Privacy
Last updated 5 November 2026
VAT API is a free API for businesses that need to check EU VAT numbers. This page explains which personal data we process, why, for how long, and what you can do about it. We keep it to what the service needs.
Who is responsible
The controller of your personal data is:
Studio Schrauwen BVZonstraat 51
2500 Lier, België
Enterprise number 1041.417.338 · VAT BE1041417338
[email protected]
For anything about privacy, email [email protected]. The service is meant for professional use by businesses only, not for consumers.
What we process and why
| Purpose | Data | Legal basis |
|---|---|---|
| Your account and API key | Email address, sign-up date, a hash of your API key | Contract: we need it to give you the service (GDPR art. 6(1)(b)) |
| Running your checks | The VAT numbers you check, the results, which source answered, timings | Contract (art. 6(1)(b)) |
| Usage limits and abuse prevention | IP address, request counters, Cloudflare Turnstile signals | Legitimate interest: keeping a free service available and safe (art. 6(1)(f)) |
| Operating and debugging the service | Server logs, performance metrics, raw provider responses | Legitimate interest: keeping the service working (art. 6(1)(f)) |
| Shared result cache | Latest known result per VAT number: validity, name, address, source, date | Legitimate interest of our users in verifying business counterparties (art. 6(1)(f)), in the VAT verification context of art. 18 of Regulation (EU) 904/2010 |
We do not sell data, show ads, or build profiles. There is no search or listing feature: results are only available by VAT number.
If your VAT number is looked up
For sole traders, a VAT number, name and address are personal data. We did not get them from you, so here is what you should know (GDPR art. 14).
- Where the data comes from: the European Commission's VIES service (which asks the national tax administration), the Belgian business register KBO/BCE of FOD Economie, vatcomply.com and controleerbtwnummer.eu.
- What we keep: the VAT number, whether it is valid, the registered name and address, whether the enterprise is active in the Belgian register, and when and where we checked.
- Why: so businesses can verify the identity and VAT status of a business they deal with. Legal basis: the legitimate interest of those businesses (art. 6(1)(f)).
- How long: see the retention table.
- Your right to object: see Objecting to your data being shown.
How long we keep data
| Data | Kept for |
|---|---|
| Account data (email, key hash) | Until you delete your account |
| Your check history | 13 months |
| Checks from the free homepage check (not linked to anyone) | 13 months |
| Latest known result per VAT number (shared cache) | Deleted once nobody has looked the number up for 13 months, or earlier on request |
| Raw responses from the sources | 90 days |
| Sign-in session | 120 minutes of inactivity |
| Server logs | 30 days |
| Server backups (Hetzner, EU) | Rolling backups, overwritten within 7 days |
| Performance metrics (VAT numbers are removed from recorded addresses) | 7 days |
| Failed background jobs | 7 days |
| Usage counters | Per-minute counter: 1 minute. Daily counter: until 00:00 UTC |
| Belgian business register (KBO open data) | Replaced in full by each daily import, around 07:00 Brussels time |
Who receives data
Service providers that process data for us (processors, under a data processing agreement):
| Provider | What for | Where / transfer safeguard |
|---|---|---|
| Hetzner Online GmbH | Hosting: servers and database | EU data centre |
| Cloudflare, Inc. | Network proxy, DNS and Turnstile bot protection; sees all traffic to the site | United States: EU-US Data Privacy Framework and standard contractual clauses |
| Zoho Corporation (ZeptoMail) | Sending sign-in emails | EU data region |
The sources we check against receive only the VAT number being checked, never your email address. They are independent organisations with their own privacy policies:
- European Commission (VIES): Forwards the number to the tax administration of the member state
- FOD Economie (KBO Public Search): Belgian numbers only
- vatcomply.com: Independent provider
- controleerbtwnummer.eu: Independent provider
Cookies and local storage
We only use what the site needs to work, so there is no cookie banner:
- Session cookie: keeps you signed in and remembers the result of a check you just ran. The session stored on our server does not contain your IP address or browser details.
- XSRF-TOKEN cookie: protects forms against forgery.
- Theme setting in your browser's local storage, only if you switch between light and dark.
The free check on the homepage and the sign-in forms (sign in, resend link, expired link) are protected against bots by Cloudflare Turnstile. On those pages your browser loads Turnstile from Cloudflare, which processes technical signals such as your IP address to tell people from bots. See Cloudflare's privacy policy. Fonts and all other files are served from our own domain. We use no advertising or analytics cookies.
Your rights
You can ask us for access to your data, to correct it, to delete it, to restrict its use, to receive it in a portable format, or object to its use. Email [email protected]. We answer within one month. You can also delete your account yourself in Settings: that removes your account, your API key and your check history.
If you think we handle your data wrongly, you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussel, www.gegevensbeschermingsautoriteit.be.
Objecting to your data being shown
If you run a business as a natural person and do not want your name and address to be stored or shown by VAT API, email [email protected] with your VAT number. After we have checked that the request is yours:
- We delete everything stored for the number: the stored result, every check of it, the source answers and the raw responses we received.
- The number goes on a suppression list. Lookups still say whether it is valid, because our users are legally required to check that, but your name, address and Belgian register details are never stored or shown again.
- For a Belgian number we also delete the imported KBO open data about your enterprise and skip it in every later daily import.
- We remove monitoring entries that mention the number. Our monitoring never records VAT numbers in addresses anyway.
Not deleted right away: server logs, which are deleted automatically after 30 days, and backups, which are overwritten within 7 days. You can ask us to lift the suppression at any time.
We cannot remove your data from the sources themselves (VIES, the national tax administrations or the KBO/BCE). Contact them directly for that.
Changes
If we change how we handle personal data, we update this page and its date. Account holders are told about significant changes by email in advance.