Privacy Policy
Last updated: 11 October 2026
This explains which personal data we process at VerifyVAT, why, and which rights you have.
1. Controller
DEEPXCLUSIVE SARLS, Rue d’Arlon 20, L-9155 Grosbous, Luxembourg. Email: info@deepxclusive.com, phone: +352 838072200.
2. Data we process
Account data: email address, password (stored only as a hash), company name, address, your own VAT ID, optionally contact email and phone number.
Request data: the VAT ID checked, the result, company data supplied by VIES, consultation number, time, the API key used and your VAT ID as requester.
Support: content and sender of messages sent through the support form.
Technical data: IP address, time and requested address in server logs, plus counters for sign-in and API limits.
3. Purposes and legal bases
We process data to provide the account and the service (Art. 6(1)(b) GDPR), to prevent abuse and ensure security (Art. 6(1)(f) GDPR) and to meet legal obligations (Art. 6(1)(c) GDPR).
4. Transmission to VIES
For every request we transmit the VAT ID to be checked and your own VAT ID as requester to VIES, the European Commission’s service, which forwards the request to the national tax administration. The service is not possible without this transmission.
5. Other recipients
Providers of hosting and email delivery process data on our behalf. If data is processed outside the European Economic Area, we ensure appropriate safeguards under Art. 46 GDPR. Data is not passed on for advertising purposes.
6. Cookies and local storage
We only use technically necessary storage: a session cookie for sign-in, a cookie for the chosen language and a local storage entry for the chosen colour theme. There are no advertising or tracking cookies and no analytics services. Fonts are loaded from our own server.
7. Retention
We keep account and request data as long as your account exists, because the history serves as your proof. On request we delete your account and associated data unless statutory retention duties apply. Server logs are kept only for a limited time.
8. Security
The connection is encrypted with HTTPS. Passwords are stored only as hashes and API keys encrypted. Sign-in and API are limited against abuse, and each customer sees only their own data.
9. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object. Write to info@deepxclusive.com.
You can also complain to the competent supervisory authority. In Luxembourg this is the Commission nationale pour la protection des données (CNPD).