Privacy Policy

Last updated: 11 October 2026

This explains which personal data we process at VerifyVAT, why, and which rights you have.

1. Controller

DEEPXCLUSIVE SARLS, Rue d’Arlon 20, L-9155 Grosbous, Luxembourg. Email: info@deepxclusive.com, phone: +352 838072200.

2. Data we process

Account data: email address, password (stored only as a hash), company name, address, your own VAT ID, optionally contact email and phone number.

Request data: the VAT ID checked, the result, company data supplied by VIES, consultation number, time, the API key used and your VAT ID as requester.

Support: content and sender of messages sent through the support form.

Technical data: IP address, time and requested address in server logs, plus counters for sign-in and API limits.

3. Purposes and legal bases

We process data to provide the account and the service (Art. 6(1)(b) GDPR), to prevent abuse and ensure security (Art. 6(1)(f) GDPR) and to meet legal obligations (Art. 6(1)(c) GDPR).

4. Transmission to VIES

For every request we transmit the VAT ID to be checked and your own VAT ID as requester to VIES, the European Commission’s service, which forwards the request to the national tax administration. The service is not possible without this transmission.

5. Other recipients

Providers of hosting and email delivery process data on our behalf. If data is processed outside the European Economic Area, we ensure appropriate safeguards under Art. 46 GDPR. Data is not passed on for advertising purposes.

6. Cookies and local storage

We only use technically necessary storage: a session cookie for sign-in, a cookie for the chosen language and a local storage entry for the chosen colour theme. There are no advertising or tracking cookies and no analytics services. Fonts are loaded from our own server.

7. Retention

We keep account and request data as long as your account exists, because the history serves as your proof. On request we delete your account and associated data unless statutory retention duties apply. Server logs are kept only for a limited time.

8. Security

The connection is encrypted with HTTPS. Passwords are stored only as hashes and API keys encrypted. Sign-in and API are limited against abuse, and each customer sees only their own data.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object. Write to info@deepxclusive.com.

You can also complain to the competent supervisory authority. In Luxembourg this is the Commission nationale pour la protection des données (CNPD).