Updated 1 September 2026
Privacy Policy
- Introduction
VAT4U GmbH develops AI-powered VAT automation software and provides managed VAT compliance services to customers across Europe and beyond. This Privacy Policy explains how we collect and use personal data in connection with those activities, including through our websites, platform, events, marketing activities, customer relationships and other business interactions. It does not govern processing carried out by third parties that VAT4U does not control.
In this Policy, „Platform“ refers to the VAT4U SaaS application and „Website“ refers to vat4u.com and its subdomains. Our contact details and those of our Data Protection Officer are in Section 2. To exercise your rights, see Section 9.
- Controller and Data Protection Officer
The data controller responsible for the processing described in this Policy is:
VAT4U GmbH
Kreuzstraße 34, 40210 Düsseldorf, Germany
privacy@vat4u.com | +49 (0)211 5455650
We have appointed a Data Protection Officer:
Dr. Völkel und Partner mbB Rechtsanwalt Steuerberater
Kreuzstraße 34, 40210 Düsseldorf, Germany
privacy@vat4u.com (marked „FAO: Data Protection Officer“)
- VAT4U as Controller, Processor and Independent Controller
VAT4U acts as controller for the processing described in Section 4. For Customer Data processed through the Platform, VAT4U generally acts as processor under the Customer DPA. „Customer Data“ means personal data submitted to, generated in, or otherwise processed through the Platform by or on behalf of a Customer. This Policy does not apply to Customer Data except where VAT4U processes limited Platform-level data for its own purposes – specifically security monitoring, audit logging, abuse prevention and compliance with VAT4U“s own legal obligations – which is also covered here.
Individuals whose personal data is processed as Customer Data should contact the relevant Customer in the first instance. The applicable DPA and current subprocessor list are available at https://trust.vat4u.com.
- Processing Activities
The table below sets out our processing activities as a controller, with applicable legal bases and retention periods.
Processing activity | Categories of personal data | Purpose | Legal basis | Retention |
Website and Platform security | IP addresses (minimised), server and application logs, device identifiers. | Secure operation of the Website and Platform; detection of and response to security incidents. | Art. 6(1)(f) GDPR – legitimate interests in information security. | Access logs: 7 days. |
Business communications and CRM | Business contact details, company information, correspondence, marketing preferences. | Responding to enquiries; meeting scheduling; managing business relationships; marketing communications where consented; account management. | Art. 6(1)(b) – pre-contractual and contractual steps. | Duration of business relationship. |
Sales prospecting | Name, role, employer, professional contact details, and publicly available professional information sourced from LinkedIn and business intelligence providers. | Identifying and contacting prospective Customers; B2B business development. | Art. 6(1)(f) – legitimate interests in B2B sales and business development. | 3 years from last meaningful interaction. |
Video conferencing and telephone | Participant names and contact details, call and meeting metadata. Recordings where participants are notified in advance. | Sales calls, product demonstrations, customer support and general business communications via Microsoft Teams and cloud telephony (Placetel). | Art. 6(1)(b) – pre-contractual and contractual steps. | Metadata: 12 months. |
Platform accounts and operations | Account details, user identifiers, access rights, authentication events and access logs. | Account provisioning; service delivery; Platform security; abuse prevention. | Art. 6(1)(b) – contract performance. | Duration of subscription. |
Billing and contract administration | Billing contact details, payment information, invoices, contracts, tax and accounting records. | Invoicing and payment; contract administration; tax and statutory compliance; management of claims. | Art. 6(1)(b) – contract. | 10 years from the end of the relevant financial year. |
Customer support | Contact details, support ticket content and history, technical diagnostics. | Delivering support services; resolving technical issues; service improvement. | Art. 6(1)(b) – contract. | 3 years from closure of matter. |
Website analytics and consent management | Cookie identifiers, consent records, device and browser data, page views, referrer data. | Recording and managing consent preferences; Website performance analytics. | §25(2) TDDDG and Art. 6(1)(f) – strictly necessary technologies. | As described in the Cookie Notice. |
Online advertising and LinkedIn Company Page | Browser and advertising identifiers, conversion events (advertising); aggregated engagement data (LinkedIn Company Page). | Advertising attribution and retargeting (subject to consent); Company Page analytics under joint controllership with LinkedIn – see Section 6. | §25(1) TDDDG and Art. 6(1)(a) – advertising (consent required). | Advertising identifiers: deleted within 13 months of collection, or on consent withdrawal. |
Social media, networking and recruitment | Profile information, messages, comments, professional history; CV and application materials. | Business communications; content publishing; professional networking; recruitment and management of applications via the VAT4U careers page. | Art. 6(1)(f) – networking and marketing. | Social media and networking data: retained for as long as needed for the relevant interaction, subject to applicable platform retention settings. |
Lead scoring: We use engagement data to prioritise sales outreach through automated lead scoring. This processing is used only to inform the order and timing of outreach and does not produce legal or similarly significant effects for individuals. You may object at any time under Article 21(1) GDPR by contacting privacy@vat4u.com.
Third-party sourced data: Where we source personal data from LinkedIn or business intelligence providers rather than from you directly, we provide this Policy within the applicable statutory period and, where the data is used to contact you, no later than our first communication, in accordance with Article 14 GDPR.
Consequences of not providing personal data: Where we request personal data that is necessary to enter into or perform a contract with you (for example, contact details required to provide our services or to issue an invoice), we indicate this at the point of collection. Failure to provide such data may mean we are unable to conclude or perform the contract. Where we are required by law to collect personal data – for example, billing contact details required for statutory financial and tax records – failure to provide that data may prevent us from fulfilling our legal obligations. Where data is collected on an optional basis, there is no consequence for declining to provide it.
- Cookies
We use cookies and similar technologies on our Website. Strictly necessary cookies are deployed to enable Website functionality and to record consent preferences. All other cookies – including analytics and advertising technologies – are activated only after you have provided consent through our consent management platform (Complianz).
You may review, update or withdraw your consent at any time through the cookie settings on our Website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Our Cookie Notice describes each technology, its provider, purpose, storage duration and legal basis, and is available at https://vat4u.com/en/cookie-notice/.
- Sharing Personal Data
We share personal data with three categories of recipient: (i) service providers that process personal data on our instructions under Article 28 GDPR agreements (where VAT4U acts as processor for Customer Data, the relevant subprocessors are addressed separately in the applicable DPA and subprocessor list at https://trust.vat4u.com/subprocessors); (ii) independent controllers – such as professional advisers and public authorities – that receive data and determine their own purposes and means; and (iii) joint controllers, as described under LinkedIn below. We do not sell personal data.
Current categories of service provider include:
■ Hosting, infrastructure and cloud service providers;
■ CRM, marketing automation and email service providers;
■ Video conferencing and cloud telephony providers;
■ Analytics, consent management and tag management providers;
■ Online advertising and conversion tracking providers (subject to consent);
■ Customer support platform providers;
■ HR and recruitment platform providers;
■ Payment, billing and accounting providers;
■ Professional advisers, including legal counsel and auditors;
■ Public authorities, courts and regulatory bodies where required by law.
The LinkedIn Insight Tag is used only with your consent for advertising measurement and retargeting. For LinkedIn Page Insights, VAT4U and LinkedIn Ireland Unlimited Company act as joint controllers under LinkedIn“s Pages Joint Controller Addendum (https://legal.linkedin.com/pages-joint-controller-addendum). LinkedIn is primarily responsible for member disclosures and rights handling. VAT4U receives Page Insights information in aggregated form and does not receive information that directly identifies individual LinkedIn members through Page Insights. You may exercise your rights in relation to this processing against either joint controller: contact VAT4U at privacy@vat4u.com or LinkedIn through its privacy settings.
- International Transfers
VAT4U is established in Germany and our core infrastructure is located within the European Economic Area. Some service providers operate in countries outside the EEA, and certain support and engineering personnel may access systems – including systems containing personal data – remotely from outside the EEA. Such remote access constitutes a transfer under Chapter V GDPR and is subject to the same safeguards described below. We transfer personal data to third countries only where an appropriate safeguard is in place.
Where the European Commission has recognised a destination country or framework as providing an adequate level of protection, we rely on that adequacy decision. For transfers to US organisations certified under the EU–US Data Privacy Framework, we verify certification status before relying on it. For transfers to countries without an adequacy decision, we use the European Commission“s standard contractual clauses, supplemented where required by transfer impact assessments and additional technical or organisational safeguards. Copies of applicable clauses are available on request at privacy@vat4u.com.
We review our transfer mechanisms regularly and update them in response to changes in applicable law or provider circumstances.
- Retention
We retain personal data for as long as necessary for the purposes described in this Policy. Specific retention periods or criteria are set out in Section 4. We may retain data for longer where required by law or necessary to establish, exercise or defend legal claims.
- Your Rights
You have the following rights in relation to your personal data, subject to the conditions and limitations in applicable law:
Right | What this means | How to exercise |
Access | Obtain confirmation of whether we process your personal data and receive a copy. | Contact privacy@vat4u.com |
Rectification | Have inaccurate or incomplete personal data corrected. | Contact privacy@vat4u.com |
Erasure | Request deletion of your personal data where the legal conditions are met. Statutory retention obligations may prevent immediate deletion in some cases. | Contact privacy@vat4u.com |
Restriction | Request that we limit our processing in defined circumstances. | Contact privacy@vat4u.com |
Portability | Receive personal data you have provided to us in a structured, machine-readable format where processing is based on consent or contract. | Contact privacy@vat4u.com |
Object | Object at any time to processing based on legitimate interests, including automated lead scoring. We will cease processing unless we can demonstrate compelling legitimate grounds. | Contact privacy@vat4u.com |
Withdraw consent | Withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing. | Cookies: use the consent banner on our Website. |
Object to direct marketing | Object to processing for direct marketing purposes. This right is unconditional. | Click Unsubscribe in any marketing email, or contact privacy@vat4u.com |
Complaint | Lodge a complaint with a supervisory authority without prejudice to any other remedy. | See Section 12 |
To exercise any of these rights, contact us at privacy@vat4u.com. We respond within the timeframes required by applicable law. Where we are unable to identify you from the information provided, we will ask for additional information sufficient to verify your identity before acting on the request.
- AI and Automated Processing
The VAT4U Platform uses machine learning models to analyse invoices, extract transaction data, classify documents and determine VAT treatment. Customer Data processed through the Platform is processed under the applicable DPA. AI-generated outputs – including VAT classifications and extracted data fields – are made available through review workflows that enable Customer users, and where applicable authorised VAT4U personnel acting under the relevant agreement, to review outputs before they are relied upon. The scope of those workflows is determined by the Customer“s configuration and applicable order terms.
VAT4U does not use personal data to make decisions within the scope of Article 22 GDPR – that is, decisions based solely on automated processing that produce legal or similarly significant effects for individuals. If our processing model changes in this respect, we will update this Policy and take such steps as are required by applicable law.
VAT4U does not use Customer Data containing identifiable personal data to train general-purpose or shared AI models unless expressly permitted under the applicable customer agreement and data protection terms. Where VAT4U uses operational data for model development or improvement, it does so in accordance with the applicable role allocation and applies aggregation, anonymisation, pseudonymisation or other controls appropriate to the data and purpose.
Our AI governance practices are documented at https://trust.vat4u.com. Questions about AI-assisted processing in connection with personal data that relates to you can be directed to privacy@vat4u.com.
- Security
We maintain technical and organisational measures designed to protect personal data in accordance with Article 32 GDPR. Further information about our security programme and assurance status is available at https://trust.vat4u.com.
Where required by Articles 33 and 34 GDPR, we notify the competent supervisory authority and affected individuals within the applicable statutory timeframes.
- Contact Details and Complaints
For data protection enquiries, to exercise your rights, or to raise a concern about our handling of personal data, contact us at privacy@vat4u.com.
Our competent supervisory authority is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
poststelle@ldi.nrw.de | https://www.ldi.nrw.de
If you are located in an EU member state other than Germany, you may also contact the supervisory authority in your member state of habitual residence or place of work.
- Updates
We may update this Policy from time to time. The current version is available at https://vat4u.com/en/vat4u-privacy-policy/.