Verifacti Privacy Policy

Preliminary. Definitions:

Personal Data: means any information relating to an identified or identifiable natural person.

Data Subject: a natural person who can be identified, directly or indirectly, by reference to a location, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

Processing: means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means.

Data Controller: means the party that determines the purposes and means for the Processing of Personal Data.

Data Processor: means the party that processes Personal Data on behalf of a Data Controller following its instructions.

Verifacti: a software solution designed to facilitate the adaptation of an Invoicing Computer System (SIF) to the VeriFactu system of the Spanish Tax Administration Agency (AEAT) and/or the TicketBai system of the regional tax agencies of the Basque Country and Navarra, based on REST API technology that enables communication between computer systems over the Internet using the HTTP protocol, following the principles of the REST (Representational State Transfer) architectural style. BILBABIT reserves the right to modify the name "Verifacti" at any time, without this entailing any modification of its functionalities.

Invoicing Computer System or SIF: software, application, or computer program owned and/or developed by the Client for invoice management that it markets to its clients or End Users, as well as that used by the Client to issue its own invoices.

End User(s): client(s) of the Client who have contracted a licence for the Invoicing Computer System as taxpayers, or the Client itself if it uses the SIF to issue its own invoices, whose tax identification number (NIF) will be communicated to BILBABIT for the use of Verifacti through the SIF.

Plan(s): a pre-established set of functionalities and/or services of Verifacti that the Client may contract according to the price and other associated conditions.

BILBABIT: the company that owns Verifacti, whose full details are set out below.

Client: a professional or company that contracts Verifacti.

Processed Data: Personal Data under the responsibility of the Data Controller that BILBABIT may process to provide the services included in the Verifacti Plan contracted by the Data Controller.

1. Information about BILBABIT as Data Controller

If you request information or if you contract Verifacti as a Client to integrate it into your SIF with the services included in the contracted Plan, the Data Controller for your Personal Data is the company Bilbabit, S.L., with registered office at c/ Udaberría, 10 -4º B -48992 - Getxo (Bizkaia), duly registered in the Commercial Registry of Bizkaia, Section 8, Sheet BI-84418, and with tax identification number (NIF): B75777847. Hereinafter, BILBABIT.

You may contact BILBABIT directly and effectively in relation to this privacy policy at the email address: info@verifacti.com.

2. Processing of Personal Data by BILBABIT as Data Controller, purpose, and legal basis

2.1. In connection with contracting Verifacti as a Client

2.1.1. Personal Data Processed

If you contract Verifacti as a Client (whether a free or paid plan), you must register as a Client by clicking on the registration button provided for this purpose on the Website and providing your data through any of the following options:

• Registration with email: through the registration form, BILBABIT requests your email address and asks you to set a password, which will be stored in encrypted form and will serve as your access credentials for Verifacti.
• Registration via Google social login: in this case, you must log in to Google and accept the permissions that you grant to BILBABIT through the Google platform, which will allow Google to provide BILBABIT with your email address, your profile picture, and your name, along with a Unique Identifier associated with your Client profile.

In any case, BILBABIT will have access to your IP address, and for the contracting of paid services, BILBABIT will ask you to provide your tax details (name or company name, tax address, tax identification number), as well as details relating to the payment method used, retaining, in the case of payment by credit/debit card, only the last four digits thereof.

2.1.2. Purpose

Your data as a Client at Verifacti is collected to enable the provision of the contracted Verifacti service, to send notifications relating to the service, and to manage billing and payment.

BILBABIT may also process your data for the purpose of sending commercial communications about its services, provided you have not objected to this, either at the time of collecting your data or at any subsequent time.

We remind you that you have the right to object to the sending of commercial communications at any time.

2.1.3. Legal basis

The legal basis for the Processing of your data for the provision of the service, billing management, payment, and sending of service notifications is the performance of a contract or pre-contract to which you, as a Data Subject, are a party.

The legal basis for sending commercial communications about BILBABIT's services, if you have contracted any of its services, is the legitimate interest of BILBABIT for direct marketing purposes.

2.2. In connection with information requests through contact forms

2.2.1. Personal Data Processed

If you contact BILBABIT by email or through the contact form to request information, BILBABIT will have access to your IP address, the email address you use, and the data you provide through that communication.

2.2.2. Purpose

If you request information through any of the means that Verifacti makes available to you (chat, forms, etc.), identifying data such as your name, telephone number, and/or email address will be collected for the purpose of attending to your request, on the basis of the legitimate interest of BILBABIT.

We will send you commercial communications only if you have given your informed, free, unambiguous, and specific consent for this purpose.

2.2.3. Legal basis

The legal basis for responding to any information request is the legitimate interest of BILBABIT in attending to such requests.

The legal basis for sending commercial communications is the provision of informed, free, specific, and unambiguous consent through a clear affirmative action, such as ticking a checkbox.

2.3. In connection with subscribing to the Verifacti Newsletter

2.3.1. Personal Data Processed

If you subscribe to the Verifacti Newsletter, BILBABIT will process the following personal data:

• Name or nickname provided by the Data Subject.
• IP address.
• Email address.

2.3.2. Purpose

Sending communications with relevant information, promotions, offers, and news related to Verifacti.

2.3.3. Legal basis

The legal basis for the Processing is the consent given by the Data Subject.

3. Retention period for Personal Data

The Personal Data provided will be retained as long as there is a mutual interest in maintaining the purpose of the Processing and for the period during which legal liabilities may arise from the services provided to the Client as Data Subject.

When Processing is no longer necessary for the stated purposes, the Personal Data will be deleted using appropriate security measures.

4. Recipients

A recipient is understood as any natural or legal person, public authority, agency, or other body to which personal data is disclosed, whether or not a third party.

Your data will not be disclosed to any third party other than BILBABIT, unless there is a legal obligation or you have given your express authorisation.

5. Data Processors

There are Data Processors, understood as entities that process personal data under the responsibility of BILBABIT, following its instructions, as providers of services necessary for the provision of the service requested by the Data Subject, with whom BILBABIT has entered into a data processing agreement in accordance with the applicable data protection regulations.

6. International Transfers

International data transfers involve a flow of personal data from Spanish territory to recipients established in countries outside the European Economic Area (the countries of the European Union plus Liechtenstein, Iceland, and Norway).

BILBABIT may carry out international data transfers to sub-processors established in the United States, but only to entities adhering to the Data Privacy Framework.

7. Rights

As a Data Subject, you are entitled to exercise the following rights recognised by data protection legislation, as provided therein:

• Right to withdraw at any time the consent given for the Processing of such data, when that is the legal basis.
• Right of access to the personal data processed by BILBABIT.
• Right to request the rectification of inaccurate data processed by BILBABIT.
• Right to request the erasure of data when, among other reasons, the data is no longer necessary for the purposes for which it was collected by BILBABIT.
• In certain circumstances, you may request the restriction of Processing of the data, in which case BILBABIT will only retain them for the exercise or defence of claims.
• In certain circumstances and for reasons related to your particular situation as a Data Subject, you may exercise the right to object to the Processing of the data. In that case, BILBABIT will cease to process the data, except for compelling legitimate grounds, or for the exercise or defence of possible claims.
• In certain circumstances and for reasons related to your particular situation as a Data Subject, you may request the right to data portability. This is a right complementary to the right of access, as it allows you to obtain the data you have provided to BILBABIT in a structured, commonly used, and machine-readable format, which may be transmitted directly to another entity at the request of the Data Subject. You may exercise these rights by any means that provides proof of sending and receipt, clearly expressing your wishes in this regard and enclosing a copy of your national identity document and/or any other documentation proving your identity, addressed to the email or postal address indicated above.

Furthermore, if you consider that any of your data protection rights have been infringed, you are entitled to lodge a complaint with the Spanish Data Protection Agency (AEPD), located at C/ Jorge Juan, 6, 28001-Madrid https://www.aepd.es/ or through the electronic office of the AEPD: https://sedeagpd.gob.es/sede-electronica-web/.

8. Security

In order to safeguard the security of the personal data of Data Subjects, BILBABIT has adopted all necessary technical and organisational measures to ensure the security of the personal data provided.

All of this is to prevent its alteration, loss, and/or unauthorised Processing or access, as required by the regulations, although absolute security does not exist.

9. Updating personal data

To keep your personal data as a Data Subject up to date, you have the option of modifying or rectifying it through your Client Account at Verifacti or by contacting BILBABIT at the email address: soporte@verifacti.com.

10. Confidentiality

Personal Data will be treated with the utmost care and confidentiality by all personnel involved in any phase of the Processing.

1. Purpose and duration of processing

By contracting the services of BILBABIT, the Data Controller authorises BILBABIT to process on its behalf the personal data necessary to provide the contracted services.

The processing of the Processed Data will take place for as long as the service contract with the Client remains in force.

2. Nature and purpose of the processing

The processing of data by BILBABIT as Data Processor will be carried out at its own facilities using its own digital means and systems. The nature of the processing of the Processed Data is automated and consists of storing and accessing personal data.

The purpose of the Processing of the Data by the Data Processor on behalf of the Data Controller is exclusively the provision of the services contracted by the Data Controller.

3. Identification of the information concerned. Categories of Data Subjects and types of data

For these purposes, the categories of Data Subjects and the types of data that may be processed by BILBABIT in its capacity as Data Processor are detailed below:

4. Obligations and rights of the Data Controller

The duty to inform the Data Subject of the processing shall be the sole responsibility of the Data Controller.

The Data Controller guarantees that the data provided to the Processor has been obtained lawfully and that it is adequate, relevant, and limited to the purposes of the processing.

The Data Controller shall make available to the Processor all the information necessary for the provision of the services.

5. Obligations and rights of the Data Processor

BILBABIT undertakes to comply with all obligations incumbent upon it as Data Processor in accordance with current legislation and any other applicable provision or regulation.

BILBABIT shall not use or apply the Processed Data for purposes other than the provision of the contracted service.

The Data Processor shall make available to the Data Controller the information necessary to demonstrate compliance with the data processing agreement, allowing the inspections and audits necessary to evaluate the processing.

6. Personnel authorised to carry out the processing

BILBABIT guarantees that the persons authorised to process the Processed Data have expressly committed in writing to respect the confidentiality of the data and are subject to a legal obligation of confidentiality.

BILBABIT shall take measures to ensure that any person acting under its authority and having access to personal data can only process them in accordance with the instructions of the Data Controller and is obliged to do so under current legislation.

BILBABIT guarantees that the persons authorised to process the data have received the necessary training to ensure that the protection of personal data is not put at risk.

7. Security measures

BILBABIT declares that it is up to date with the obligations arising from data protection regulations, especially with regard to the implementation of security measures for the different categories of data and processing established in Article 32 of the GDPR.

BILBABIT guarantees that these security measures will be properly implemented and will help the Data Controller to comply with the obligations established in the GDPR, taking into account the nature of the processing and the information available to the Data Processor.

The Data Controller shall carry out an analysis of the possible risks arising from the processing to determine the appropriate security measures to ensure the security of the processed information and the rights of the Data Subject and, if the Data Controller determines that risks exist, shall send the Processor a report with the impact assessment so that the Data Processor can proceed to implement the appropriate measures to prevent or mitigate the risks.

BILBABIT shall analyse the possible risks and other circumstances that may have an impact on security and that may be attributable to it and, where applicable, shall inform the Data Controller to assess its impact.

8. Security breaches

Security breaches of which the Data Processor becomes aware shall be notified without undue delay to the Data Controller for its knowledge and the application of measures to remedy and mitigate the effects caused.

The notification of a possible security breach shall contain at least the following information:

• Description of the nature of the security breach.
• Categories and approximate number of Data Subjects affected.
• Categories and approximate number of data records affected.
• Possible consequences.
• Measures taken or proposed to remedy or mitigate the effects.
• Contact details where further information can be obtained.

9. Disclosure of data to third parties

The Data Processor may not disclose data to other recipients unless it has previously obtained the written authorisation of the Data Controller, which, if it exists, shall be attached to this agreement.

The transmission of data to public authorities in the exercise of their public service does not require the authorisation of the Data Controller if such transmissions are necessary to achieve the purpose of the processing.

10. Sub-processors

BILBABIT undertakes to fully comply with the applicable Data Protection Laws with regard to the engagement of Sub-processors, including the conditions referred to in Article 28 of the GDPR, where applicable.

BILBABIT shall have general authorisation for the engagement of the following sub-processors currently in use:

BILBABIT shall specifically inform the Data Controller in writing of any change it intends to make to the list, whether by adding to it or replacing a Sub-processor, with a minimum of 30 days' notice, thereby giving the Data Controller sufficient time to object to such changes before the engagement of the Sub-processor(s) in question.

BILBABIT shall provide the Data Controller with the information necessary for the Data Controller to exercise its right of objection. If the Data Controller does not object within the aforementioned 30-day period, authorisation to appoint the Sub-processor shall be deemed to have been granted.

BILBABIT shall observe, where applicable, the implementation of appropriate safeguards, including, but not limited to, the use of Standard Contractual Clauses (SCCs) and/or other applicable measures.

BILBABIT must include in any agreement with Sub-processors receiving Confidential Information a provision whereby the Sub-processor shall be subject to the same obligations of confidentiality, data protection, and data security to which the Processor is bound under the Agreement and this DPA.

In any case, BILBABIT shall remain fully liable for any negligence and/or damage caused to the Data Controller and/or its Processed Data and for any breach of Data Protection Laws or the rights of Data Subjects by its Sub-processors.

11. International Data Transfers

BILBABIT provides its services through servers located in European territory, so there is no international transfer of Processed Data.

Notwithstanding the foregoing, if the Processor intends to process the Processed Data outside the territory of the European Economic Area (EEA), including through the use of Sub-processors or to transfer data to any third country or international organisation without an adequacy decision in accordance with Article 45(3) GDPR, or any other existing legal requirement/limitation under applicable data protection laws regarding transfers of personal data, BILBABIT shall only do so subject to the prior written approval of the Data Controller and subject to the implementation of appropriate safeguards, including, but not limited to, the use of Standard Contractual Clauses (SCCs), which shall apply automatically where necessary, and/or other applicable measures, to ensure sufficient safeguards for compliance with such requirements and any applicable data protection laws.

12. Rights of the Data Subject

BILBABIT shall, whenever possible, and taking into account the nature of the processing, create the necessary technical and organisational conditions to assist the Data Controller in its obligation to respond to requests regarding Data Subject rights.

In the event that the Processor receives a request for the exercise of such rights, it shall notify the Data Controller immediately, and in no case later than the business day following receipt of the request, along with any other information that may be relevant to the resolution of the request.

13. Liability

In accordance with Article 82 of the GDPR, the Data Controller shall be liable for damages caused by any processing operation in which it participates that does not comply with the provisions of the GDPR, and only the Data Processor shall be liable for damages and losses caused by processing where it has not complied with the obligations of the GDPR specifically directed at the Data Processor or has acted outside or contrary to the lawful instructions of the Data Controller.

Likewise, the Data Processor shall be exempt from liability if it can prove that it was in no way responsible for the event giving rise to the damage.

14. Termination of the provision of services

Once the contracted services have ended for any reason, if the Data Processor has stored personal data, or any other document and/or medium provided to it by any means, it shall return or delete them, at the discretion of the Data Controller, including any existing copies.

Data shall not be deleted when its retention is required by a legal obligation, in which case the Data Processor shall continue to store it, blocking the data and limiting its processing to the extent that liabilities may arise from its relationship with the Data Controller.

The Data Processor shall maintain the obligation of secrecy and confidentiality of the data even after the conclusion of the service relationship.

15. Obtaining a copy of the DPA

In the event that the Client wishes to obtain a signed copy of the Data Processing Agreement (DPA), it may request it by sending an email to soporte@verifacti.com.