Privacy policy

The controller of personal data collected through app-verifactu.c2developers.com is:

• Company: C2Developers S.I.
• Tax ID (NIF): J71554372
• Registered office: Calle de la Cultura 5-7, 31010 Barañáin (Navarre, Spain)
• Contact e-mail: [email protected]

Data Protection Officer (DPO): BM GESTDATA, S.L. — ONTIDATA, Avda. Albaida 19, 46870 Ontinyent (Valencia). E-mail: [email protected].

Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights Guarantees (LOPDGDD).

We process the personal and tax data supplied by users and subscribed businesses for the following purposes and legal bases:

• Provision of the Verifactu service: submitting invoicing records of each issuer to the AEAT in compliance with Royal Decree 1007/2023 and the regulation governing Computerised Invoicing Systems (SIF). This involves processing of tax IDs, company names, amounts, dates and invoice series. Legal basis: legal obligation (Art. 6.1.c GDPR) and contract performance (Art. 6.1.b).
• Contract management: onboarding, billing, support and operational communications. Legal basis: contract performance.
• Accounting and tax compliance: retention of our own invoices and supporting documents. Legal basis: legal obligation.
• Handling enquiries: replying to requests sent to [email protected]. Legal basis: legitimate interest of the controller (Art. 6.1.f).

We do not carry out automated decision-making with legal effects on data subjects or any form of profiling.

Tax data (invoicing records, hashes, AEAT responses, audit events) is kept for four (4) years from the accrual date, in line with Article 66 of the Spanish General Tax Act and the limitation period for tax obligations.

User account data is kept while the contract is in force. After termination, it is blocked for the limitation period of any claims arising from the contract and is then erased using appropriate measures.

Data may be disclosed to:

• The Spanish Tax Agency (AEAT) and, where applicable due to regional tax regimes, the competent regional tax authorities, as legal recipients of the invoicing records.
• Infrastructure providers acting as processors (hosting, database, transactional e-mail) under a contract compliant with Art. 28 GDPR. All processing takes place within the European Economic Area.

No international data transfers outside the EEA take place. We do not sell or share data for marketing purposes.

You may exercise the following rights at any time:

• Access, rectification and erasure.
• Restriction of processing and objection.
• Data portability.
• Withdrawal of consent, where applicable, without retroactive effect.
• Lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe the processing does not comply with the law.

To exercise these rights, write to [email protected] or to the DPO at [email protected], providing sufficient identification. We will respond within the legal deadline.

Fields marked as required in the sign-up forms and in API calls are necessary to provide the service. Without them, valid records cannot be submitted to the AEAT and an operational account cannot be maintained. The user warrants that the data supplied is accurate and undertakes to keep it up to date.

We apply appropriate technical and organisational measures to preserve the confidentiality, integrity and availability of information: encryption in transit (HTTPS/TLS) and at rest, access control via API keys stored as hashes, tamper-evident audit logs, regular backups and logical multi-tenant separation. The FNMT certificates used to sign submissions to the AEAT are kept in encrypted storage with restricted access.