This notice explains how VATcube Ltd handles personal data in VATcube Accounts and on accounts.vatcube.com. It is given under the General Data Protection Regulation (EU) 2016/679 and the Cyprus law that supplements it, Law 125(I)/2018.
Who is responsible
VATcube Ltd, Nicosia, Cyprus, registration (registration number), is the controller of the personal data described below. Contact: support@vatcube.com.
For the data a company enters in its own books (its clients, suppliers, employees, shareholders and so on), the company is the controller and we act as its processor, under section 9 of the terms of service. Requests about that data are best sent to the company itself; we help it answer them.
What we collect
- Account details: the names and email addresses of the people who sign in, their password (stored only as a secure hash), two-factor settings and preferences.
- Company and billing details: the company's name, VAT number, address and billing email, the plan and the invoices we issued.
- Payment details: cards are entered on a form provided by Stripe and go straight to Stripe. We never see or store the full card number; we keep only the card type and its last four digits.
- Security records: sign-ins, the IP address and browser used, and changes made, so that we and you can see who did what.
- Messages: what you write to us through the website or by email, and our replies.
- Website: if you leave your email to hear when sign-up opens, we keep it for that purpose only.
What companies keep in their books
As a processor we hold what each company enters: its clients and suppliers with their contact and bank details, invoices and payments, and, when the company runs payroll, its employees' names, identity card or passport numbers, tax identification and social insurance numbers, bank account numbers and salaries. These numbers are shown in full only on the employee's own record and on payslips and tax forms; lists show only their last digits. We use this data only to run the service for that company.
Why we use it, and on what basis
- To provide the service you signed up for and to charge for it: performance of the contract.
- To keep invoices and payment records as tax law requires: legal obligation.
- To keep the service and accounts secure and to prevent fraud: our legitimate interest.
- To send emails about your account, payments, the trial and changes to the service: performance of the contract.
We do not send marketing emails unless you asked for them, and we do not sell personal data.
Who receives it
We use a small number of service providers, each bound by a data processing agreement. The full list, with what each one does and where, is on the sub-processors page of this website. In short: - the hosting provider of our servers; - Stripe, for card payments and the subscription; - the email delivery service that sends our messages; - Mistral AI, which reads the invoices and receipts a company uploads or forwards, unless that company switches AI reading off; - Backblaze and Dropbox, which hold encrypted copies of the backups, when they are switched on. Some of them may process data outside the European Economic Area. Where they do, the transfer is covered by the European Commission's standard contractual clauses or an adequacy decision.
How long we keep it
- Account and company details: while the account is open and for 12 months after it ends.
- Invoices, receipts, payment records and the books a company keeps with us: as long as tax law requires, at least 6 years.
- Security records: 12 months.
- The log of emails sent, the waiting list and messages sent through the website: 24 months.
- Website sign-up records: 12 months.
Your rights
You can ask us to see the personal data we hold about you, correct it, delete it, restrict or object to its use, or receive it in a portable format. A signed-in user can download their own data and ask for their account to be closed on My security. Write to support@vatcube.com for anything else. You can also complain to the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy).
Cookies
We use only the cookies needed to sign in and keep the session secure: "acsess" holds the session and ends when the browser closes, and "actrust" remembers a browser you chose to trust for two-factor sign-in, for the days shown at the time. The browser also keeps, on your own device, how you arranged the columns of a table; it is never sent to us. The card form is provided by Stripe, which sets its own cookies to prevent fraud. Fonts and icons are served from our own server. We do not use advertising, analytics or tracking cookies, so we do not ask for consent to them.
Changes
We will post any change to this notice here and, if it matters for you, tell you by email.