Privacy Policy

Taxmo B.V. registered at the Dutch Commercial Registrar with number 42180642, addressed at NDSM-Straat 117, 1033 NA, Amsterdam, The Netherlands, (operating as "Taxmo," "we," "our," or "us"), the company behind www.taxmo.nl, values your privacy. This Privacy Policy explains how we collect, use, and share your personal information when you use our website and services related to Dutch tax assistant, bookkeeping, BTW/VAT returns calculations, and record keeping.

Data Controller

Taxmo B.V. is the Controller of your personal data within the meaning of Article 4(7) of the EU General Data Protection Regulation (GDPR). By using our Service, you authorise us to act as the Controller of your data as prescribed by law. This means that we determine the purposes and means of the processing of your personal data and bear the corresponding legal obligations that arise under the GDPR.

As Controller, we are responsible for ensuring that your personal data is processed lawfully, fairly, and transparently, and that your rights as a data subject are respected at all times. These obligations include, but are not limited to, implementing appropriate technical and organisational measures to protect your data, maintaining records of processing activities, conducting data protection impact assessments where required, and cooperating with the competent supervisory authority in the performance of its tasks. The Dutch Autoriteit Persoonsgegevens (AP) is the lead supervisory authority.

Our role as Controller gives rise to specific duties under the GDPR, including ensuring your rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and the right to object (Article 21). We take these obligations seriously and have put in place the processes described in this Privacy Policy to fulfil them. If you wish to exercise any of these rights, or have questions regarding our role as Controller, please contact us at privacy@taxmo.nl.

Our Privacy Policy

At Taxmo, your privacy is not an afterthought, it is a core principle that shapes how we design, operate, and deliver our services.

We are committed to the responsible and lawful processing of your personal data in full compliance with the EU General Data Protection Regulation (EU GDPR) and the Uitvoeringswet Algemene verordening gegevensbescherming (UAVG). We process your personal data only where a valid lawful basis exists, which may include your consent, the performance of a contract to which you are a party, or our legitimate interests where these are not overridden by your fundamental rights and freedoms.

We believe that transparency is the foundation of trust. This Privacy Policy sets out clearly and plainly what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you hold in relation to it. We are committed to ensuring that you are never left uncertain about how your information is being handled.

Beyond legal compliance, we take a proactive approach to data protection. We regularly review and test our data processing activities to verify that appropriate technical and organisational safeguards are in place. We actively monitor for potential vulnerabilities, assess risks of data breaches, and apply the principle of data minimisation, ensuring that only the minimum amount of personal data strictly necessary for each purpose is ever collected or processed. We further enforce your rights and assist you with related action where you request it.

If you have any questions about this policy or wish to exercise your rights, including your rights of access, rectification, erasure, restriction, portability, or objection, please contact us at privacy@taxmo.nl.

Definitions

• Controller: the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data, as defined by Article 4(7) of the GDPR. In relation to the Service, Taxmo B.V. acts as the Controller.
• Customer Personal Data: data and information which is uploaded onto our systems for the purpose of provision of our services.
• Account Personal Data: data which is provided by you or otherwise collected by us for the purpose of service provisions.
• Personal Data: any information relating to an identified or identifiable natural person as defined by the GDPR Article 4.

Information We Collect

A. Information You Provide

Registration and Profile Information

When you register for an account and accept our Terms of Services we collect your Email, name, phone number (optional), tax details (e.g., BSN, BTW number, KVK number, income sources for returns), payment receipts, and other documentation we may require in order to provide you with the complete Services. If you sign-in through your social media accounts, we may also collect information which you have consented to its sharing on these platforms such as your profile photo.

Payment Information

We retain history of transactions related to your account and our Services. Payments processed by third-party providers are restricted for us and when you add a payment method, we do not have access to any of your card or bank details (e.g., Stripe handles payments), and no card details can be accessed by us or stored on our systems.

Communications

When you communicate with us, we may receive additional information about you relevant to the specific communication. This may be the case when you contact our Customer Support Team. Such additional information may be any information you provide via the communication platform such as over the email, support queries or otherwise. Such information may include name, email, message content from support queries, newsletter sign-up, phone numbers, attachments.

Careers

If you apply for a job and send us any personal information such as resume, contact details for job applications, documentation, employment experience and education certificates that may be relevant to your profile processing.

B. Information Collected Automatically

Cookies

Cookies consist of small text files containing letters and numbers that we save to your browser or device storage, or tiny graphic images embedded in web pages or emails. They may persist for a single session or longer term. We deploy cookies to track your browsing, identify you among users, enable features, and evaluate Service usage. Third-party partners like analytics or ad providers might employ these tools to monitor your activities across sites and services over time.

Types of Cookies Used

• Strictly Necessary: Essential for basic Service access; we can't deliver functionality without them.
• Functional: Recognize return visits to customize content and retain settings (e.g., language or region preferences).
• Analytical/Performance: Support operations, maintenance, and enhancements. This includes our own cookies or third-party tools like Google Analytics (which may track other sites/apps).
• Marketing: Used only if you allow marketing cookies. They let us measure our advertising on Google, Facebook and Instagram and show our ads to people who visited our website. Our Cookie Policy lists the cookies involved.

Device/Usage Data

We receive information about the device and software that you use to access our website and Services such as IP address, browser type, OS, pages viewed, timestamps, inferred location (general region from IP), Service Providers, phone carriers, application installations, device type and identifiers, advertising identifiers.

Location Information

While we may infer your general location using IP address technology no precise geolocation is collected during your sessions on our website.

Usage Information

We automatically collect details on your interactions with our Services, such as pages and content viewed, searches performed, comments made, content posted, commands entered, and visit timestamps, to analyze usage patterns and continuously enhance our offerings.

C. Third-Party Information

From social logins (name, email per settings) or partners (e.g., verification services).

How We Use Collected Information

• To provide, maintain, improve, and enhance our Services.
• To communicate with you, including updates and information about our Services, requested details, responses to comments and questions, and general customer support.
• To enable connections with third-party services or applications, such as social networks.
• For marketing, such as creating and delivering promotional or advertising materials that may be useful, relevant, valuable, or otherwise interesting to you.
• To personalize your experience on our Services, for example by showing tailored content.
• To process transactions and payments.
• To detect and prevent fraud and address trust and safety concerns.
• For compliance, such as enforcing our Terms of Service or other legal rights, or meeting requirements under applicable laws, regulations, judicial processes, or government requests.
• For any other purposes where we provide specific notice at the time of collection.

De-Identified Information: We may anonymize Account Personal Data collected from or about you so it cannot reasonably be linked back to you or your device. Once de-identified, we can use or share it freely at our discretion, and this Privacy Policy no longer governs it.

Hosting and Data Storage

Our website and Services run on infrastructure of Amazon Web Services (AWS) in the European Union. The application servers and the files you upload are located in Frankfurt, Germany, with a standby server in Ireland. Our database is hosted by Neon, also in Frankfurt.

AWS and Neon process personal data on our behalf as service providers (see "How We Share Your Information"). Both belong to groups headquartered in the United States. Where that could involve access to personal data from outside the EEA, the safeguards described under "Data Transfers" apply.

If you have any questions about where your personal data is stored or processed, or wish to exercise any of your rights under applicable data protection law, please contact us at privacy@taxmo.nl.

Legal Bases for Processing (GDPR)

Consent

You have given explicit, informed consent for specific processing, such as Cookies or marketing communications (which you can withdraw anytime). Art. 6(1)(a) GDPR (consent)

Contract

Processing is necessary to perform our contract with you or for taking pre-contract steps, e.g., account registration and service delivery. Art. 6(1)(b) GDPR (performance of a contract)

Legal Obligation

Processing is required to comply with laws, such as tax/accounting/reporting rules (e.g., Belastingdienst requirements).

Legitimate Interests

We have a legitimate interest in processing for purposes like service improvement, fraud prevention, analytics, security enhancements, and product development (e.g., refining tax tools), provided it does not override your rights. You can object at any time. Art. 6(1)(f) GDPR (legitimate interest)

How We Share Your Information

Under the GDPR, we only share personal data where necessary and with appropriate safeguards (e.g., DPA contracts, SCCs for transfers). We disclose to these categories:

Affiliates

Shared with entities under common ownership/control for Privacy Policy purposes.

Service Providers

Vendors processing data on our behalf (e.g., hosting/AWS, payments/Stripe, analytics/Google, security/fraud prevention), bound by strict contracts (Art. 28 GDPR).

Advertising Partners

Only if you allow marketing cookies: Google (Google Ads) and Meta Platforms Ireland Limited (Facebook and Instagram) receive information about your use of our website. For Google this is visits and conversions such as a sign-up or a subscription. For Meta it is visits to the public pages of our website while you are logged out, and when an account reaches one of a few milestones (sign-up, onboarding completed, first entry recorded, payment added). Neither receives the contents of your bookkeeping. They process this information under their own privacy policies. You can withdraw this consent at any time in the cookie settings.

Other Users

No public profiles or sharing on Taxmo, of your Customer Data such as tax-related data which remains private. We do not operate social features.

Third-Party Integrations

If you connect apps (e.g., Belastingdienst tools), limited data shared per your action.

Legal Requirements

Disclosed if required by law (e.g., Belastingdienst audits, court orders) or to protect rights/safety (Art. 6(1)(c)/(f) GDPR).

Business Transfers

In mergers/sales, transferred to new owners with notice.

Consent

With your explicit permission.

No sales or unauthorized sharing occurs.

Connected Mailbox (Gmail and Microsoft Outlook)

You can choose to connect your own Gmail or Microsoft Outlook mailbox so that invoices, quotes and payment reminders for your own customers are sent from your own email address. This is optional and only takes effect once you connect a mailbox in Settings.

What we access

Only permission to send email on your behalf (Gmail: the gmail.send permission; Microsoft: Mail.Send), plus your email address so we know which mailbox is connected. We do not read, list, search, download or delete any email in your mailbox, and we cannot see your inbox, folders or contacts.

What we store

The email address of the connected mailbox, the provider, an access token that lets us send on your behalf (stored encrypted), the connection status and the time it was last used. As with every invoice email sent through Taxmo, the recipient, subject and content of the messages we send for you are kept in our delivery log.

How we use it

Only to send the invoices, quotes and payment reminders you create in Taxmo, when you send them or when a schedule you set up (such as a recurring invoice or an automatic reminder) sends them. We do not use it for anything else.

Who it is shared with

No one. We do not sell this data, use it for advertising, or transfer it to third parties, and our staff do not read it, except where needed for security, to comply with the law, or to provide the sending you asked for. Messages are delivered to your customers through Google or Microsoft, as with any email you send from your own account.

Stopping it

You can disconnect at any time in Settings. We then delete the stored token and, for Google, revoke the access. You can also remove Taxmo's access in your Google Account (myaccount.google.com/permissions) or your Microsoft account. Deleting your Taxmo account disconnects the mailbox and removes the stored data. If a connection stops working, invoices are sent the normal way through Taxmo instead.

Google API Services User Data Policy

Taxmo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Cookie Controls

You can manage cookies via your browser settings: block, disable, or get notifications for incoming cookies; delete existing ones; or use private/incognito mode. Note that blocking essential cookies may prevent access to parts of our Services or impair functionality.

Your Rights (EU GDPR)

If you are in the European Economic Area or the Netherlands, you have the following rights regarding your personal data under the EU General Data Protection Regulation (EU) 2016/679 (Articles 15-22):

• Access (Art. 15): Request confirmation and details of processing of your information.
• Rectification (Art. 16): Correct inaccuracies.
• Erasure (Art. 17 - "right to be forgotten"): Delete data when no longer needed or on other grounds such as where the data has been unlawfully processed.
• Restriction (Art. 18): Restrict processing of your personal data while we assess your claim on grounds of unlawful processing or contestation of data accuracy or opposing the erasure of data, requiring instead restriction.
• Objection (Art. 21): Oppose processing based on legitimate interests or direct marketing. This applies when we present you with the dialogue window requiring acceptance of this type of data processing.
• Portability (Art. 20): Receive data in a structured, commonly used, and machine-readable format (where feasible).

Further, you have the right to withdraw consent at any time (Art. 7 - free of charge, no impact on prior processing), and the right to lodge complaints with the Autoriteit Persoonsgegevens (AP), the Dutch supervisory authority under Art. 77 GDPR. You can contact the AP at autoriteitpersoonsgegevens.nl or by phone at +31 (0)88 1805 250.

Contact privacy@taxmo.nl to exercise your rights. We will verify your identity. Changes apply promptly to live systems, but retention may occur for backups, fraud prevention, legal obligations, or legitimate needs. Exceptions per applicable EU and Dutch law, including the Uitvoeringswet AVG (UAVG).

Data Transfers

Your Personal Data may be processed by TAXMO on servers located outside the European Economic Area (EEA) and Switzerland, as necessary for the purposes outlined in this policy. This includes the storage and processing of Personal Data in the United States and in other jurisdictions where our affiliates, partners, service providers, or vendors operate.

Because data protection standards differ from one country to another, and some may not provide the same level of protection as your country of residence, TAXMO applies the safeguards described in this policy to your Personal Data wherever it is processed.

When we transfer Personal Data outside the EEA or Switzerland, we ensure such transfers comply with applicable data protection laws by using valid transfer mechanisms, such as:

• Relying on adequacy decisions adopted by the European Commission under Article 45(1) of the GDPR, for countries recognized as providing an adequate level of data protection.
• Using the Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) GDPR for transfers to other jurisdictions.

If you would like further details or a copy of the safeguards implemented for such international transfers, please contact us at privacy@taxmo.nl

Data Retention

Client and business contact information, including Customer Personal Data and Account Personal Data, is retained for up to two years following the last business interaction. This retention is based on our legitimate interest (Art. 6(1)(f) GDPR) in defending against potential legal claims and resolving disputes related to our tax calculation services. Billing and payment data may be retained for up to seven years to comply with Dutch fiscal obligations (Art. 6(1)(c) GDPR).

Newsletter subscription data is retained until you choose to unsubscribe, based on your consent (Art. 6(1)(a) GDPR). You may unsubscribe at any time.

Technical and website usage data is anonymised or deleted once it is no longer required for security, maintenance, or analytical purposes.

Security

Reasonable technical/organizational measures e.g., encryption, Multifactor Authentication are employed to protect your data. While we implement industry-standard security practices, no system is completely secure.

Children's Privacy

The Service is not intended for use by individuals under 16 years of age. We do not knowingly collect data from children. If we become aware that we have collected personal data from a child under 16, we will take steps to delete such information.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice within the Service. The "last updated" date at the top of this page indicates when the policy was last revised.

Contact

For privacy-related questions, data subject requests, or concerns, contact us at privacy@taxmo.nl.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

Taxmo B.V.

KVK (Dutch Commercial Register): 42180642

NDSM-Straat 117, 1033 NA, Amsterdam, The Netherlands

‍