Privacy Policy

IVAERO Digital, S.L., Tax ID (NIF) B05630363, with its address at calle Sostres, 1 bis, 2.º 1.ª, 08024 Barcelona (Spain), email hola@ivaero.com (“IVAERO”), is the controller of the data of website visitors, people who contact us or request access, account holders, authorised users, and customer contacts whose own subscription it manages or invoices.

When a customer adds sales or issues invoices with IVAERO, it may include personal data of its buyers and recipients, as well as that of the holder of the electronic certificate it provides to submit its records to the AEAT. The customer decides the purpose of the processing and acts as controller; IVAERO processes that data on its behalf, as processor, to provide the service. This relationship is governed by the Data Processing Agreement published on this website. Rights over the data in those invoices can be exercised with the issuing customer; if the request reaches IVAERO, we will work with the customer to handle it.

Account and access. Data: name, email, phone, company, tax ID, tax address and the credentials of authorised users. Purpose: creating and protecting the account, managing access and invitations, verifying operations, providing support, communicating incidents or necessary changes to the service, and keeping a record of each user's acceptance of the Terms and conditions, with the date and the version accepted. Legal basis: performance of the contract or pre-contractual steps; legitimate interest in security and abuse prevention.

Subscription and payment. Data: plan subscribed, IVAERO's invoices, payment history and payment data received from the payment provider. Purpose: managing the subscription, collecting payment and meeting accounting and tax obligations. Legal basis: performance of the contract and compliance with legal obligations.

Enquiries and requests. Data: what is provided through the website's forms or by email, such as name, email, company and the content of the message. Purpose: answering enquiries, handling access requests and complaints. Legal basis: pre-contractual steps, performance of the contract or legitimate interest in handling the requests received.

Technical logs. Data: access and security logs, such as IP address, date and time, the operation performed and its result. Purpose: detecting incidents and unauthorised access, keeping the service available and defending legal claims. Legal basis: legitimate interest and, where applicable, legal security obligations.

Marketing communications. Data: email and marketing preferences. Purpose: sending IVAERO news and offers where there is consent or in the cases of a prior relationship permitted by law. Legal basis: consent or, where applicable, the legal permission for similar services; always with the option to unsubscribe.

Browsing. Data: what is obtained through analytics cookies. Purpose: measuring and analysing use of the website, only if the user accepts it. Legal basis: consent; see the Cookie Policy.

Fields marked as required are needed to create the account, subscribe, invoice or process a request. If they are missing, some functions cannot be provided. IVAERO does not make consent to marketing communications a condition for using the service.

If a person signs up or invites others on behalf of a company, the company must make sure it is authorised to provide their data and, where applicable, inform its authorised collaborators.

IVAERO obtains data from those who create or use accounts, from those who invite other users, from use of the service, and from the payment providers needed to collect payments. Sales and buyer data can be entered manually, imported from the customer's files, or received through connections the customer authorises with e-commerce platforms, online shops or other supported channels, such as Amazon. The data received depends on the permissions granted and the configuration of each channel. IVAERO does not use its customers' buyer data for its own advertising or for any purpose other than providing the service.

When the customer connects its Amazon seller account, IVAERO receives from Amazon the buyers' name and address and, where provided, their email, and uses them only to issue the invoices for those orders. Data received from Amazon is identified as such and is kept and deleted as set out in section 4.

Account data is kept for as long as the contractual relationship lasts and, afterwards, for the applicable limitation or legal-compliance periods, blocked and with restricted access. The record of acceptance of the Terms and conditions follows the same period, being evidence of the contract. The invoices IVAERO issues to its customers and their supporting documents are kept for six years (article 30 of the Spanish Commercial Code) and, in any case, for as long as the related tax obligations have not become time-barred (articles 66 to 70 of Law 58/2003, the General Tax Law).

Enquiries and requests are kept for as long as needed to handle them and deal with any liability. Technical logs are kept for 12 months. Marketing communications stop when consent is withdrawn or the person unsubscribes, while a minimal record of the objection may be kept.

As for the data IVAERO processes on its customers' behalf: invoices and invoicing records are kept for as long as the contractual relationship lasts and, afterwards, for the export and return period set out in the Terms of Service and the Data Processing Agreement, and blocked for as long as a law requires them to be kept. Electronic certificates are kept until the customer removes them from its account or the account is closed. Buyer data received from Amazon that is not linked to an issued invoice is deleted 30 days after the order is delivered; data linked to an issued invoice is kept for as long as tax and commercial law require. The customer remains responsible for keeping its invoices in accordance with the rules that apply to it.

The data is accessed by IVAERO's authorised staff and by the providers essential for hosting, maintenance, email, support and payments, in accordance with their contracts and roles. IVAERO does not sell personal data or disclose it to third parties for their own purposes. Data is disclosed to authorities or entities where there is a legal obligation or where the customer orders an operation that is part of the service, for example the submission of its invoicing records to the AEAT. The payment provider may process some data as an independent controller under its own terms.

The providers that process personal data on IVAERO's behalf are Amazon Web Services EMEA SARL (Luxembourg), which provides hosting, the database, document storage and transactional email in the Ireland region (European Union), and Google Cloud EMEA Limited (Ireland), through Google Workspace, for corporate email and customer support. Those that process data on customers' behalf are identified in the Data Processing Agreement, together with their role and the countries from which they process that data.

IVAERO processes data in the European Economic Area. Google may process data outside it; in that case it does so with the safeguards of Chapter V of the GDPR, such as an adequacy decision (including the EU-US Data Privacy Framework for participating entities) or the European Commission's standard contractual clauses.

IVAERO applies security measures appropriate to the risk, including: encryption at rest of the database, the cache and document storage; additional encryption, with keys managed in AWS Key Management Service, of the electronic certificates customers provide; communications encrypted with TLS; role-based access control within each account and logical separation of each customer's data; passwords stored using strong hashing functions; daily automatic backups; an audit log of relevant actions; and IVAERO staff access limited to what is necessary. IVAERO reviews these measures periodically.

If a personal data breach occurs, IVAERO will notify the Spanish Data Protection Agency and, where required, the people affected, within the periods set by the GDPR. If it affects data IVAERO processes on a customer's behalf, it will inform the customer in accordance with the Data Processing Agreement.

When the retention period ends, or when a person exercises their right to erasure and there is no legal obligation to keep the data, IVAERO deletes it or irreversibly anonymises it. If the law requires it to be kept, IVAERO keeps it blocked and processes it only to meet that obligation or deal with claims. Backups are deleted according to their rotation cycle.

When a customer closes its account, it has the export period set out in the Terms of Service; afterwards, IVAERO deletes the data processed on its behalf except what is subject to legal retention. When a user is removed from an account, their identity is anonymised in the audit log. If the customer disconnects its Amazon account or revokes the authorisation, IVAERO deletes within 30 days all data received from Amazon that is not subject to legal retention.

Data subjects may request access, rectification, erasure, objection, restriction and portability where applicable, and may withdraw their consent without retroactive effect, by writing to hola@ivaero.com and stating the request. IVAERO will reply within one month, extendable in the cases provided for in the GDPR, and may ask for the additional data strictly needed to verify identity. They may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

If a request concerns data IVAERO processes on a customer's behalf, IVAERO will pass it on to the customer and help it respond.

The website uses strictly necessary technical cookies and, only with consent, analytics cookies. The Cookie Policy describes which they are, their purpose, their duration and how to change your preferences at any time.

Automating invoicing tasks does not mean that IVAERO takes automated decisions producing legal effects on visitors or account holders within the meaning of article 22 of the GDPR. A substantial change to this policy will be communicated by appropriate means and published with its new date.

This policy is written in Spanish. The English version is a translation and, in case of discrepancy, the Spanish version prevails.