Politique de confidentialité

This policy explains what personal data E-Invoice Map processes, why, and what your rights are under the GDPR ^[1].

Who is responsible

The controller is Mohamed (Mo) Farag, Carrer de Floridablanca 68, Local 9F, 08015 Barcelona, Spain. Contact: [email protected]. Details are in the legal notice.

What we process, and why

Data	Purpose	Legal basis	Kept for
Page statistics: counted from our web server log by our self-hosted GoatCounter, with no script in your browser: the page, the referring site, the browser type and the country	knowing which pages are useful	legitimate interest	aggregated counts; nothing is stored on your device, no profile of you. The log lines used for counting are kept 14 days, like the server log. If your browser sends Global Privacy Control or Do Not Track, the visit isn't counted
Lookup requests: the number you type is sent to the Peppol network (see below) and the answer is cached under a scrambled key. We keep no log of the numbers people look up	answering the lookup and caching	legitimate interest	the cached answer 24 hours
Rate limiting: a short-lived counter keyed on a hash of your IP address	the daily limits (20 lookups, 200 rows in a bulk check), abuse protection	legitimate interest	24 hours
Privacy requests: what you send through the form below, including your email	handling your request	legal obligation	your email and message 90 days after we close the request; then only the type, dates and a scrambled form of the identifier, blocked (nobody uses it), for up to 3 years as proof of how we answered
Reports and corrections ("Report a problem" at the bottom of each page): the page, your message, an optional source link and, only if you give it, your email	checking and fixing the site, and replying to you (a copy of each report is emailed to our mailbox at [email protected])	legitimate interest	12 months; your email is erased 90 days after we close the report
Notices of illegal content (the same form, "Illegal content"): the page, your explanation, your name and email	handling the notice under the Digital Services Act and telling you our decision	legal obligation	12 months; your name and email are erased 90 days after our decision
Clicks on provider links ("Visit" links to a provider's website): which provider, the country page, the page and the spot on it, the language and the day. No IP address, no cookie, nothing about you	knowing which pages help people choose, and reporting clicks to affiliate networks and to providers with a Featured listing	legitimate interest	daily totals, kept as statistics
Web server log: your IP address, the time, the page asked for (without query strings, so not the numbers you look up), the answer code and your browser type. Clicks on provider links are logged without the IP address	security, and finding and fixing errors	legitimate interest	14 days
Peppol participant data (sole traders included), from the public Peppol Directory and the Peppol network, not from you: the identifier, its scheme and country, its access-point provider and the dates we saw it	the lookup, daily counts and aggregated market shares	legitimate interest, see our assessment; Spanish law presumes it for sole traders' business data (LOPDGDD art. 19) [3]	while listed in the Directory and 12 months after it disappears; the result of each monthly check of a sample of identifiers 24 months; the counts and shares we publish contain no identifier

We never store names, email addresses or phone numbers of companies or people from the Peppol Directory or from official lists. We never sell data and never build profiles of visitors.

The e-invoice viewer

Files you open in the viewer are processed only in your browser. They are never uploaded, stored or seen by us.

The Peppol network and company registers

• Peppol network. To answer a lookup, our server asks the public Peppol network: a DNS query, then the company's own provider (its SMP server), exactly as a sender's e-invoicing software does. The provider sees the number and our server's address, not yours.
• Company-name search (Norway and France): if you type a company name and press "Search the register", your browser asks the official register directly (Brønnøysundregistrene in Norway, the Annuaire des Entreprises in France). We never see the name; the register sees it, with your IP address, under its own privacy notice.

Service providers

• Hosting: a server operated by Hetzner Online GmbH in Germany.
• Cloudflare, Inc. (USA): network delivery and security, the Turnstile bot check on the lookup and request forms, and forwarding of emails sent to [email protected]. Cloudflare processes technical connection data (your IP address, browser signals) on our behalf.
• Lettermint (Netherlands, EU servers): sends the emails you ask for (confirmation links and, if you have an account, login links and alerts). It receives your email address and the text of that email, does not track opens or clicks, and keeps delivery logs for 28 days.
• Google (Gmail): the mailbox behind [email protected]. Emails you send us, and our replies, are stored there. For that mailbox Google acts under its own privacy policy.

Transfers outside the EU. Cloudflare, Inc. and Google transfer data to the United States under the EU–US Data Privacy Framework, an adequacy decision of the European Commission ^[4]. If that framework stops applying, the European Commission's standard contractual clauses apply. You can ask us for a copy of the safeguards.

Your rights

You can ask for access, correction, erasure and restriction, and you can object to processing based on legitimate interest, including the display of lookup results for an identifier that relates to you as a sole trader: we then stop showing it and stop storing it, and keep only a scrambled form of the identifier so it isn't added again. You can withdraw a consent at any time (early access). We make no decisions about you by automated means. Requests are free; if we have real doubt who you are, we may ask for proof. We answer within 7 days and at the latest within one month (three months for a complex request; we tell you within the first month). You can also complain to the Spanish data protection authority (AEPD) ^[2].

What your browser stores for this site, and why no consent banner is needed, is on the cookies page.

Comptes : si vous créez un compte ou souscrivez une offre, la notice de confidentialité des comptes explique ce que nous conservons sur vous, et les conditions de traitement des données couvrent les listes que vous ajoutez (en anglais).

Accès anticipé à l'envoi : si vous vous inscrivez à l'accès anticipé pour l'envoi de factures électroniques, la page d'inscription explique ce que nous conservons (votre e-mail, entreprise, pays, numéro fiscal et vos réponses) et quand nous le supprimons : les inscriptions non confirmées après 24 heures, tout le reste 12 mois après l'inscription ou à la fin du test.

Demandes de service : si vous envoyez une demande via la page d'aide à l'intégration, nous conservons votre nom, votre e-mail professionnel, votre entreprise, votre pays et votre message. Finalité : vous répondre et préparer un devis. Base juridique : mesures précontractuelles prises à votre demande, art. 6, par. 1, point b) du RGPD. Nous les gardons 12 mois après votre demande, plus longtemps seulement si un contrat suit. Nous ne les utilisons jamais pour du marketing, ne les partageons pas et ne les montrons à aucun tiers. Une copie de chaque demande est envoyée par e-mail à notre boîte à l'adresse [email protected]. Nous n'acceptons pas de travaux d'entreprises établies en Espagne : les demandes venant d'Espagne sont refusées et non conservées.

Revendiquer un profil : si vous revendiquez le profil d'un fournisseur, la page de revendication explique ce que nous conservons : le domaine vérifié, la façon dont vous l'avez vérifié (un e-mail sur ce domaine ou un enregistrement DNS), les horaires et ce que vous envoyez (corrections, description, logo). Nous ne conservons ni votre nom ni votre adresse e-mail : l'unique e-mail de vérification part vers l'adresse que vous saisissez et rien n'en est gardé. L'onglet de votre navigateur garde un jeton de courte durée (2 heures) pour qu'un rechargement ne vous fasse pas perdre votre travail. Ce que vous envoyez n'est publié qu'après relecture par une personne. Les demandes sans suite sont supprimées après 90 jours, les envois refusés après 12 mois.

Liens marqués « Annonce » : quand vous en suivez un, vous passez par le réseau d'affiliation qui gère le programme partenaire du prestataire (par exemple Awin, Daisycon, Impact, PartnerStack ou Affilae) avant d'arriver sur son site. Le réseau et le prestataire peuvent alors déposer leurs propres cookies sur leurs propres sites pour savoir que vous venez de chez nous, afin que nous soyons rémunérés si vous vous inscrivez. Ces cookies sont les leurs et relèvent de leurs politiques de confidentialité, accessibles depuis leurs sites. Nous indiquons seulement au réseau sur quelle page de notre site, et à quel endroit, se trouvait le lien : jamais rien sur vous.

M'envoyer cette page : si vous nous demandez de vous envoyer par e-mail un lien vers une page, nous utilisons votre adresse uniquement pour cet e-mail et ne gardons rien : ni adresse, ni liste. Nous comptons le nombre de ces e-mails par jour, et un compteur de courte durée (une empreinte salée de votre adresse, effacée après une heure) empêche les abus.