In force since 18 September 2026.
If you request information or if you contract Verifacti as a Client to integrate it into your SIF with the services included in the contracted Plan, the Data Controller for your Personal Data is the company Bilbabit, S.L., with registered office at c/ Udaberría, 10 -4º B -48992 - Getxo (Bizkaia), duly registered in the Commercial Registry of Bizkaia, Section 8, Sheet BI-84418, and with tax identification number (NIF): B75777847. Hereinafter, BILBABIT.
You may contact BILBABIT directly and effectively in relation to this privacy policy at the email address: soporte@verifacti.com.
If you contract Verifacti as a Client (whether a free or paid plan), you must register as a Client by clicking on the registration button provided for this purpose on the Website and providing your data through any of the following options:
In any case, BILBABIT will have access to your IP address, and for the contracting of paid services, BILBABIT will ask you to provide your tax details (name or company name, tax address, tax identification number), as well as details relating to the payment method used, retaining, in the case of payment by credit/debit card, only the last four digits thereof.
Your data as a Client at Verifacti is collected to enable the provision of the contracted Verifacti service, to send notifications relating to the service, and to manage billing and payment.
BILBABIT may also process your data for the purpose of sending commercial communications about its services, provided you have not objected to this, either at the time of collecting your data or at any subsequent time.
We remind you that you have the right to object to the sending of commercial communications at any time.
The legal basis for the Processing of your data for the provision of the service, billing management, payment, and sending of service notifications is the performance of a contract or pre-contract to which you, as a Data Subject, are a party.
The legal basis for sending commercial communications about BILBABIT's services, if you have contracted any of its services, is the legitimate interest of BILBABIT for direct marketing purposes.
If you contact BILBABIT by email or through the contact form to request information, BILBABIT will have access to your IP address, the email address you use, and the data you provide through that communication.
If you request information through any of the means that Verifacti makes available to you (chat, forms, etc.), identifying data such as your name, telephone number, and/or email address will be collected for the purpose of attending to your request, on the basis of the legitimate interest of BILBABIT.
We will send you commercial communications only if you have given your informed, free, unambiguous, and specific consent for this purpose.
The legal basis for responding to any information request is the legitimate interest of BILBABIT in attending to such requests.
The legal basis for sending commercial communications is the provision of informed, free, specific, and unambiguous consent through a clear affirmative action, such as ticking a checkbox.
If you subscribe to the Verifacti Newsletter, BILBABIT will process the following personal data:
Sending communications with relevant information, promotions, offers, and news related to Verifacti.
The legal basis for the Processing is the consent given by the Data Subject.
In order for BILBABIT to generate and submit Invoicing Records to the competent Tax Administration on behalf of an End User, the latter must first grant the corresponding representation form. BILBABIT makes two alternative methods available for signing it:
The facial biometric template is considered a special category of data under Article 9 of the GDPR.
To reliably verify the identity of the person signing the representation form, to prevent identity theft and fraud, and to generate and retain the evidence attesting to the granting of the representation before the competent Tax Administration and before third parties.
The legal basis for processing the identification data and the evidence of the signing process is the performance of the contract or pre-contract to which the Data Subject is a party (Art. 6(1)(b) GDPR) and compliance with the legal obligations applicable to representation before the Tax Administration (Art. 6(1)(c) GDPR).
The legal basis for processing biometric data is the Data Subject's explicit consent (Art. 9(2)(a) GDPR), obtained in advance, on an informed and separate basis, by means of a clear affirmative action before the verification process begins.
That consent may be withdrawn at any time, without affecting the lawfulness of processing carried out beforehand. Giving consent to biometric processing is not a condition for accessing the service: anyone who does not wish to undergo biometric verification may sign the representation form using a digital certificate, at no additional cost and without any loss of functionality.
The verification process uses automated tools, including artificial intelligence, to analyse the identity document, extract and cross-check its data, carry out anti-fraud controls and compare the facial image against the photograph on the document. The result of that verification may mean that the signing process cannot be completed by that route.
In the event of anomalies, low-confidence results or a challenge by the Data Subject, the result will be reviewed by authorised BILBABIT personnel or an alternative signing flow will be activated. The Data Subject has the right to obtain human intervention, to express their point of view and to contest the decision, by writing to soporte@verifacti.com.
The identity verification and electronic signature process is carried out on behalf of BILBABIT and following its instructions by Ivnosys Soluciones, S.L.U. (Signaturit Group – A Namirial company), with registered office at calle Acceso Ademuz 12, 1º1 – 46980 Paterna (Valencia), NIF B-98333362, and by NAMIRIAL, S.p.A., with registered office at Via Caduti sul Lavoro 4, 60019 Senigallia (AN), Italy, with whom BILBABIT has entered into the corresponding data processing agreement in accordance with Article 28 of the GDPR.
The data are stored on infrastructure located within the European Economic Area. However, those processors may engage sub-processors carrying out support, monitoring or maintenance operations involving access to the data from outside the European Economic Area, in which case the transfer will take place with the safeguards provided for in Chapter V of the GDPR.
Biometric data are processed only for as long as necessary to complete the identity verification and are deleted, together with anything derived from them, once it has been completed.
The image of the identity document, the data extracted from it, the result of the verification and the evidence of the signing process are retained for as long as the representation remains in force and, after its revocation or expiry, for the limitation period of any actions and liabilities that may arise from the granting of the representation.
The Personal Data provided will be retained as long as there is a mutual interest in maintaining the purpose of the Processing and for the period during which legal liabilities may arise from the services provided to the Client as Data Subject.
When Processing is no longer necessary for the stated purposes, the Personal Data will be deleted using appropriate security measures.
A recipient is understood as any natural or legal person, public authority, agency, or other body to which personal data is disclosed, whether or not a third party.
Your data may be disclosed to the following categories of recipients: service providers acting as BILBABIT's data processors in accordance with section 5; the competent Tax Administration, where necessary for the provision of the service or for compliance with legal obligations; and financial institutions and payment service providers, for the management of collection.
Outside the above cases, your data will not be disclosed to any third party unless there is a legal obligation or you have given your express authorisation.
There are Data Processors, understood as entities that process personal data under the responsibility of BILBABIT, following its instructions, as providers of services necessary for the provision of the service requested by the Data Subject, with whom BILBABIT has entered into a data processing agreement in accordance with the applicable data protection regulations.
Those processors include, in particular, hosting and infrastructure providers, payment and invoicing service providers, communication and support tool providers, and the identity verification and electronic signature service providers indicated in section 2.4.5.
International data transfers involve a flow of personal data from Spanish territory to recipients established in countries outside the European Economic Area (the countries of the European Union plus Liechtenstein, Iceland, and Norway).
BILBABIT may carry out international data transfers to sub-processors established in the United States, but only to entities adhering to the Data Privacy Framework.
As a Data Subject, you are entitled to exercise the following rights recognised by data protection legislation, as provided therein:
You may exercise these rights by any means that provides proof of sending and receipt, clearly expressing your wishes in this regard and enclosing a copy of your national identity document and/or any other documentation proving your identity, addressed to the email or postal address indicated above.
Furthermore, if you consider that any of your data protection rights have been infringed, you are entitled to lodge a complaint with the Spanish Data Protection Agency (AEPD), located at C/ Jorge Juan, 6, 28001-Madrid https://www.aepd.es/ or through the electronic office of the AEPD: https://sedeagpd.gob.es/sede-electronica-web/.
In order to safeguard the security of the personal data of Data Subjects, BILBABIT has adopted all necessary technical and organisational measures to ensure the security of the personal data provided.
All of this is to prevent its alteration, loss, and/or unauthorised Processing or access, as required by the regulations, although absolute security does not exist.
To keep your personal data as a Data Subject up to date, you have the option of modifying or rectifying it through your Client Account at Verifacti or by contacting BILBABIT at the email address: soporte@verifacti.com.
Personal Data will be treated with the utmost care and confidentiality by all personnel involved in any phase of the Processing.
For the provision of the Verifacti services relating to the generation and submission of Invoicing Records to the Spanish Tax Agency (AEAT) and/or to the regional tax authorities, BILBABIT processes personal data of the End Users of the IIS (and, where applicable, of third parties whose data the Client enters through Verifacti) on behalf of the Client, in its capacity as Data Processor or, where applicable, as Sub-processor.
The conditions of such processing are set out in the Data Processing (or, where applicable, Sub-processing) Agreement (DPA) entered into between the Client and BILBABIT, the full content of which —including the determination of the role applicable in each case— is available at the following link: Data Processing Agreement (DPA).
Contracting Verifacti and the consequent acceptance of this Privacy Policy and of the Verifacti Terms and Conditions entail full and unreserved acceptance of the DPA in force at that time.
Should the Client wish to obtain an individually signed copy of the DPA, it may request one by sending an email to soporte@verifacti.com.