatsApp not be used as a communication channel.
11. Amendment of the Privacy Policy
TAX FACTORY, S.L. may amend this Privacy Policy to adapt it to regulatory, technical, organizational or service changes. The version in force is the one published at any given time at this route. Enquiries: guillem@taxfactory.es.