This is a courtesy translation. The legally binding text is the Spanish version, at factuza.com/legal/privacidad. Where this translation differs from it, the Spanish version prevails.
You can write to us in English at privacidad@factuza.com to exercise any of the rights described below.
Contents
1. Who processes your data
- Data controller
- Eduardo Ortega Busutil (individual, sole trader), trading as OBTechnologies and Factuza
- Tax number (NIF)
- 50744036X
- Address
- Avenida del Talgo 86, 1.º B — 28023 Madrid (Spain)
- Privacy contact
- privacidad@factuza.com
- Supervisory authority
- Spanish Data Protection Agency (AEPD) — aepd.es
2. Two different roles: your data and your clients'
This distinction is the key to everything else, so we explain it first.
For your data as a Factuza user we are the controller. Your email address, your tax number, the plan you have bought, your licence invoices and your support tickets are processed by us and we decide what they are for.
For the data you put into the application we are the processor. Your clients' data, your suppliers' data and your invoices are yours: you decide what is done with them and we process them only on your instructions and on those imposed by the invoicing rules. That relationship is set out in the data processing agreement (article 28 GDPR), which forms part of the terms of service and which you can read in full.
In practice this means we do not use your clients' data for anything other than providing you with the service: we do not analyse it for commercial purposes, we do not pass it on, and we do not train anything with it.
3. What we process your data for, and on what basis
| Processing | Data | Lawful basis |
|---|---|---|
| Account and provision of the service | Identification, email address, tax number, the issuer's tax details, plan and licence status | Performance of the contract (art. 6.1.b GDPR) |
| Billing and collection of the licence fee | Billing details and payment identifier (the card number is handled by the payment gateway; we never see it) | Performance of the contract and legal obligation (arts. 6.1.b and 6.1.c) |
| Support and incidents | Subject, messages in the thread, technical details you provide | Performance of the contract (art. 6.1.b) |
| Sending invoices to your recipients by email, on your behalf | Recipient's email address and the attached invoice | Processing on your behalf (art. 28) |
| Delivery and open receipts for those emails: each one carries an identifier and a small image which, when it loads, tells us the email has been opened. It exists so that you can see whether your invoice arrived, and for nothing else. | Recipient's email address, send identifier, status (sent, delivered, opened) and date. Neither where it is opened from nor on what device is recorded. | Processing on your behalf (art. 28), based on your legitimate interest as the issuer in confirming delivery (art. 6.1.f). Many email programs block these images: in that case the open simply is not recorded. |
| Filing records with the AEAT (VeriFactu) | Issue and cancellation records with their chained hash | Legal obligation (art. 6.1.c; Royal Decree 1007/2023) |
| The “Factuza al día” newsletter | Email address, segment and date of consent | Consent (art. 6.1.a), withdrawable in one click |
| Security, access logs and backups | Session identifier, date and time, IP address, actions on the record chain | Legal obligation and legitimate interest in security (arts. 6.1.c and 6.1.f) |
We do not build commercial profiles, we do not take automated decisions with legal effects on you and we do not sell data to third parties. Ever.
4. How long we keep it
- Account data: for as long as the relationship is in force and, afterwards, blocked for the limitation periods of any possible liabilities.
- Invoices and invoicing records: the periods imposed by law —four years of tax limitation (Law 58/2003) and six years of commercial retention (article 30 of the Commercial Code)— counted from the end of the relevant financial year.
- VeriFactu chain records: by design they are append-only: they are neither deleted nor modified, because their integrity is what gives the system its evidential value. An invoice is voided with a cancellation record, never by deleting it.
- Email send and open receipts: for as long as the invoice they accompany is kept — they form part of the proof that it was delivered.
- Support tickets: three years from closure.
- Newsletter subscription: until you unsubscribe; we keep the record of the consent and of the unsubscription as proof of compliance.
5. Who else is involved
To provide the service we rely on suppliers acting as processors, under signed contract and only for the purposes indicated:
| Supplier | What for | Location |
|---|---|---|
| Microsoft Azure | Hosting of the application, database and backups | Spain region (spaincentral) |
| Azure Communication Services | Sending email: invoices, notices and the newsletter | European Union |
| Azure Document Intelligence | Reading (OCR) the expense invoices you upload | European Union |
| Azure OpenAI | Drafting the support centre's replies. When you write to us, the content of your message is processed to prepare the answer. Microsoft does not use this data to train its models | European Union |
| Microsoft Entra External ID | Registration and login | European Union |
| Stripe | Collecting the licence fee. Card details are handled entirely within their environment; Factuza does not store them | EU / USA with appropriate safeguards |
| Spanish Tax Agency (AEAT) | Recipient of the invoicing records. It is not a processor: it is a disclosure imposed by law | Spain |
Outside these cases, we do not disclose data to third parties save under a legal obligation or a court order.
6. Where it is stored
Factuza's infrastructure is deployed in the Azure region in Spain. Your invoices and your clients' invoices do not leave the European Economic Area.
The only possible international transfer is the one associated with the payment gateway, covered by the standard contractual clauses approved by the European Commission and by the supplier's own supplementary measures.
7. Security measures
- Encryption in transit (TLS) and at rest.
- Authentication managed by an identity provider; we do not store passwords.
- Credentials and certificates live in a secrets store, never in the code.
- The chain of invoicing records is immutable and issuing is transactional: a past record cannot be altered without the chain giving it away.
- Backups with point-in-time recovery.
- Minimal and traced internal access. Support staff do not look at your invoices unless you expressly ask them to in a ticket.
8. Use of automation and artificial intelligence
Factuza does not use generative artificial intelligence. The two features that might look like it are not:
- Invoice dictation uses the device's own speech recognition and a deterministic rules interpreter. It does not generate content: it interprets it.
- Expense OCR uses a pre-trained extraction model that reads the data from a document. It neither creates content nor takes decisions for you.
Your data is not used to train models, ours or anyone else's. The same inputs always produce the same outputs, and every calculated box states where it came from. That is why Factuza falls outside the transparency obligations of article 50 of Regulation (EU) 2024/1689; if we ever added a generative feature, it would be labelled as such from day one.
9. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent where the processing is based on it, by writing to privacidad@factuza.com. We will reply within one month.
Two honest caveats:
- The right to erasure has limits where a legal retention obligation exists. We cannot delete invoicing records within the tax and commercial retention periods, nor break the VeriFactu chain; we can delete the rest and block what the law requires us to keep.
- If what you want to exercise is a right over data that another user entered into their account (because they invoiced you, for instance), the controller is that business, not us. We will pass your request on without delay.
If you consider that we have not handled your request properly, you may complain to the Spanish Data Protection Agency.
10. Changes to this policy
We will publish any amendment on this same page with its date. If the change is substantial and affects you as a registered user, we will tell you by email before it takes effect.