Privacy policy

Data controller

Qualiax is the controller of the personal data collected through this website. Qualiax is an independent professional practice based in Spain. Contact: info@qualiax.com.

The tools’ files are not processed

The free tools on this site — such as the Amazon VAT transactions report reader — process the file you select entirely inside your browser. The file is not uploaded to any server, is not stored and is not accessible to Qualiax at any time.

This means that over the contents of those files no data processing by us takes place: not of your billing data, not of your customers’ data, not of your business figures. It is a product architecture decision, verifiable in your browser’s network traffic.

What data we collect

Waiting list. If you sign up, we collect your email address. It is the only piece of data: no name, no company, no list of countries you sell in. Signing up is entirely voluntary.

Email you write to us. If you write to our contact address, we process whatever you choose to tell us in that message, and only in order to reply.

Email to download the Excel. The summary the tool shows on screen is complete and free, and requires no data at all. Only if you also want to download the result as an Excel file do we ask for an email address. It is the only data we collect there: no name, no company, nothing from the file you analysed.

Proposal request form. If you ask us for a proposal for services, we collect your name, your email address and the name of your company and, if you choose to give them, your website or store, the option you pick about what you need, whether you already sell on Amazon and the message you write.

Site analytics. We use Vercel Analytics to understand how the site is used. It records page views, geographic region at country level, device type and referrer. The data is anonymous — see the cookie policy for why no consent banner is required.

For what purpose and on what legal basis

Waiting list. To let you know when the product is available and, if you tick the box, to write to you with content on VAT and tax for people selling on Amazon and Shopify. Legal basis: your consent, given by ticking a box that never comes pre-ticked.

Email you write to us. To read and answer your enquiry. Legal basis: the legitimate interest in communicating with whoever writes to us.

Email to download the Excel. To send you the file and, if you tick the box, to write to you with content on VAT and tax for people selling on Amazon and Shopify. Legal basis: your consent, given by ticking a box that never comes pre-ticked.

That consent is freely given within the meaning of Article 7(4) of the GDPR, and we want to explain why, because it is deliberate: the tool does not make the service conditional on giving us your email. The full analysis — every block, the breakdown by rate, the warnings and the traceability down to the source row — is shown on screen without asking you for anything, and will stay that way. The email is asked for only in exchange for a specific, separable extra: the Excel file. If you do not give it, you do not lose the service — you lose only the download.

Proposal request form. To study your case, prepare the proposal and reply to you. Legal basis: taking steps at your request prior to entering into a contract (Article 6(1)(b) of the GDPR). Ticking the box on the form confirms that you are asking us to do so; it does not subscribe you to any newsletter or to commercial communications.

Analytics. To understand the site’s performance and improve the content. Legal basis: legitimate interest. No identifiable data is processed.

How long we keep the data

Email for the Excel. It is kept while you remain subscribed. When you unsubscribe it is removed from the list. You can ask for its deletion at any time, without waiting for anything.

Proposal request. It is kept for as long as the conversation about the proposal lasts and, if no business relationship follows, for a maximum of twelve months from the last communication. If one does, it becomes governed by the contract. You can ask for its deletion earlier at any time.

Messages from the form stay in our mailbox and are kept until you request their deletion. Analytics data is retained under Vercel’s retention policy (see their privacy documentation for the current periods).

Who accesses the data

The Qualiax team handles the messages received, and Volcano Brands, S.L., a company in which the owner holds an interest, accesses them only to handle the proposal requested. We use the following providers, which act as data processors on our behalf:

• MailerLite Limited — email marketing platform where your address is stored if you give it to us to download the Excel, and from which the emails you consented to receive are sent. It acts as a data processor. According to its security statement, its services are hosted in data centres located in the European Union (Germany and the Netherlands), certified under ISO/IEC 27001:2022, so your address is processed within the European Union. You can unsubscribe from the link in every email, with no explanation owed to us.
• Vercel — hosting platform and analytics provider. Infrastructure in the US and the EU. Vercel Analytics processes no identifiable data.
• Resend — email delivery service through which the request you make in the form reaches our mailboxes. It acts as a data processor; it processes the form data only to deliver that email. Resend, a US company, with servers in the European Union and Standard Contractual Clauses.
• MailerLite Limited — in addition to the above, it keeps a copy of the proposal request as a record, in a group separate from the newsletters, in case the email is lost. It is not used to send you commercial communications.

These providers act under contractual obligations and cannot use the data for purposes of their own. We do not hand data to third parties for commercial purposes, nor do we sell contact lists.

International transfers

Some data may be processed on Vercel infrastructure located in the United States. Vercel uses Standard Contractual Clauses (SCCs) as the transfer mechanism for EU personal data.

Your rights

Under the GDPR and applicable Spanish law, you have the right to: access your personal data, rectify inaccurate data, request its deletion, receive it in a portable format, object to its processing and request its restriction.

To exercise any of these rights, write to info@qualiax.com. We will reply within 30 days at most.

Supervisory authority

If you believe your rights have not been respected, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish data protection authority), at aepd.es, or with the supervisory authority of your country of residence.

No automated decisions

We use no automated decision-making and no profiling based on personal data. Every reply to an enquiry goes through human review.

Minors

This site is not aimed at children under 16. We do not knowingly collect personal data from minors. If you believe we have collected such data by mistake, write to us and it will be deleted immediately.

Changes to this policy

We may update this policy as our practices or legal requirements evolve — for example, when email subscription to download results is activated. The effective date at the top reflects the latest revision.