1. Introduction

Welcome to getdac7.eu ("we", "us", "our"). We are committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Policy explains how we collect, use, process, and disclose your information in conjunction with your access to and use of our website and services (collectively, the "Service").

This policy applies to three categories of data:

Visitor Data: Information we collect from visitors to our public website.
Account and Billing Data: Information about you and your company if you create an account and buy access to the Service.
Customer Data: Seller data that our customers upload to the Service, which we process on their behalf.

Our legal entity is Marcel Goria, IČO: 08722536, a self-employed person registered in the Czech Republic ("getdac7.eu"). For the purpose of the General Data Protection Regulation (GDPR), we act as the Data Controller for Visitor Data and for Account and Billing Data. For Customer Data, our customer (the platform operator) is the Data Controller, and we act as its Data Processor under Article 28 GDPR.

2. Information We Collect

2.1. Visitor Data

When you visit our website, we may collect the following information:

Contact Information: If you fill out a form on our website, for example to request access or to join a waitlist, we collect your email address and, depending on the form, your company name, the pricing plan you are interested in, or the country you would like us to support. If you book a demo, you do so on Calendly's booking page, and we receive the details you enter there. The legal basis for this is your consent.
Analytics Data: If you accept analytics cookies, we collect information about how you use our website, such as your IP address, browser type, pages visited, time spent on pages, and whether you clicked a sign-up or demo button. The legal basis for this is your consent.

Cookies: Analytics cookies are off by default. Our cookie banner asks for your consent, and we load Google Analytics and Google Ads conversion tracking only after you accept analytics cookies. If you do not accept them, these tools do not load. To withdraw your consent later, delete the cookies for getdac7.eu in your browser. The banner will then ask you again.

2.2. Account and Billing Data

If you create an account, we collect your name, email address and company, your platform's own details (name, tax number and address), and your settings, such as column mappings. If you buy access to the Service, we also keep billing records. We need this data to provide the Service to you and to bill you. The legal basis is the performance of our contract with you and, for billing records, our obligations under tax and accounting law.

2.3. Customer Data

When our customers use our Service, they upload data about their sellers for processing. This is the data we process on their behalf as a Data Processor and is governed by our Data Processing Agreement (DPA). It is required for DAC7 reporting and includes seller identity data (names, business names, addresses, dates and places of birth, tax identification numbers, VAT numbers, financial account identifiers such as IBANs), property listing addresses, and payment figures (consideration, fees, taxes, number of activities).

Customers upload seller data through the upload in the app only. Please do not send seller data to us by email.

3. How We Use Your Information

To Provide our Service: We use Customer Data only to validate it and generate DAC7 reports, as instructed by our customers and as set out in our DPA. We do not use it for any other purpose.
To Run Your Account: If you create an account, we use Account and Billing Data to give you access to the Service, save your settings, support you, and bill you.
To Communicate with You: We use Visitor Data to respond to your inquiries, send you information about our service, and manage access requests.
To Improve Our Website: If you accept analytics cookies, we analyze Analytics Data to understand how our website is used and to improve it.

4. Data Storage and Security

Data Residency: We host the Service on Amazon Web Services (AWS) in the eu-central-1 region (Frankfurt, Germany). The data we host, including Customer Data, account data and the forms you send us, is stored and processed there, and we do not transfer it outside the EU/EEA. Analytics and demo bookings are different. If you accept analytics cookies or book a demo, Google or Calendly may process your data outside the EU/EEA, including in the United States (see Section 6).

Security Measures: Data travels between your browser and the Service over HTTPS (TLS). We process seller files only on AWS in Frankfurt, keep them only temporarily, and delete them automatically. Our logs don't contain the content of your files. Access to our systems is limited to authorised personnel. Annex 1 of our DPA lists the technical and organisational measures we apply to Customer Data.

Data Retention: How long we keep data depends on its category.

Customer Data: Seller data you upload (the file and anything we derive from it, such as the generated XML report and the validation report) is kept only while we process it and while the result is available for you to download, which is at most 1 hour after the report is ready. It is then deleted automatically. We never keep it longer than 24 hours after upload, even if you don't download the result. Seller data is not included in backups, and our logs don't contain the content of your files.
Account and Billing Data: If you create an account, we keep your account data while the account exists and delete it within 30 days after the account is closed, except billing records, which we keep for as long as tax and accounting law requires.
Visitor Data: We retain Visitor Data for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

5. Your Data Protection Rights under GDPR

If you are a resident of the European Economic Area (EEA), you have the following data protection rights:

The right to access, update, or delete the information we have on you.
The right of rectification.
The right to object.
The right of restriction.
The right to data portability.
The right to withdraw consent.
The right to lodge a complaint with a data protection supervisory authority, for example the Czech Office for Personal Data Protection or the authority in the EU country where you live or work.

Please note that for Customer Data, we are a Data Processor. If you are a seller on a platform that uses our service and you wish to exercise your rights, please contact the platform (the Data Controller) directly. We delete seller data after each processing run, so we usually hold no data about you.

6. Sharing and Disclosure

We do not sell, rent, or trade your personal information with any third parties for their marketing purposes.

We share information with the following recipients:

Amazon Web Services (AWS): Hosts the Service. AWS processes the data we hold, including Customer Data while we process it, in the eu-central-1 region (Frankfurt, Germany).
Google: Provides Google Analytics and Google Ads conversion tracking. These tools load only if you accept analytics cookies. Google may process Analytics Data outside the EU/EEA, including in the United States.
Calendly: Runs our demo booking page. If you book a demo, Calendly processes the details you enter and may process them outside the EU/EEA, including in the United States.
European Commission: Where the Service performs these checks, we check VAT numbers through the European Commission's VIES service and tax identification numbers through its TIN on-the-Web service. Only the VAT number or TIN and the country code are sent. These are public-authority services used at our customer's instruction, not sub-processors.
For Legal Reasons: We may disclose your information if required to do so by law or in response to valid requests by public authorities.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

8. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

contact@getdac7.eu