Privacy Policy
This Privacy Policy explains how personal data is handled when you visit VATcodex. It is provided in accordance with Regulation (EU) 2016/679 (“GDPR”) and Spanish Organic Law 3/2018 (LOPDGDD).
In short: searching and reading need no account, involve no tracking of any kind, and the search itself runs inside your browser: your queries are not sent anywhere. There is no advertising and no analytics, and no profile is built about you. If you create an account to take part in the discussion, the address you sign in with is never shown to anyone and is never used to sell you anything. Accounts and posts are stored in the European Union. One thing does leave: the text of a post is sent to an automated screening service the moment it is published, and section 4 says to whom and why.
1. Data controller
The Operator, established in Spain, acting in a personal capacity. Contact for data protection matters: contact. No Data Protection Officer has been appointed, as the processing does not meet the criteria set out in Article 37 GDPR.
2. What data is processed, why, and on what legal basis
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| IP address and standard request metadata (browser type, page requested, timestamp), logged by the hosting provider | Delivering the website, security, abuse prevention and fault diagnosis | Legitimate interest (Article 6(1)(f) of Regulation (EU) 2016/679) in operating a secure, functioning website | As retained by the hosting provider for operational logs (short term) |
| IP address and request metadata received by the providers of the search model and the software library (section 4) | Technically necessary to deliver those resources to your browser | Legitimate interest (Article 6(1)(f) of Regulation (EU) 2016/679) in providing a working search function | As retained by those providers |
| Email address and password, if you create an account. The password is stored only as a cryptographic hash and is never visible to the Operator | Creating and securing your account, confirming the address is yours, letting you reset a lost password | Performance of the terms you accept when you register (Article 6(1)(b) of Regulation (EU) 2016/679) | Until you delete your account |
| Profile: display name (required); organisation, professional headline, LinkedIn address and a public contact detail (all optional, all shown publicly if you fill them in) | Attributing your posts, so that a reader can weigh who is speaking | Performance of the terms (Article 6(1)(b) of Regulation (EU) 2016/679); the optional fields are published because you choose to publish them | Until you delete or clear them |
| Posts: the text, the case or article it is attached to, the category, the Member State you tag it with, the date, and whether a question is marked answered | Publishing the discussion | Performance of the terms (Article 6(1)(b) of Regulation (EU) 2016/679) | Until you delete the post or the account. On account deletion you choose between erasing your posts and anonymising them so replies by others are not broken |
| Likes you give to posts | Showing how many people found a post useful | Performance of the terms (Article 6(1)(b) of Regulation (EU) 2016/679) | Until withdrawn or the account is deleted. Who liked what is never public: you can only see your own |
| Reports you submit about a post, and your identity as the reporter | Handling notices about illegal or infringing content | Legal obligation (Article 6(1)(c) of Regulation (EU) 2016/679) under Regulation (EU) 2022/2065, and legitimate interest in a usable forum | As long as needed to handle the report and any complaint about the outcome |
| The text of your post, sent for automated screening, and the resulting classification | Detecting and removing unacceptable content before it stays up | Legitimate interest (Article 6(1)(f) of Regulation (EU) 2016/679) in keeping a professional forum usable and lawful | The classification is kept with the post; see section 4 for the provider’s own retention |
3. What is not done
No cookies for analytics, advertising or tracking. No web analytics of any kind. No advertising, ever. No profiling, and no automated decision-making producing legal effects or similarly significant effects on you within the meaning of Article 22 GDPR. No sale, rental or commercial sharing of personal data, ever, to anyone. Your searches are executed in your browser and are not transmitted to the Operator or to anyone else.
The typefaces are served from this site itself, so no font provider is contacted.
4. Recipients and processors
The Service uses the following providers. Each acts as a processor on the Operator’s instructions, or, for the resources your browser fetches directly, receives your IP address because that is unavoidable when a browser requests a file.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Netlify | Hosting of the website | IP address and request metadata | Global content delivery network; transfers covered by Standard Contractual Clauses |
| Supabase | Database and authentication: accounts, profiles, posts, likes and reports | Everything in the account rows of section 2 | European Union, the project region |
| Anthropic | Automated screening of posts. When you publish, the text of the post is sent to its interface so that a language model can classify it | The text of the post. Not your email address, not your name, not your IP address | United States; transfers covered by Standard Contractual Clauses. The provider states that content submitted through its business interfaces is not used to train its models |
| jsDelivr | Delivers the software library that runs the semantic search in your browser | IP address and request metadata | Global content delivery network |
| Hugging Face | Delivers the search model itself, the first time you use semantic search. The download is redirected to its own content delivery network | IP address and request metadata | Global content delivery network |
Nothing else receives personal data. There is no advertising network, no analytics provider and no data broker involved at any point.
5. International transfers
Accounts and posts are stored in the European Union. Two categories of data leave it: the text of a post, sent to the screening provider in the United States; and the IP address seen by the content delivery networks that serve the site and the search model. Those transfers rely on the European Commission’s Standard Contractual Clauses. If you would rather no post of yours were processed outside the Union, the way to achieve that is not to post.
6. Automated screening, and what it does not decide
Every post is classified automatically when published, and a post found clearly unacceptable is taken down at once. This is a decision about a piece of text, not an evaluation of you, and it produces no legal effect on you. If a post of yours is removed and you disagree, write to the contact address: the decision will be reviewed by a human being, and this is the internal complaint route referred to in the Terms.
7. Your rights
You may exercise the rights of access, rectification, erasure, restriction, objection and portability, and you may withdraw a consent at any time without affecting the lawfulness of prior processing. Several of them do not need a request at all:
- Rectification and erasure of your profile: edit or clear any field on the account page.
- Erasure of your account: one click on the account page. You choose whether your posts are deleted outright or anonymised.
- Erasure of a single post: delete it yourself from the thread.
- Objection to the notification emails: switch them off in your profile, or use the unsubscribe link in any of them.
For anything else, write to contact. You also have the right to lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos, or with the authority of your own country of residence.
8. Emails
Two kinds of email are sent, and no others. Account mail: confirming your address, and resetting a password. Activity mail: optional, chosen by you in your profile, for example when somebody replies to your post; every one carries a one-click unsubscribe link. There is no newsletter, no marketing and no commercial mail of any kind, and your address is never passed to anyone.
9. Security
The site is served over HTTPS only. Access to the data is governed by rules enforced by the database itself rather than by the interface, so that manipulating the browser does not widen what an account can read or change. Passwords are stored only as cryptographic hashes. The sign-in address is never exposed through the public interface, to any user, at any time.
10. Children
The Service is aimed at tax and legal professionals and is not directed at children. Accounts are not knowingly created for anyone under 14, the age set by Spanish law for consent to information society services.
11. Changes to this policy
This policy may be updated. The version in force is the one published on this page, with the date and version shown above. Where a change materially affects people with accounts, it will be signalled in the interface rather than made quietly.