Privacy policy

1. Data controller

The controller of the personal data covered by this policy is Serentill Labs, S.L., the company that operates the Verificus service (hereinafter, "Verificus"), with tax identification number (NIF) B05643143 and registered office at Avinguda de Lleida, 52, 25132 Benavent de Segrià (Lleida), Spain, registered in the Commercial Registry of Lleida, sheet L-38223, 1st entry.

For any matter relating to data protection, data subjects may contact Verificus at hola@verificus.es. Verificus has not appointed a data protection officer, as it is not required to do so under Article 37 of Regulation (EU) 2016/679 (GDPR) and Article 34 of Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

2. Scope

2.1. This policy describes the processing that Verificus carries out as controller: managing user accounts, collecting subscription payments, handling enquiries, securing the service, representing users before the Spanish Tax Agency (AEAT), contacting the accounting firms that receive documents through Verificus and keeping usage statistics to improve the service.

2.2. The data that users enter into Verificus in the course of their business (invoices, data on customers and suppliers, the address book, emails forwarded to the service, SEPA mandates and documents sent to their accounting firm) is processed by Verificus as a processor on behalf of the user, or of the entity on whose behalf the user acts, which is the controller. Verificus processes it solely to provide the service, in accordance with the controller's instructions, subject to a duty of confidentiality and through the sub-processors listed in section 4, under the terms of Article 28 GDPR.

2.3. Persons who have received an invoice or a SEPA direct debit from a Verificus user must exercise their rights against that user, who is the controller. If they contact Verificus, Verificus will forward the request to the controller without undue delay.

2.4. Where the account was created by an accounting firm that provides services to the user, the firm is the controller of the account data on the portal and of the documents exchanged there, and Verificus processes them on the firm's behalf. In that case, the firm's privacy notice, which the user accepts on first access, applies. The invoices that the user issues or receives remain under the user's responsibility, and the firm has access to them to the extent necessary to provide its services.

3. Purposes, legal bases and retention periods

3.1. User account management

Verificus processes first name and surnames, email address, password (stored only as an irreversible cryptographic hash) and, where the user provides them, telephone number, postal address, NIF, logo and the bank details needed to issue SEPA direct debits. It also processes the workspaces the user belongs to, the user's role in each and, for each session, the IP address, browser and start date.

The purpose is to create and maintain the account, authenticate the user, manage workspaces, members and invitations, and send the communications needed to provide the service (address verification, invitations and password recovery). The legal basis is the performance of the service contract (Article 6(1)(b) GDPR). An email address and a password are required to create an account.

The data is kept for as long as the account is active. Sessions expire after thirty days, verification links after twenty-four hours and invitations after seven days. When a user deletes the account, Verificus erases the user's personal data immediately; the content of workspaces shared with other members remains available to them.

3.2. Provision of the invoicing service

Invoice and counterparty data (name, NIF, address, email, telephone, amounts and descriptions), the sending history of each invoice, emails received at the user's Verificus address, SEPA mandates and documents sent to the user's accounting firm are processed on the user's behalf, under the terms of section 2.2.

This data is kept for as long as the account is active. When the account is deleted, it is erased, except for the data that the law requires to be kept: issued and received invoices, VeriFactu invoicing records and the authorisations under which they were filed. These are blocked under Article 32 LOPDGDD until 1 January of the seventh year after the financial year to which they relate, and are then erased. While blocked, they may only be made available to authorities or courts that request them. Documents sent to the accounting firm are erased thirty days after sending.

3.3. Subscription payments

Verificus processes the name or company name, NIF, billing address, email address and the customer and subscription identifiers assigned by Stripe. Card details are entered directly into Stripe, and Verificus has no access to them.

The purpose is to collect the subscription and issue the corresponding invoices. The legal bases are the performance of the contract (Article 6(1)(b) GDPR) and compliance with Verificus's tax and accounting obligations (Article 6(1)(c) GDPR). Invoices and accounting records are kept for six years, in accordance with Article 30 of the Spanish Commercial Code.

Stripe processes some of this data as a controller for fraud prevention and compliance with payment services regulations, under the terms of its own privacy policy.

3.4. Electronic communications

To send the service's emails and those the user sends from Verificus (invoices and documents to the user's accounting firm), Verificus processes the recipient's address and name, the content of the message and, where applicable, any attachments. The legal basis is the performance of the contract (Article 6(1)(b) GDPR); messages that users send to their customers are processed on their behalf.

For each invoice sent, the date, the destination address and the person who ordered the sending are kept for as long as the invoice exists. Verificus does not keep a copy of the message. The email delivery provider keeps its content and delivery data for thirty days.

3.5. Automated reading of invoices

At the user's request, Verificus extracts the data of received invoices (issuer, NIF, amounts and taxes) from the document, the photograph or the email forwarded to the service. To that end, the document is sent to an artificial intelligence model provided by Anthropic. Where the email has no attached document, the text of the message, converted to PDF, is sent instead. This processing is carried out on the user's behalf, under the terms of section 2.2.

The providers do not use the data to train their models. Anthropic deletes inputs and outputs within thirty days at most.

The result is a proposal: the invoice remains pending review until the user checks and confirms its data. No decision based solely on automated processing that produces legal effects concerning the data subject or similarly significantly affects them, within the meaning of Article 22 GDPR, is taken.

3.6. VeriFactu records and representation before the AEAT

When an invoice is issued, Verificus sends the AEAT the invoicing record required by Royal Decree 1007/2023, which contains the NIF and name of the issuer and the recipient, the number, the date, the amounts and the record's hash. This fulfils a legal obligation of the user, and Verificus carries it out on the user's behalf.

To file the records in the user's name, Verificus acts as a social collaborator in tax management and requires the user's express authorisation. With regard to this processing, Verificus is the controller. It processes the name and NIF of the represented person or entity, the signed authorisation form and, where it is signed by hand, a copy of the signatory's identity document. The purpose is representation before the AEAT and evidence of the authorisation. The legal bases are the performance of the contract (Article 6(1)(b) GDPR) and compliance with Verificus's obligations as a social collaborator (Article 6(1)(c) GDPR). The data is disclosed to the AEAT and kept while the authorisation is in force and, thereafter, for the same period as the invoices filed under it (section 3.2).

3.7. Service security and backups

Verificus processes the IP address, browser, user and workspace identifiers, the path and result of each request and, where they appear in it, the email address or NIF. Credentials are removed from the logs before they leave the server. Verificus also keeps a record of privacy and administrative actions.

The purposes are to detect and investigate errors, security incidents and abuse, and to demonstrate compliance with data protection law. The legal bases are Verificus's legitimate interest in network and information security (Article 6(1)(f) and Recital 49 GDPR) and compliance with the accountability principle (Articles 5(2) and 32 GDPR, in conjunction with Article 6(1)(c)). Technical logs are kept for fourteen days, error reports for thirty days, and the record of privacy and administrative actions for three years.

Verificus makes a daily encrypted backup of the data, stored by a different provider within the European Union. Backups are rotated automatically, and erased data remains in them until the backup that contains it expires: about two months for files and, for other data, twelve months in most cases and six years at most. During that period the data is not processed for any purpose other than recovery from an incident, and if a backup ever had to be restored, erasures would be applied again before the service resumed.

3.8. Enquiries and exercise of rights

Verificus processes the name, email address, company (if given) and the content of the enquiry, in order to answer it. The legal basis is the performance of the contract (Article 6(1)(b) GDPR) where the person is already a user, consent (Article 6(1)(a) GDPR) where the enquiry is made through the verificus.es contact form, and compliance with a legal obligation (Article 6(1)(c) GDPR) where it concerns the exercise of a right. The verificus.es contact form stores no data: it sends the message by email to hola@verificus.es. Enquiries are kept for two years after they are closed, and requests to exercise rights for three years, to show that they were answered.

3.9. Accounting firms that receive documents

If a client sends you documents with Verificus, we keep the firm's name and email address for up to 24 months to introduce Verificus for accounting firms. You can ask us not to keep them with the "Don't keep my contact details" link in the email, or by writing to hola@verificus.es.

The data comes from the user, who provides it to send the documents to their accounting firm. Verificus processes the contact person's name, the firm's name, the email address, the clients who have sent documents to it and the number and dates of the sendings, but not the content of the documents. The legal basis is Verificus's legitimate interest in introducing its service to professionals who already work with Verificus users (Article 6(1)(f) GDPR and Article 19 LOPDGDD). Verificus will not send the firm marketing communications without its prior consent.

The data is kept for twenty-four months from the last sending received. If the data subject objects, it is erased immediately and only a cryptographic hash of the address is kept, so that it is not added again. Objecting does not prevent the firm from continuing to receive the documents its clients send.

3.10. Service improvement and usage statistics

To understand how the service is used and where users run into difficulties, Verificus records the screens visited, the forms opened, submitted or abandoned, the errors shown and the account's usage milestones (for example, creating the company or issuing the first invoice), as well as where the signup came from (the link or campaign the user arrived from) and, if given, the reason for leaving the plan. This data is linked to a random identifier that is not derived from the name, the email address or the NIF. The content of invoices and documents, amounts, NIFs, names, email addresses and the text typed into forms are not recorded.

For the verificus.es website, only the pages visited, the language, the referring website and the campaign are counted per day, without storing the IP address or any identifier of the visitor.

The purpose is to detect usage problems, improve the service and assess its commercial terms. The legal basis is Verificus's legitimate interest in improving the service it provides (Article 6(1)(f) GDPR). Each week Verificus prepares an aggregated, pseudonymised summary of this data with the help of an artificial intelligence model provided by Anthropic, which receives no identifying data. No decision affecting the user is derived from it.

Usage data is kept for thirteen months and is erased with the account. Users may object at any time from Settings → Your data; from then on their use is not recorded and the usage data already recorded is erased. Where the account was created by an accounting firm (section 2.4), this data is only processed in aggregated form, unless the firm has authorised it.

This section also applies to the staff of accounting firms who use Verificus for accounting firms and Verificus Sync, where the firm has authorised it. For Verificus Sync, the app version, the operating system and sync problems are also recorded, never the names of files or folders. Each person can object from their own account.

4. Recipients

Verificus does not disclose personal data to third parties, except where required by law. The following providers access it as processors or sub-processors, under a data processing agreement and solely for the stated purpose:

The data is also disclosed to the AEAT, in compliance with the obligations described in section 3.6; to the user's accounting firm, in the case described in section 2.4; and to courts and authorities that request it in accordance with the law.

5. International transfers

Some providers are based in, or process data in, the United States. The corresponding transfers are covered by the following safeguards:

The EU-US Data Privacy Framework is the subject of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection. The standard contractual clauses are those approved by Commission Implementing Decision (EU) 2021/914. Data subjects may obtain a copy by writing to hola@verificus.es.

6. Data subject rights

6.1. Data subjects may exercise the rights of access, rectification, erasure, restriction of processing, data portability and objection, under the terms of Articles 15 to 22 GDPR. They may withdraw any consent given at any time, without affecting the lawfulness of prior processing.

6.2. From Settings → Your data in Verificus, users can obtain a copy of their data (profile, issued and received invoices, companies, series and privacy record), delete their account and object to usage statistics (section 3.10). Any other request may be sent to hola@verificus.es from the address linked to the account, or with information that allows the requester to be identified. Verificus will reply within one month, which may be extended in the cases set out in Article 12(3) GDPR. Exercising these rights is free of charge.

6.3. Data subjects who consider that the processing does not comply with the law may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid).

7. Cookies

7.1. Verificus only uses the cookies necessary to provide the service requested. It does not use analytics or advertising cookies. The usage statistics in section 3.10 set no cookies and store no data on the device.

7.2. The session cookies cannot be accessed by the page's code. Verificus also stores in the browser's session storage a flag indicating that a notice has been closed, so that it is not shown again. Error reports are sent through Verificus's servers and set no cookies.

7.3. Under Article 22(2) of Spanish Law 34/2002 on information society services and electronic commerce, these cookies are exempt from the consent requirement, because they are strictly necessary to provide the service expressly requested by the user. For this reason, Verificus does not display a consent banner.

7.4. The verificus.es website sets no cookies, stores no data on the device and loads no third-party resources. It counts visits without identifying the visitor (section 3.10).

8. Changes

Verificus may amend this policy to reflect changes in the law or in the service. Each amendment will update its version and effective date. Where an amendment substantially affects the processing of data, Verificus will notify users by email or through the service before it applies.

9. Language versions

This policy is published in Catalan, Spanish and English. In the event of any discrepancy, the Catalan version shall prevail.