Who we are and how we act
VATedge Ltd. (“VATedge”, “we”, “our” or “us”) is a company registered in Israel, based in Tel Aviv, and offers automated foreign VAT recovery services (the “Services”). This Privacy Policy supplements and should be read together with our Terms of Service, and may be supplemented by additional privacy statements, terms or notices provided to you. Capitalized terms that are not defined here have the meaning given to them in our Terms of Service.
VATedge acts in more than one capacity. We are a “controller” in respect of personal information we collect for our own purposes, for example inquiries submitted through our website, event registrations, business contacts, job applications, and our own security and audit records. We are a “processor” in respect of personal information we process on behalf of our business customers in providing the Services, including expense and invoice documents, customer account and user records, bank details used for refund payouts, powers of attorney and support tickets, which we process in accordance with the Data Processing Agreement with the relevant customer. If you have any questions or requests regarding personal information we process as a processor, please contact your organization directly in the first instance.
When we file a VAT refund claim with a tax authority as our customer’s appointed VAT agent, we determine what is submitted and how, exercising our own professional judgment. To that extent, and only to that extent, we act as an independent controller rather than as a processor. The receiving tax authorities are independent controllers in respect of the information they receive.
Acceptance of this policy
Please read this Privacy Policy before accessing and using the Services.
Where we rely on your consent for a specific processing activity, we will ask for it separately and you may withdraw it at any time by contacting us at info@vatedge.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
What information we collect
Non-personal information. Information that is un-identified and non-identifiable, made available to us or collected automatically through your use of the Services, which does not enable us to identify the person it was collected from. This consists mainly of technical and aggregated usage information, such as operating system and browser version, screen resolution, language, and duration of usage.
Personal information. Information that identifies an individual, or that with reasonable effort — or together with other information we have access to — enables the identification of an individual, or that is of a private or sensitive nature relating to an identified or identifiable natural person. This includes the association of an individual with a persistent identifier such as a name or an identification number. Personal information does not include information that has been anonymized or aggregated and can no longer be used to identify a specific natural person. The personal information we collect falls into the following categories.
- Customer account users
- Account registration and authentication information from our customers’ authorized users: name, organization email address, phone, role, profile image, log-in credentials (stored in hashed form) and Google sign-in profile details, together with log-in timestamps and technical log data.
- Expense and invoice documents
- In delivering the Services we process the expense receipts and invoices our customers submit to us. These documents routinely contain personal information relating to our customers’ employees and to representatives of their suppliers, including names, addresses, travel and accommodation details, VAT numbers, amounts and dates. We process this information as a processor on the instructions of the relevant customer, who is the controller. We also process the bank account details our customers provide so that recovered VAT can be paid to them. These are usually the details of a business account and do not constitute personal information; where the account holder is a named individual, such as a sole trader, we treat those details as personal information and apply additional restrictions to them.
- Prospect and business contact data
- The name, business email, organization, role, country and telephone number of representatives of businesses who are prospective customers or partners of VATedge, together with any free-text message they choose to send us and the IP address a form was submitted from (used solely to prevent abuse of our forms). We collect this through the free consultation, contact us, and event registration forms on our website, and through business cards and attendee lists at conferences and events.
- Employees and candidates
- Name, email, phone, CVs and related information necessary for the evaluation of candidates interested in working at VATedge.
We collect personal information only where we have a legal basis to do so under Article 6 of the GDPR, as set out in section 6 below.
How we collect information
We collect information through your use of the Services. We are aware of your usage of the Services and may gather, collect and record information relating to that usage.
We also collect information you provide to us voluntarily, for example the name and email you give us when you register for the Services or submit a form on our website.
Why we process your information
To provide, operate and improve our Services and related offers, and to manage our business. To give you a user experience better fitted to your needs. To contact users who have asked to be contacted, so we can tell them more about VATedge and its Services.
To prevent, detect, mitigate and investigate fraud, security breaches, and other potentially prohibited or illegal activity, whether suspected or actual. To comply with any applicable rule or regulation, and to respond to or defend against legal proceedings involving us or our affiliates.
To send you newsletters and information connected to the Services, where you registered to receive them or otherwise gave us your consent, and to send important notices about Services you have registered for. To market our Services, including through our marketing service providers, and to track and evaluate our marketing activities and their results.
To act upon and comply with requests you make under this Privacy Policy and the privacy laws that apply to you, and to perform any other function or service described to you at the time of collection.
Our legal grounds for processing
- Performance of a contract
- To create and operate customer accounts, authenticate users, deliver the Services, process expense documents and claims, execute powers of attorney, pay refunds, respond to support requests, and respond to demo requests and enquiries you submit to us, including steps taken at your request before entering into a contract.
- Compliance with a legal obligation
- To retain tax and claim records for the periods required by applicable tax law, to maintain accountability records under Article 5(2) GDPR, and to respond to data subject requests and lawful requests from public authorities.
- Our legitimate interests
- To keep the Services secure and available, including detecting and preventing fraud, abuse and technical issues; to limit the rate of form submissions using IP addresses; to improve and troubleshoot the Services; to conduct business-to-business marketing and outreach to representatives of prospective customers; to run our internal operations; and to establish, exercise or defend legal claims. We balance these interests against your rights and freedoms before relying on this basis, and you may object to such processing as described in section 9.
- Your consent
- Where we ask for it for a specific purpose, such as sending you marketing communications where consent is required. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Where we store and transfer your information
We host and store personal information within the European Union and may access it from Israel, where we are registered. Access from Israel is a transfer outside the EEA and outside the United Kingdom. We rely on the European Commission’s adequacy decision for Israel in respect of personal information subject to the EU GDPR, to the extent that decision applies to the processing in question, and on the safeguards described below in respect of personal information subject to the UK GDPR.
Our production systems, databases, file storage, backups and AI processing all run in Google Cloud’s europe-west1 region in Belgium. The service providers we use are described in section 7.
Transfers outside the European Economic Area. In limited circumstances personal information may be transferred outside the EEA: when we file a VAT refund claim with a tax authority in a country outside the EEA, which is necessary for the establishment and exercise of your organization’s legal claim to a VAT refund (Article 49(1)(e) GDPR); and when we use internal business tools hosted in the United States for our own operations.
Where a transfer is made to a country the European Commission has not found to provide an adequate level of protection, we rely on one of the following. For personal information subject to the EU GDPR: an adequacy decision of the European Commission in respect of the destination country, or the Standard Contractual Clauses approved by the European Commission together with any additional measures identified by a transfer impact assessment. For personal information subject to the UK GDPR: UK adequacy regulations in respect of the destination country, or the International Data Transfer Agreement issued by the UK Information Commissioner, or the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, together with any additional measures identified by a transfer risk assessment (referred to in UK legislation as a “data protection test”).
Your rights
Where VATedge is the controller of your personal information, you have the rights set out below under the GDPR. These rights are not absolute and may be subject to conditions and exceptions under applicable law.
You may exercise any of them by emailing info@vatedge.com. We will respond within the timeframe required by applicable law, and we reserve the right to verify your identity before processing a request.
- Right of access
- You may ask us to confirm whether we process personal information about you, and to receive a copy of that information along with details of how and why it is processed. We will respond within one month of receipt, which may be extended by up to two further months where the request is complex.
- Right to rectification
- You may ask us to correct inaccurate or incomplete personal information we hold about you. We work to keep your information accurate and up to date, and will address correction requests promptly.
- Right to erasure
- In certain circumstances you may ask us to delete personal information we hold about you, for example where it is no longer necessary for the purposes it was collected for, where you have withdrawn consent, or where retention is not otherwise required by law.
- Right to data portability
- Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you may ask to receive your personal information in a structured, commonly used and machine-readable format, and to transmit it to another controller.
- Right to restriction of processing
- In certain circumstances you may ask us to restrict processing of your personal information, for example while the accuracy of the data is contested, or where processing is unlawful but you prefer restriction over deletion.
- Right to object
- Where we process your personal information on the basis of our legitimate interests, you may object to that processing. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, or where the processing is necessary for the establishment, exercise or defence of legal claims.
- Right to withdraw consent
- Where we rely on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.
- Right to lodge a complaint
- You may lodge a complaint with a data protection supervisory authority in an EU or EEA state. If you are in the United Kingdom, you may lodge a complaint with the Information Commissioner’s Office (ico.org.uk). Lodging a complaint does not affect any other remedy available to you, including your right to a judicial remedy.
Limitations. Not all rights apply in all jurisdictions, and some are subject to conditions and exceptions under applicable law. We may decline a request where we are unable to verify your identity; where the request would adversely affect the rights or freedoms of others; where we are required or permitted to retain the data under applicable law; or where fulfilling it would prevent us from providing a service you have requested.
Data we process as a processor. Where VATedge processes personal information on behalf of its customers as a data processor, we do not control that processing and cannot directly fulfil data subject requests relating to it. Please direct any such request, including access, correction or deletion, to the relevant VATedge customer, your organization, in the first instance.
Cookies and similar technologies
We may use certain monitoring and tracking technologies, including ones offered by third-party service providers, to maintain, provide and improve our Services and to give our users a better experience. These technologies let us keep track of user preferences and authenticated sessions, secure our Services by detecting abnormal behaviour, identify technical issues and improve performance, and create and monitor analytics.
A cookie is a small data file that is downloaded and stored on your computer or mobile device when you visit our Services. The cookies we use fall into the following categories.
- Strictly necessary cookies
- These enable core features of the Services, such as moving between pages, staying signed in, and remembering information you enter on forms. Without them the Services will not work as they should. Because they are strictly necessary to provide a service you have requested, they are exempt from the consent requirement in Article 5(3) of the ePrivacy Directive.
- Security cookies
- These help us identify and prevent security risks.
- Performance and analytics cookies
- These would collect information about how the Services are used and help us improve how they work. We do not set them today. If we introduce them, we will ask for your consent before doing so.
- Functionality and preference cookies
- These would remember choices you make, such as your preferred language, and provide personalized features. We do not set them today. If we introduce them, we will ask for your consent before doing so.
Managing cookies. Most browsers let you control cookies, including whether to accept them and how to remove them. You can set most browsers to notify you when you receive a cookie, or to block or remove cookies altogether; see the Help area of your browser for instructions. Because the cookies we currently set are strictly necessary, blocking or deleting them will prevent you from signing in and using the Services.
How we keep your information secure
We have implemented administrative, technical and organizational safeguards appropriate to the risk, as required by Article 32 of the GDPR. These include encryption in transit (TLS 1.2 or above) and at rest (AES-256), role-based access controls designed to restrict each user to their own organization’s data, rate limiting and abuse protection on our public endpoints, and audit logging of access and changes.
Despite these measures, VATedge cannot provide absolute information security or eliminate all risk associated with personal information, and security breaches may happen. If you have questions about security, contact us at info@vatedge.com.
How long we keep your information
We retain personal information only for as long as necessary for the purposes it was collected for. Security, audit and accountability records are retained as evidence of our compliance. Where we rely on your consent and you withdraw it, we will delete the relevant personal information unless we are required or permitted to retain it to comply with a legal obligation, or to establish, exercise or defend legal claims.
Children
To use our Services you must be over the age of eighteen. We do not knowingly collect personal information from individuals under eighteen and do not wish to do so. We reserve the right to request proof of age at any stage so we can verify that individuals under eighteen are not using the Services. If you believe we might hold information from or about someone under eighteen, contact us at info@vatedge.com.
Job candidates
We welcome qualified candidates to apply to any of the open positions posted on our Services by sending us their contact details and CV or resume (“Candidate Information”). Privacy and discreetness matter to our candidates, so we keep Candidate Information private and use it solely for our internal recruitment purposes, including identifying candidates, evaluating applications, making hiring and employment decisions, and contacting candidates by phone or in writing.
We may retain Candidate Information after the applied position has been filled or closed, so we can reconsider candidates for other suitable positions at VATedge, use it as a reference for future applications, and, where a candidate is hired, for further employment and business purposes related to their employment with us.
Direct marketing
Where you have given us your business contact details, we may contact you about our Services and related updates, relying on your consent or on our legitimate interest in business-to-business marketing. You may object to this or withdraw your consent at any time, at no cost, by emailing info@vatedge.com or by clicking the unsubscribe link in any email you receive from us.
Updates to this policy
This Privacy Policy may change from time to time at our discretion. The most current version will always be posted on our Services, and we revise the date at the top of this page when we update it. We may provide you with notices about this Privacy Policy using the email address you provided in connection with your account registration. By continuing to access and use our Services after an update becomes effective, you accept and agree to be bound by the updated Privacy Policy.
Governing law
This Privacy Policy, its interpretation, and any claims and disputes related to it are governed by the laws set out in our Terms of Service, without respect to conflict of law principles, and such claims and disputes shall be brought before the court of competent jurisdiction set out there.
Nothing in this section limits your rights under the EU GDPR or the UK GDPR, including your right to lodge a complaint with a supervisory authority or to bring proceedings in the courts of your country of residence, nor does it override any mandatory provision of the law of the country in which you are habitually resident.
How to contact us
To exercise any of the rights described in section 9, or for any other privacy question, email us at info@vatedge.com.
VATedge Ltd. · Tel Aviv, Israel · info@vatedge.com