How VATFind handles data.

Who is responsible

VATFind is operated by Global Data Intelligence Limited (company number 09410808), registered at Artisans' House, 7 Queensbridge, Northampton, Northamptonshire, United Kingdom, NN4 7BF. Global Data Intelligence Limited is responsible for the personal data described in this notice.

This notice explains the VATFind-specific processing and the available privacy rights and controls.

VAT-number finds and checks

VATFind processes the legal company name or VAT/EIN, country, and optional state or province you submit using contracted data services to retrieve company records. Do not enter passwords, personal financial information, or information unrelated to a business lookup.

Company-detail responses may be cached in the application database for up to 15 minutes to improve speed and reduce repeated source calls. The retrieval time remains attached to the response. The contracted data services used by VATFind may process lookup inputs and source-request metadata under their applicable privacy terms.

Free allowance and security controls

To apply the free allowance, VATFind derives a daily keyed hash from the network address supplied by the hosting platform. The raw address is not stored in the quota table. Quota records older than two days are removed during later search activity. People sharing a network can share the same allowance.

Hosting and security providers may process request metadata, IP addresses, and essential cookies to deliver the site, prevent abuse, and maintain service security.

VATFind accounts, search history and saved results

WorkOS AuthKit processes account registration and sign-in using the method you select, including email and password or an enabled social identity provider. VATFind receives the account email, its verification status, user identifier, and available profile name used to show your profile and determine which history and credit balance you may access. After a completed registration, VATFind queues the account email, available profile name, WorkOS user reference, registration source, and the company name and phone number supplied during free signup for delivery to HubSpot CRM when the service-to-service CRM connection is available, so the VATFind team can identify product registrations and support account questions. This does not subscribe the account to marketing email. VATFind stores the required company name and phone number with your account so the team can identify your business and contact you about your account. These details are visible in account settings. VATFind uses a derived account identifier for lookup-history and credit-ledger rows.

Completed signed-in searches store that identifier, search text, method, country, optional region, number of matches, and timestamp. The history table does not store your profile name, email, temporary result tokens, or full company-detail snapshots. The dashboard shows a rolling 30-day window and up to 100 recent searches; older rows are removed during later signed-in search activity.

When you explicitly choose Save result, VATFind stores a separate account-owned snapshot containing the returned company fields, source, retrieval time, and save time. Anonymous save requests are held temporarily for up to 30 minutes while you register or sign in and are bound to the browser that started the request. Saved results remain in the workspace until you remove them and do not update automatically. Monitoring is a separate setup and is never activated merely because you viewed or saved a result.

Company monitoring, VAT-status requests, and webhooks

When you activate self-service company monitoring, VATFind stores the submitted identifier and country, optional company name and reference, selected cadence and company-record fields, baseline and latest usable snapshots, run outcomes, company-change and service-health events, delivery status, and any webhook URL you configure. This current workspace capability rechecks company-record evidence; it does not perform live tax-authority monitoring.

If you request authority-backed VAT-status monitoring, the contact request records the countries, volume, cadence, evidence and delivery requirements you provide. Any later VAT-status implementation, including the authority response data it processes and retains, requires separately confirmed coverage and terms.

Pausing stops scheduled rechecks while retaining the monitor slot. Archiving stops future checks and releases the slot. Run and event records may be retained for service security, billing, support, and audit purposes. A configured webhook receives signed event payloads and delivery metadata; do not place credentials or personal data in the webhook URL.

Subscriptions, payment processing and service emails

Stripe processes checkout, recurring payments, invoices, and receipts. You may pay before registering. VATFind associates Stripe's signed payment confirmation with a derived identifier for the checkout email; for a new customer, VATFind creates an account and opens the purchased workspace automatically in the browser that started checkout. VATFind stores a hashed browser proof, checkout-attempt reference, account identifier, email and expiring session record to connect that return securely. A payment does not mark the email verified and cannot unlock an existing account without sign-in. WorkOS creates the new account record without a password; later sign-in verifies identity using an available authentication method. When you are already signed in, VATFind sends Stripe a signed workspace reference and locks the verified workspace email to checkout. VATFind does not receive or store full card numbers or card security codes. To issue the billing-period allowance, prevent duplicate fulfillment, track subscription status, handle refunds or disputes, and support purchases, VATFind stores a derived account identifier, Stripe customer, subscription, invoice, checkout, payment, Payment Link and event references, plan details, included-check amounts, transaction amount and currency, status, and timestamps.

VATFind may queue a transactional payment confirmation and, after account setup, a workspace-ready message. It also queues one low-credit alert at 20% remaining and another at 5% remaining in each subscription period. The email-delivery record can include the recipient email, available first name, plan, billing interval, amount and currency, included and remaining checks, billing dates, invoice reference and Stripe invoice link, delivery attempts and status, provider message reference, and limited error category. Resend processes these messages when transactional delivery is configured. They are service emails about the purchase or account, not marketing. Sent queue records are removed after 24 months; unsent records remain queued until delivery or operational resolution so a temporary provider outage or configuration problem does not silently discard a service message.

Payment and ledger records are retained as needed for account delivery, accounting, fraud prevention, disputes, support, and legal obligations. Clearing search history does not delete the credit account or payment ledger. Stripe and Resend also handle information under their own applicable privacy terms.

Support centre and support emails

When you open a signed-in support request, VATFind stores the derived workspace identifier, verified account email, available profile name, category, subject, message, request or invoice reference you provide, active plan name, the last non-support workspace page recorded in that browser, status, and timestamps. The support team can reply and change the request status. The customer and authorised VATFind staff can see the complete thread in the workspace.

You may attach one PNG, JPEG, or WebP screenshot up to 5 MB to the first message. The image is stored in private object storage and is served only after VATFind confirms that the signed-in customer owns the request or that the viewer is authorised VATFind staff. Remove credentials, payment-card details, personal data, and confidential material before uploading.

VATFind uses Resend to notify the designated VATFind support recipient about new customer messages and to send the customer a receipt and staff-reply notifications. Email payloads contain the request reference and limited thread context needed to understand the notification; the workspace thread remains the source of truth. Support requests and attachments are normally retained for 24 months after their last activity, unless a longer period is needed for an active issue, security, billing, legal obligations, or legal claims.

API and enterprise requests

When you submit the contact form and acknowledge the response notice, VATFind stores your name, work email, company, area of interest, estimated lookup volume, message, and submission time, and processes your work phone number in the CRM-delivery queue and CRM so the VATFind team can qualify and respond to the request. The same details and a request reference are submitted to HubSpot CRM using the VATFind contact workflow or, when configured, its service-to-service CRM connection. An email-derived hash is used to enforce the daily submission limit. The form does not subscribe you to marketing email.

VATFind keeps a limited CRM-delivery queue containing the contact or registration details, delivery attempts, status, and error category. Queue records become eligible for removal after 24 months. Temporary failures are retried through background processing and later site activity.

Application contact requests are normally kept for 24 months and removed during later form or staff-inbox activity. Relevant correspondence or CRM relationship records may be retained separately where an ongoing commercial relationship, legal obligation or legal claim requires it. Do not submit credentials, regulated personal data, or confidential material in the free-text field.

Cookies and service providers

VATFind uses essential authentication, security and service-preference storage. Optional first-party analytics and Google Analytics run only after an analytics choice. You can reject optional analytics as easily as accepting it and change your choice through Cookie settings. See the cookie notice for technologies, purposes and durations. With analytics consent, the first observed public page in a tab is retained for up to 30 minutes and included in the CRM note if you submit a sales enquiry. This contains a page path and capture time, without query strings or account-page details. For a new workspace signup, a separate consented cookie retains the first observed public page, campaign labels, referrer hostname and whether a Google ad click parameter was present for up to 30 minutes. A signed handoff carries these details through authentication into the HubSpot registration note. Withdrawing consent prevents their use. No click identifiers, search terms or full referrer URLs are stored. VATFind does not load a separate advertising tag.

Information is shared only as needed with service providers that support VATFind, including WorkOS for account registration and sign-in, the selected social identity provider when applicable, the hosting platform for delivery and security, contracted data services for VATFind company-name and VAT/EIN record searches, HubSpot for CRM and commercial follow-up, Stripe for checkout and payment operations, and Resend for transactional service-email delivery when configured.

Your controls and rights

You can export or clear search summaries from Search history or Settings. You can separately review, export, or delete company snapshots from Saved results. In Monitoring, you can pause, resume, or archive company monitors and acknowledge their events. Clearing history does not delete saved results or monitoring evidence, and deleting a saved result does not reset the daily allowance or remove provider, hosting, security, payment, or legal records kept for their separate purposes.

Depending on applicable law, you may ask to access, correct, delete, restrict, or object to processing of your personal data, and may have portability or complaint rights. To email VATFind, click here. You may also complain to the UK Information Commissioner's Office.

Contact

For privacy questions or rights requests, click here. For VATFind product and payment support, use the signed-in support centre or click here.

Purposes and lawful grounds

The table explains our purposes where VATFind acts as controller under the UK GDPR and, where applicable, EU GDPR. Contract applies when the individual is our customer or asks us to take steps towards a contract. For an employee acting for a corporate customer, the corresponding account and service administration relies on our legitimate interests in supplying and supporting that business.

Where we rely on legitimate interests, you may request information about the balancing assessment and object because of your particular situation. Submitting an enquiry or creating an account does not subscribe you to marketing. Any optional marketing programme requires its own lawful basis, notices and opt-out.

Business records and people who do not have an account

Company information can be personal data when it identifies a sole trader or a person acting as a director, officer, shareholder, beneficial owner or business contact. Depending on the requested product and available record, this may include a name, business role, company connection, ownership interest, business address or business tax identifier. Information comes from customer submissions, official public registers and licensed company-information sources; the source context returned with a record identifies the source category available for that result.

You can contact us about a record even if you have never used VATFind. Include enough information to locate it, such as the company, country, your connection and the field concerned. We will assess correction, restriction, objection or erasure requests against the relevant purpose and legal duties, and tell you the outcome. A public record is not exempt from privacy law simply because it is public. A correction in VATFind does not itself amend the originating official register.

Where VATFind holds customer-provided personal data solely on that customer’s instructions, the customer determines the purpose and is normally the controller. We will help route the request and assist as required. Our data processing terms explain the distinction.

API credentials, MCP clients and analytics

API and OAuth records include credential hashes or protected credential material, labels, scopes, client names and redirect addresses, creation and expiry times, revocation status and usage metadata. Live checks and monitoring can store the submitted business identifier, resolved company evidence, client reference and metadata that you choose to include. Avoid unrelated personal information in free-text references and metadata.

When you authorise an MCP client or configure a webhook, the client or recipient receives the information requested within that permission. Its operator controls its own retention, model use and onward disclosures. Disconnecting prevents future authorised access; it cannot recall copies already delivered.

With your analytics choice, VATFind records campaign source, medium, name and ID from tagged public-page links, alongside a random browser-session identifier and allowlisted product-event dimensions such as country, search mode and match count. Campaign labels are kept in the current tab for up to 30 minutes and, if you submit an enquiry with analytics enabled, attached to its CRM note under the enquiry retention rules. The first-party analytics table has a 90-day cleanup threshold. Google Analytics is loaded only with analytics permission on public-page routes. The tag may process online identifiers, IP-derived technical information, browser details and page interactions. Our explicit event forwarding excludes search text, emails and company-result payloads. Essential billing, security and usage records are maintained independently of optional analytics.

Retention periods and deletion

Cleanup is periodic or triggered by subsequent activity; an expiry is not a promise of physical deletion at the exact minute. Provider logs and backups have their own retention and recovery cycles. Where no fixed period applies, we assess the purpose, account or case status, data sensitivity, statutory record duties and applicable claim periods. Ask us for the period and reason applicable to a particular record or a coordinated deletion request covering relevant service providers.

International processing and disclosures

VATFind uses the service providers listed here. Processing and authorised support access can occur outside the UK and EEA, including in the United States and locations used by the relevant supplier. The service does not promise UK-only or EU-only residency. Request the applicable supplier, location and transfer schedule if your organisation has a residency requirement.

A restricted transfer requires an applicable adequacy decision or appropriate safeguards, such as the EU Standard Contractual Clauses and UK Addendum or the UK International Data Transfer Agreement, together with any required assessment and supplementary measures. Which mechanism applies depends on the recipient, processing and contract; this notice does not itself execute those instruments or establish a supplier’s certification. Contact us for the safeguards and transfer details applicable to your personal data, including a copy where available subject to necessary redactions.

We may disclose relevant information to professional advisers, insurers, courts, regulators or law enforcement where necessary and lawful, and to a prospective business successor under confidentiality safeguards. Business-data delivery to customers can contain the business-role information described above; this is separate from processing private account, billing and support records. Those private records are not offered as a marketing-contact dataset.

Your privacy rights and response times

Subject to applicable law and the processing involved, you may request access, correction, erasure, restriction and portability of personal data. You may withdraw consent at any time without affecting earlier lawful processing. Essential service data may still be needed on a different lawful ground.

Right to object: you may object to processing based on legitimate interests because of your particular circumstances. You may object to direct marketing at any time, and we will stop that use. Use Cookie settings to refuse or withdraw optional analytics.

To email VATFind, click here with “VATFind privacy” in the subject or write to the registered office above. We may request proportionate identity or authority checks. We normally respond within one month under UK/EU GDPR. Where law permits an extension for a complex or multiple request, we will explain the reason and revised deadline within that first month. Requests are normally free; any lawful fee or refusal will be explained. Other jurisdictions may provide different rights and deadlines, which we will apply where relevant.

You may complain directly to the UK Information Commissioner’s Office (telephone +44 303 123 1113), or to your relevant local data protection authority. In the EEA, this can include the authority where you live, work or consider an infringement occurred. You do not have to contact us first.

Required information, automated processing and children

You choose whether to browse or contact us. A company identifier or name and country are needed to run a lookup; a verified email is needed for an account, and company name and phone number are required to complete free signup; billing information is needed to supply a paid plan. Without the relevant required information, we cannot complete that request. Optional fields are identified in the form.

VATFind automatically resolves company matches, applies quota and billing access rules, and generates company-change events. Exhausted checks or payment failure can pause live use; support can review an error. VATFind does not decide an individual’s credit, employment or legal eligibility on a customer’s behalf. Customers remain responsible for their decision-making, lawful grounds and any required human review.

VATFind is a business service intended for people aged 18 or over. Do not submit children’s information, special-category information or personal identity documents through general lookup and contact fields. If you believe such information has been provided inappropriately, contact us for review and removal where required.

Security and notice changes

Read our security information for the controls applied to accounts, private workspace data, credentials and integrations. No online system is risk-free. Where a personal data breach requires notice to affected people or an authority, we will provide the legally required notification.

We update this notice when relevant practices change and show the revision date above. Material changes will be brought to your attention through the service or account email as appropriate. A new optional processing purpose requiring consent will not be enabled by changing this notice alone.