Privacy Policy

1. Introduction

CryptoTax.be is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Belgian crypto tax reporting service.

This policy complies with the General Data Protection Regulation (GDPR) (EU) 2016/679 and Belgian data protection laws.

2. Data Controller Information

3. Information We Collect

3.1 Personal Information

• Account Information: Name, email address, password (encrypted)
• Contact Details: Phone number (optional), mailing address (for invoicing)
• Tax Information: Tax identification number, residency status

3.2 Financial and Cryptocurrency Data

• Exchange API Credentials: Encrypted API keys for connected exchanges (e.g., Kraken)
• Wallet Addresses: Ethereum and other blockchain wallet addresses you provide
• Transaction History: Trades, transfers, deposits, withdrawals, staking rewards
• Portfolio Data: Asset holdings, historical balances, cost basis information

3.3 Technical Information

• Device Information: IP address, browser type, operating system
• Usage Data: Pages visited, features used, interaction patterns
• Cookies: Session cookies, preference cookies

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

• Contract Performance: To provide our tax reporting services
• Legal Compliance: To comply with Belgian tax laws and anti-money laundering regulations
• Legitimate Interests: To improve our services, ensure security, and prevent fraud
• Consent: For marketing communications and optional features

5. How We Use Your Information

5.1 Provide Services

• Generate accurate tax reports for Belgian tax authorities
• Calculate capital gains, losses, and taxable income
• Track portfolio performance and tax obligations
• Synchronize data from exchanges and blockchains

5.2 Legal and Compliance

• Comply with Belgian tax reporting requirements
• Meet anti-money laundering (AML) obligations
• Respond to legal requests from authorities
• Maintain records as required by Belgian tax law (7 years)

6. Data Sharing and Disclosure

6.1 Service Providers

• Cloud Infrastructure: AWS/Azure for secure data hosting
• Payment Processors: For subscription billing
• Email Services: For transactional emails

6.2 Legal Requirements

We may disclose information when required by:

• Belgian tax authorities (SPF Finances/FOD Financiën)
• Court orders or legal proceedings
• Law enforcement agencies

7. Data Security

We implement industry-standard security measures:

• Encryption: AES-256 encryption for data at rest, TLS 1.3 for data in transit
• API Keys: Encrypted storage using Spring Security Crypto
• Access Controls: Role-based access, multi-factor authentication
• Security Audits: Regular penetration testing and vulnerability assessments
• Infrastructure: Secure cloud hosting with SOC 2 compliance

8. Data Retention

We retain your data according to Belgian legal requirements:

• Tax Data: 7 years from the tax year, as required by Belgian tax law
• Account Information: Duration of account plus 7 years
• Transaction History: 7 years from transaction date
• Support Communications: 2 years from last interaction

Deleted data is securely erased from our systems and backups within 90 days.

10. Your Rights Under GDPR

You have the following rights regarding your personal data:

10.1 Access Right

Request a copy of your personal data we process

10.2 Rectification Right

Correct inaccurate or incomplete personal data

10.3 Recht op verwijdering ("Recht om vergeten te worden")

U kunt op elk moment verzoeken om uw account en bijhorende gegevens te verwijderen. Dit kan rechtstreeks via de optie "Verwijder mijn account" in de instellingen van uw profiel. Na bevestiging wordt uw data onherroepelijk verwijderd, behoudens gegevens die wij wettelijk verplicht zijn te bewaren (zoals facturen). Uw loginaccount bij onze identiteitsprovider (Auth0) wordt handmatig verwijderd binnen 14 dagen.

10.4 Restriction Right

Limit processing of your data in certain circumstances

10.5 Portability Right

Receive your data in a structured, machine-readable format

10.6 Objection Right

Object to processing based on legitimate interests or direct marketing

16. Contact Information

17. Complaints

If you're unsatisfied with our handling of your personal data, you have the right to lodge a complaint with the Belgian Data Protection Authority or your local supervisory authority.

18. Language

This privacy policy is available in Dutch (Nederlands), French (Français), and English. In case of discrepancies, the Dutch version prevails for Belgian users.

Questions? Contact us at [email protected]