Privacy policy
This is an English translation for convenience. The Spanish version prevails if there is any discrepancy.
1. Controller
The controller is TAX FACTORY, S.L., Spanish tax number B67123612, registered office at Calle Tenor Viñas, 14, Entresuelo 3.º, 08021 Barcelona, and tax office at Plaza de Terrassa Industrial, 4, floor 2, door 3, 08223 Terrassa.
Privacy questions and rights requests may be sent to guillem@taxfactory.es. TaxFactory has not appointed a data protection officer because it does not currently identify a mandatory case; this assessment will be revisited if processing or law changes.
2. Scope and data categories
This policy covers the website, contact requests and professional contracting. Automated contracting is limited to adults acting for a business or professional activity.
Depending on the service, TaxFactory may process:
- identity, professional, contact and representation details;
- tax, billing and business-address information;
- contract data, selected plan, and advanced-signature identity, acceptance and integrity evidence;
- payment and billing identifiers handled through Stripe, without TaxFactory receiving full card details;
- tax, accounting, banking, corporate, employment and Social Security documents required for the engagement;
- worker or other third-party data and strictly necessary special-category data for employment work;
- enquiries, files and communications sent by form, email, telephone or WhatsApp;
- IP address, browser, device, timestamps, anti-fraud identifiers and security logs;
- language preference stored locally and temporary contracting-access credentials held in
sessionStorage.
TaxFactory does not request a client’s digital certificate through the website.
3. Purposes and legal bases
| Purpose | Main legal basis |
|---|---|
| Answer enquiries and prepare proposals | Requested pre-contractual steps and consent where applicable |
| Contract, invoice and deliver services | Performance of the contract |
| File obligations and respond to authorities | Compliance with legal duties |
| Prevent fraud, secure the site and defend claims | Legitimate interests and legal compliance |
| Manage the advanced electronic signature and retain evidence | Contract performance and defense of rights |
| Send promotional information | Consent or another valid basis under the LSSI |
When TaxFactory processes third-party data on a client’s instructions, the client is the controller and TaxFactory is the processor. The data processing agreement applies. The client must have a legal basis for providing those data.
4. Contact and contracting
The contact form requests a name, email and message. A telephone number is requested during checkout or when the person provides it through another channel to manage the service. Unnecessary sensitive data should not be submitted. Cloudflare Turnstile processes technical signals to protect the form.
Contracting collects professional identity and, for companies, representative information. The sequence is review and acceptance, Stripe payment and, after payment, identity verification and an advanced electronic signature in the browser. Returning from Stripe does not itself activate a service.
5. Recipients and providers
Data is shared only on a valid basis and to the extent necessary. Recipients may include:
- tax, employment and other public authorities, registries and courts;
- Cloudflare for hosting, security, Turnstile, operational storage and contact-email delivery;
- Stripe for payments, subscriptions and billing portal;
- Holded and professional tools associated with the selected plan;
- Microsoft 365 and professional communications providers;
- e-Signature.eu to verify the signatory’s identity, manage the advanced electronic signature and generate its technical evidence;
- CARTO for office-map tiles and WhatsApp when that channel is selected;
- qualified professional collaborators, including Gabinete Gestor, S.L. (MLT Asesores), when specialist work requires them.
TaxFactory documents applicable processors and subprocessors. A provider change does not by itself expand the authorized purposes.
6. International transfers
Some providers may process data outside the European Economic Area. A transfer will require a valid safeguard such as an adequacy decision, applicable EU-US Data Privacy Framework participation or standard contractual clauses, with supplementary measures where needed.
7. Retention
Data is retained for its purpose and then for applicable legal and liability periods. Enquiries and unaccepted proposals are kept only for a proportionate period; contracts, signature evidence, invoices, tax, accounting, anti-money-laundering and employment records follow their statutory periods. Backups follow controlled deletion cycles and legally retained data is restricted.
8. Rights
You may request access, correction, deletion, objection, restriction, portability or withdrawal of consent at guillem@taxfactory.es. TaxFactory will respond within the legal period. A complaint may also be filed with the Spanish Data Protection Agency at aepd.es.
9. Security
TaxFactory applies risk-based access control, capability separation, encryption where appropriate, backups, technical logs, minimization, provider review and confidentiality commitments. No system is risk-free; incidents are handled under applicable law.
10. Changes
This policy will be updated when purposes, providers, technology or law changes. Questions: guillem@taxfactory.es.