1. Data controller
VATManager (the "Controller") is responsible for the processing of personal data collected through the website vatmanager.eu and the platform api.vatmanager.eu. For any request: info@vatmanager.eu.
2. Data collected
We collect the following categories of data:
- Registration data: first name, last name, email address, company name.
- Usage data: access logs, actions on the platform, browser, IP, analytics via Cloudflare.
- Marketplace data: transaction data collected through the official APIs of Amazon (Selling Partner API, authorised via Login with Amazon), Shopify and eBay to deliver the service.
- Uploaded files: sales reports in CSV/XLSX format containing transaction data.
- Payment data: handled directly by Mollie; we do not store card data.
- Error-monitoring data: only with your consent, in the event of a site malfunction, technical error data (message, stack trace, page visited, browser type, the most recent technical actions that preceded it) and your IP address are sent to GlitchTip. No profiling.
3. Purposes and legal bases
- Delivering the service — performance of the contract (Art. 6(1)(b) GDPR)
- Security and fraud prevention — legitimate interest (Art. 6(1)(f) GDPR)
- Tax and legal obligations — legal obligation (Art. 6(1)(c) GDPR)
- Marketing and communications — consent (Art. 6(1)(a) GDPR)
- Monitoring and fixing site errors — consent (Art. 6(1)(a) GDPR)
4. Data retention
Account data and transaction data (including marketplace data and uploaded files) are retained for the entire duration of the contract. After the service ends or the account is deleted, tax and transaction data are retained for 10 years in compliance with the obligations set out in Art. 2220 of the Italian Civil Code and Italian VAT law (Presidential Decree 633/72).
Manually uploaded files can be deleted by the user at any time from their personal area; deletion is immediate on live systems. However, data may persist in periodic database backups for a period no longer than that required by law, after which it is permanently and automatically deleted.
Payment data is not retained by the Controller; its processing and storage are handled directly by Mollie under its own privacy notice.
5. Recipients
Data may be shared with technical providers acting as data processors, including: hosting and CDN (Cloudflare), payments (Mollie) and site error monitoring (GlitchTip, EU instance, active only with your consent). Each provider processes data under a data processing agreement (DPA). We do not sell data to third parties. All providers operate within the EU/EEA or with adequate safeguards.
6. Data subject rights
You have the right of access, rectification, erasure, restriction, portability and objection to processing. You can exercise your rights by writing to info@vatmanager.eu. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
7. Cookies
For information on the cookies we use, see our Cookie Policy.