Privacy & Cookies

Last updated: October 1, 2025

1. Purpose of this Privacy Policy

This Privacy Policy explains how Facturaz S.L. (“Facturaz”, “we”, “our”, or “us”) collects, uses, and protects your personal data in compliance with:

• EU Regulation 2016/679 (GDPR), and
• Spanish Organic Law 3/2018 (LOPDGDD) on the Protection of Personal Data and Guarantee of Digital Rights.

By accepting this Privacy Policy, you give your explicit, informed, and voluntary consent for Facturaz to process your personal data collected through our website, www.facturaz.es (the “Website” or “Platform”).

Using the Platform means you must be at least 18 years old or have sufficient legal capacity to enter into binding contracts.

This policy applies to all users of our services including visitors, registered users, and autónomos (freelancers).

2. Data Controller

Facturaz S.L. is a Spanish limited liability company, registered in the Mercantile Register of Valencia with NIF B22962112 and legal address at Calle Barques 2, Planta 2, 46002 Valencia, Spain.

You can contact us at soporte@facturaz.es for any questions related to this Policy.

Facturaz acts as the Data Controller when we collect data directly from you (for example, during registration or billing).

In some cases, we act as a Data Processor. For example, when professional clients use our software to manage their own clients’ data. In those cases, we process data strictly according to their instructions.

3. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in law, technology, or how we operate.

If updates are significant, we’ll notify you by email or directly through the Platform.

Please ensure your personal information remains accurate and up to date. Notify us if your details change during your relationship with us.

4. Third-Party Links

Our Website may contain links to other websites, plug-ins, or applications.

If you click on those links, third parties may collect or share data about you.

Facturaz does not control those websites and is not responsible for their privacy practices.

We recommend reviewing the privacy policy of every external site you visit.

5. Personal Data We Collect

We may collect and store the following categories of personal data:

• Identification data: name, surname(s), DNI/NIE or national ID, date and place of birth.
• Contact data: address, email, phone number.
• Financial and fiscal data: bank account (IBAN), invoices, payment information, tax details.
• Professional data: activity type, employment status, or professional affiliations.
• Technical data: IP address, browser type, session identifiers, access logs.
• Verification documents: uploaded ID cards, passports, digital certificates, or payment proofs.

We may also use aggregated or anonymized data for statistical or analytical purposes, which does not identify you personally.

6. How We Collect Your Data

We collect data in two main ways:

a) Direct interactions

When you register, fill out onboarding forms, upload documents, make payments, or contact us by email, chat, or other means.

b) Automated technologies

When you browse our Website, we collect technical data such as IP address or browser type using cookies or similar technologies.

See the Cookies section below for more details.

7. How We Use Your Data (and Legal Basis)

We process your data only when legally permitted. The main purposes include:

• Managing account creation and access to the Platform,
• Processing payments and issuing invoices,
• Providing and improving our services,
• Handling customer support and communications,
• Complying with tax, accounting, and legal obligations,
• Preventing fraud and ensuring system security, and
• Sending important service or policy updates.

When required, we rely on your explicit consent (for example, for marketing emails or cookie preferences).

You can withdraw that consent at any time.

8. Data Recipients

We may share your personal data with trusted third parties, only when necessary and under confidentiality agreements:

Technology Providers

• Amazon Web Services (AWS): for hosting and database infrastructure.
• Stripe Payments: for secure payment processing.
• Bilbabit: for Verifactu-compliant data transmission.

Public Authorities

• Agencia Tributaria (AEAT) or other tax/legal authorities when required by law.

Professional Service Providers

• Accountants, tax advisors, or auditors under strict confidentiality obligations.

All third parties handle your data in compliance with GDPR and apply appropriate security safeguards.

9. Facturaz as a Data Processor

When Professional Clients use Facturaz to manage their own customers’ data (e.g., invoices or client lists), Facturaz acts as a Data Processor.

In those cases:

• We process data only as instructed by the client,
• We apply strict confidentiality and technical security measures, and
• We comply fully with GDPR and Verifactu requirements.

10. International Data Transfers

Some service providers may process or store data outside the European Economic Area (EEA).

Such transfers happen only if:

• The destination country has an adequacy decision from the European Commission, or
• The provider uses Standard Contractual Clauses (SCCs) approved by the EU to guarantee equivalent data protection.

11. Data Security

We use strong technical and organizational security measures to protect your personal data from loss, misuse, or unauthorized access.

These include:

• SSL/TLS encryption for data transmission,
• Access control and monitoring,
• Security logging and intrusion detection,
• Regular infrastructure audits, and
• Encrypted backups and redundancy.

While we take all reasonable precautions, no online system can guarantee absolute security.

If a data breach occurs that could affect your rights, we’ll notify you as required by law.

12. Data Retention

We retain your personal data only for as long as needed for the purposes stated in this Policy or as required by law.

Typical retention periods include:

• Account data: while your account is active and up to 5 years after termination (for accounting and tax purposes).
• Invoices and Verifactu records: at least 6 years, as required by Spanish commercial law.
• Support and communication data: up to 2 years after resolution.

After the retention period, your data will be securely deleted or anonymized.

13. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Access: Obtain a copy of the personal data we hold about you.‍
• Rectification: Correct inaccurate or incomplete data.‍
• Erasure: Request deletion (“right to be forgotten”) when legally allowed.‍
• Restriction: Limit the processing of your data in specific circumstances.‍
• Objection: Object to certain uses, such as direct marketing.‍
• Portability: Receive your data in a structured, machine-readable format.‍
• Withdraw consent: Withdraw consent at any time when processing is based on consent.

To exercise these rights, email soporte@facturaz.es with a copy of your ID for verification.

If you believe your rights have been violated, you may file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

14. Minors

Facturaz services are intended for users aged 18 or older.

We do not knowingly collect personal data from minors.

If we become aware that such data has been collected, we will delete it immediately.

15. Cookies

Facturaz uses cookies and similar technologies to:

• Ensure the Website functions correctly,
• Enable secure login and session management,
• Remember user preferences for future visits,
• Analyze usage and traffic for performance improvements, and
• Protect users from potential security threats.

Accepting cookies is optional, but some features may not work properly if you disable them.

Managing Cookies in Your Browser

You can configure your browser to manage or reject cookies.

• Internet Explorer: Tools → Internet Options → Privacy → Settings
• Firefox: Tools → Options → Privacy → History → Custom Settings
• Chrome: Settings → Privacy → Content Settings
• Safari: Preferences → Security

You can also manage your preferences anytime via our Cookie Preferences Center.

16. Policy Modifications

Facturaz may update this Privacy Policy to reflect legal, technical, or operational changes.

Significant updates will be communicated via email or directly within the Platform.

We encourage you to review this Policy periodically to stay informed about how we protect your data.