Privacy Policy

1. Introduction

CryptoTax.be is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Belgian crypto tax reporting service.

This policy complies with the General Data Protection Regulation (GDPR) (EU) 2016/679 and Belgian data protection laws.

2. Data Controller Information

3. Information We Collect

3.1 Personal Information

• Account Information: Name, email address, password (encrypted)
• Contact Details: Phone number (optional), mailing address (for invoicing)
• Tax Information: Tax identification number, residency status, and (if you record it) the registration status of your foreign accounts with the National Bank of Belgium (CAP)
• Business Information (accountants): firm name, VAT number, billing address and team membership within an accountant workspace

3.2 Financial and Cryptocurrency Data

• Exchange API Credentials: Encrypted API keys for connected exchanges (e.g., Kraken)
• Wallet Addresses: Ethereum and other blockchain wallet addresses you provide
• Transaction History: Trades, transfers, deposits, withdrawals, staking rewards
• Portfolio Data: Asset holdings, historical balances, cost basis information

3.3 Technical Information

• Device Information: IP address, browser type, operating system
• Usage Data: Pages visited, features used, interaction patterns
• Cookies: Session cookies, preference cookies

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

• Contract Performance: To provide our tax reporting services
• Legal Compliance: To comply with Belgian tax laws and anti-money laundering regulations
• Legitimate Interests: To improve our services, ensure security, and prevent fraud
• Consent: For marketing communications and optional features

5. How We Use Your Information

5.1 Provide Services

• Generate accurate tax reports for Belgian tax authorities
• Calculate capital gains, losses, and taxable income
• Track portfolio performance and tax obligations
• Synchronize data from exchanges and blockchains

5.2 Legal and Compliance

• Comply with Belgian tax reporting requirements
• Meet anti-money laundering (AML) obligations
• Respond to legal requests from authorities
• Maintain records as required by Belgian tax law (7 years)

6. Data Sharing and Disclosure

6.1 Service Providers

• Hosting Infrastructure: Hetzner (EU data centers) for application hosting and Cloudflare for content delivery and encrypted file storage
• Identity Provider: Auth0 for secure login and authentication
• Payment Processors: Stripe for subscription billing
• Email Services: Mailgun (EU region) for transactional emails
• Blockchain and Market Data Providers: To build your reports we query blockchain indexers and price data providers (such as Moralis, Alchemy and Etherscan) with the wallet addresses you provide, and the APIs of exchanges you connect

6.2 Accountant Access

You can grant read-only access to your CryptoTax.be account to a third party, such as your accountant or tax advisor, by sending an invitation from within your account settings. With this access the third party can view your tax data but cannot modify it. The legal basis for this sharing is your consent (GDPR Article 6(1)(a)). You can revoke this access at any time from your account settings, after which the third party immediately loses all access to your data.

In addition, an accountant who manages your tax file with your mandate can create a managed client file for you on CryptoTax.be. In a managed file the accountant can, on your behalf, add data sources (wallet addresses, exchange connections, CSV files), apply corrections to your tax data, and finalize your tax report. If you already have a CryptoTax.be account with the same email address, the managed file is linked to that account. The legal basis for this processing is the agreement between you and your accountant (GDPR Article 6(1)(b)); the accountant confirms to us that they hold your mandate. Accountants and their team members are contractually bound by our accountant terms of use, including strict confidentiality and security obligations.

Questions about a managed file, or want to end a collaboration? Contact your accountant or reach us at [email protected].

6.3 Legal Requirements

We may disclose information when required by:

• Belgian tax authorities (SPF Finances/FOD Financiën)
• Court orders or legal proceedings
• Law enforcement agencies

7. Data Security

We implement industry-standard security measures:

• Encryption: AES-256 encryption for data at rest, TLS 1.3 for data in transit
• API Keys: Encrypted storage using Spring Security Crypto
• Access Controls: Role-based access, multi-factor authentication
• Security Audits: Regular penetration testing and vulnerability assessments
• Infrastructure: Secure cloud hosting with SOC 2 compliance

8. Data Retention

We retain your data according to Belgian legal requirements:

• Tax Data: 7 years from the tax year, as required by Belgian tax law
• Account Information: Duration of account plus 7 years
• Transaction History: 7 years from transaction date
• Support Communications: 2 years from last interaction

Deleted data is securely erased from our systems and backups within 90 days.

9. Your Rights Under GDPR

You have the following rights regarding your personal data:

9.1 Access Right

Request a copy of your personal data we process

9.2 Rectification Right

Correct inaccurate or incomplete personal data

9.3 Erasure Right ("Right to be Forgotten")

You can request to delete your account and associated data at any time. This can be done directly via the "Delete my account" option in your profile settings. After confirmation, your data will be permanently deleted, except for data we are legally required to retain (such as invoices). Your login account with our identity provider (Auth0) will be manually deleted within 14 days.

9.4 Restriction Right

Limit processing of your data in certain circumstances

9.5 Portability Right

Receive your data in a structured, machine-readable format

9.6 Objection Right

Object to processing based on legitimate interests or direct marketing

10. Contact Information

10.1 Complaints

If you're unsatisfied with our handling of your personal data, you have the right to lodge a complaint with the Belgian Data Protection Authority or your local supervisory authority.

Questions? Contact us at [email protected]