Additional Data Protection information

This document expands the Privacy Policy with additional information on the processing of personal data carried out by TRIBUTAI SOLUTIONS, S.L. (hereinafter, "TRIBUTAI"), in accordance with article 13 of Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).

It includes, by category of data subject, the purposes, legal bases, data disclosures, international transfers and retention periods; as well as the list of data processors and the relationship with Public Administrations.

The detail set out here comes from our Record of Processing Activities (Art. 30 GDPR), of which only the part relevant to data subjects is published; the specific technical measures, the named allocation of access and the internal security procedures remain internal documentation that is not disclosed.

TRIBUTAI has appointed an external and independent Data Protection Officer (DPO), the firm LetsLaw, which oversees the processing of personal data. You can contact the DPO at the mailbox dpo@tributai.es, which is only for data protection.

TRIBUTAI acts as Data Controller (Art. 24 GDPR) for the following categories of data subjects.

3.1. Customers

Categories of data: identification (first name, surnames, DNI/NIF), contact (address, phone, email), tax-related, economic, banking and invoicing data, and documentation provided for the provision of the service (invoices, returns, tax forms, receipts).

Purpose: provision of AI-assisted tax advisory intermediation services, management and filing of procedures with the Public Administration for self-employed people, support and customer service.

Legal basis: performance of a contract (Art. 6.1.b GDPR); compliance with legal obligations in tax, fiscal and Social Security matters (Art. 6.1.c GDPR). Consent is required for commercial communications (Art. 21.2 LSSI-CE).

Disclosures: AEAT, TGSS and other competent public bodies when necessary to provide the service or comply with legal obligations. Technology processors and sub-processors (see section 6).

3.2. Employees (Payroll, Personnel and HR)

Categories of data: identification (first name, surnames, NIF/DNI, Social Security no., address, phone); personal characteristics (marital status, date and place of birth, sex, nationality); academic and professional (education, experience); employment (position, non-financial payroll data, history); economic and banking data for payroll management.

Purpose: management of the employment relationship, occupational risk prevention obligations, training and professional development.

Legal basis: performance of a contract (Art. 6.1.b GDPR) and compliance with legal obligations in employment, tax and Social Security matters (Art. 6.1.c GDPR).

Disclosures: Tax Administration, General Treasury of Social Security, Occupational Accident Mutual Insurers and/or Insurance Entities.

3.3. Job candidates

Categories of data: identification, contact, academic and professional (CV, experience, education).

Purpose: management of selection processes and unsolicited applications.

Legal basis: application of pre-contractual measures at the request of the data subject (Art. 6.1.b GDPR).

3.4. Suppliers and external collaborators

Categories of data: identification (first name and surnames, DNI/NIE), contact (phone, email, postal address), banking and invoicing, professional (company name, CIF, contact person, type of service).

Purpose: management of the contractual, administrative, accounting and tax relationship with suppliers.

Legal basis: performance of a contract (Art. 6.1.b GDPR) and, in tax and accounting matters, compliance with legal obligations (Art. 6.1.c GDPR).

Disclosures: Tax Administration, financial institutions, external advisers and technology providers when necessary.

When a Customer uses the platform to handle tax obligations relating to third parties linked to their economic activity (for example, data of their own customers included in invoices or tax forms), TRIBUTAI acts as Data Processor under article 28 GDPR, and processes that data exclusively under the Customer’s (Controller’s) documented instructions.

Third parties linked to the Customers’ activity:

• Categories of data: identification, contact, economic, tax-related, banking and documentation associated with the Customer’s procedures.
• Purpose: management and processing of the Customer’s tax and administrative obligations.
• Legal basis: that which corresponds to the Customer as Controller, under the data processing agreement signed.
• Disclosures: competent Public Administrations and technology providers strictly necessary to carry out the service.

In accordance with article 13.2.a) GDPR, the periods foreseen for the deletion of the different categories of data are set out below. Where tax, commercial or employment regulations set mandatory periods, these will prevail over contractual criteria.

In accordance with article 28 GDPR, the following providers access personal data on behalf of TRIBUTAI under a data processing agreement, contractually obliged to apply appropriate security measures and to process the data exclusively in accordance with our instructions.

The list is updated with each change of provider. If you need the full, current inventory, you can request it by exercising the right of access (Art. 15 GDPR) at dpo@tributai.es.

The following public bodies do not act as data processors within the meaning of article 28 GDPR, but as competent authorities or public systems receiving information in compliance with legal obligations applicable to the user or the Customer. They are documented as recipients of data disclosures:

• State Tax Administration Agency (AEAT): census procedures (form 036) processed through CIRCE and, when the user requests it, the data of the returns that the user files themselves at the e-office.
• General Treasury of Social Security (TGSS): management of registration procedures and obligations in Social Security matters.
• CIRCE / PAE: online processing of self-employed registrations and the Single Electronic Document (DUE).
• Spanish Land Registry (Catastro): normalisation and validation of tax addresses.
• TicketBAI: submission of electronic invoicing information for users subject to it.
• VeriFactu: submission and chaining of electronic invoicing records (functionality implemented, activation pending).

These disclosures are made as part of compliance with the legal obligations of the data subject or the Customer and are supported by article 6.1.c) GDPR.

Certain technology providers involve international transfers of data outside the European Economic Area (EEA), mainly to the United States for transactional email (SendGrid/Twilio) and social authentication (Google, Microsoft).

In all cases we apply the safeguards provided for in articles 44 et seq. of the GDPR:

• EU-US Data Privacy Framework (DPF) when the provider is certified and the European Commission’s adequacy decision applies.
• Standard Contractual Clauses (SCC) Module 2 under Decision (EU) 2021/914 when the provider is not covered by the DPF or as an additional safeguard.
• Transfer Impact Assessment (TIA) where appropriate, assessing the regulatory framework of the destination country.

You can request detailed information about the specific safeguards applied to each transfer by writing to dpo@tributai.es.

In accordance with article 32 GDPR, we apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption in transit (TLS) and encryption at rest.
• Field-level encryption for especially sensitive information and key management through cloud HSM.
• Role-based access control and least privilege (RBAC/IAM), with enhanced authentication for critical operations.
• Segregation of development and production environments.
• Continuous monitoring, immutable audit logs and anomaly detection mechanisms.
• Antivirus scanning of documentation uploaded by users.
• Anti-fraud mechanisms: device fingerprinting, trust scoring, distributed rate limiting and anti-bot protection.
• Encrypted backups retained for 30 days.
• Privacy by design and by default procedures (Art. 25 GDPR) and data minimisation.

The measures are reviewed periodically and whenever there is a significant change in the processing. The specific technical detail forms part of the internal security documentation and is not disclosed publicly so as not to compromise the security of the system itself.

We have an internal procedure for managing security incidents and breaches aligned with articles 33 and 34 GDPR:

• Detection, identification and classification of the incident (confidentiality, integrity or availability).
• Assessment of the risk to the rights and freedoms of data subjects.
• Where applicable, notification to the Spanish Data Protection Agency (AEPD) without undue delay and, in any case, within 72 hours of TRIBUTAI becoming aware.
• Where the breach is likely to result in a high risk to the rights and freedoms of natural persons, communication to the data subject without undue delay, in clear and plain language.
• Documentation of all facts relating to the breach, the corrective measures adopted and the assessments carried out, available to the Supervisory Authority.

To report a suspected security incident you can write to security@tributai.es.

TRIBUTAI uses artificial intelligence (Claude by Anthropic, through Google Cloud Vertex AI in the European Union; and Google models for OCR/document analysis) to assist the user with tax queries and document processing.

In accordance with article 22 GDPR, we inform you that:

• AI-generated answers are for guidance only and do not constitute binding professional tax advice.
• Official procedures before the Administration (AEAT, TGSS, CIRCE) are subject to human supervision by qualified staff before they are submitted.
• You have the right to request human intervention, express your point of view and contest any decision based solely on automated processing that produces legal effects on you or significantly affects you, by writing to dpo@tributai.es.

In accordance with Regulation (EU) 2024/1689 (AI Act), our AI systems are classified as limited risk; tax advice is not a high-risk category under Annex III.

You can exercise at any time your rights of access, rectification, erasure ("right to be forgotten"), restriction, portability, objection and not to be subject to automated individual decisions (Arts. 15 to 22 GDPR) at:

• Email to the DPO: dpo@tributai.es.
• Rights request form (interactive digital version).
• Post to TRIBUTAI SOLUTIONS, S.L. — CL. General Vives, 56, 2 Pta. D, Oficina 201, 35007 Las Palmas de Gran Canaria.

We will reply within a maximum of one month from receipt of the request (Art. 12.3 GDPR), extendable by two additional months in complex cases. To verify your identity we may ask you for additional information (Art. 12.6 GDPR).

If you consider that the processing does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), headquarters at C/ Jorge Juan, 6, 28001 Madrid.