Adapted translation from Spanish. In case of discrepancy the Spanish text prevails.
Español · OriginalThis policy explains which personal data Finomo processes, for what purpose and on what legal basis, who is involved in the processing, how long the data is kept and how you can exercise your rights. It includes information on cookies and browser storage, developed in the linked Cookie Policy.
Finomo is the brand of Evgenii Ustinov, NIF Z2074293C, with registered address at Juan Caturla Gosalvez 2, 03005 Alicante, Spain. For data protection: gdpr@finomo.es. For support: support@finomo.es. Finomo has not appointed a data protection officer; enquiries on this matter are handled at gdpr@finomo.es.
Finomo acts as controller for the identification, subscription, invoicing, payment and security data of its users and clients, including the copy of the identity document uploaded by the account holder and the result of the check that the holder is the grantor of the power of attorney before the AEAT.
Finomo acts as processor for third-party data (buyers, suppliers, employees or others) that the client provides or generates on the platform in the course of their business, and for the automatic preparation of the returns for that business and their transmission to the AEAT or the delivery of the file for filing, in accordance with the client's instructions. This processing is governed by the Data Processing Agreement; the client is the controller and handles requests from their own data subjects with Finomo's assistance. Approval of a return or the power of attorney before the AEAT does not change this allocation.
Depending on the features you use, we process: identification, NIF and contact details; the copy of the identity document (DNI, NIE or TIE) uploaded by the account holder for registering and using the power of attorney, and the result of its check; account and activity data; tax settings; invoices and expenses; payment data and bank accounts appearing on invoices; returns and history; documents and receipts; powers of attorney, approvals and consents; communications with support; and payment data for the subscription itself.
For intra-Community transactions, we process the name and VAT number of the counterparties and the result of their check in the VIES system. Access logs include the date, session identifier, IP address and the technical browser data needed for security and for the subscription record.
The data comes from you, from the documents and instructions you record and, only where an operational channel and sufficient authorisation exist, from the AEAT. An imported document retains its origin. Finomo does not ask for Cl@ve passwords, electronic certificates or private keys.
Creating and maintaining your account, providing the contracted service and handling support: Finomo acts as controller; basis, performance of the contract or pre-contractual measures (Article 6(1)(b) GDPR).
Recording the subscription, consents and approvals: controller; basis, the contract, the legal obligation to evidence electronic contracting and the legitimate interest in defending against claims (Articles 6(1)(b), 6(1)(c) and 6(1)(f)).
Issuing and collecting Finomo's invoices and keeping its accounting records: controller; basis, the contract and tax and accounting obligations (Articles 6(1)(b) and 6(1)(c)).
Checking that the account holder is the grantor, using the copy of their DNI, NIE or TIE, in order to register and use the power of attorney before the AEAT: controller; basis, performance of the contract and of the representation granted (Article 6(1)(b)); after the contract ends, retention is limited to evidencing the check (Article 6(1)(f)). It is not based on consent and no checks other than identity are carried out.
Keeping ledgers, invoices and documents on the client's behalf: processor; under the instructions of the client as controller, who determines the legal basis for their third parties' data.
Automatically preparing drafts of the returns for the client's business and their corrections, and transmitting to the AEAT those the client approves or delivering the file to them: processor; under the client's documented instructions, with separate power of attorney and approval.
Checking the VAT numbers of intra-Community counterparties in VIES: processor; client's instructions and the client's tax obligation.
Sending invoicing records to the AEAT when the client activates VERI*FACTU mode: processor; client's documented instructions and separate activation.
Protecting accounts and investigating improper access: controller; legitimate security interest (Article 6(1)(f)), with minimisation and a documented balancing test; you may object.
Handling rights requests, complaints and incidents: controller; legal obligation and defence against claims (Articles 6(1)(c) and 6(1)(f)).
Sending product news and tax calendar updates to those who consent: controller; consent (Article 6(1)(a)), which you may withdraw at any time in Settings, under Notifications, without affecting the lawfulness of earlier mailings.
Finomo does not reuse files for advertising, data sales or training artificial intelligence systems. If you do not upload the copy of your identity document or the check is not completed, Finomo does not use the power of attorney and the platform provides you with the file of the approved return so that you can file it yourself. The privacy information, acceptance of the contract, charging authorisations and each consent are separate decisions.
Currently only Finomo's owner has operational access to the data; there are no staff and no designated substitute. Finomo does not consult external professionals about a client's case and does not disclose their data to them for that purpose. The owner accesses client data only through a VPN connection, including while travelling and outside the European Economic Area; there is no separate regime for travel. That access by the operator themselves does not constitute a disclosure to third parties.
Hosting: the platform server is a virtual private server (VPS) contracted from IONOS and located in Spain. It stores the database, the documents and the local backups.
E-mail: Finomo's mailboxes (support@finomo.es, gdpr@finomo.es and the addresses used to send notices) are contracted from IONOS. IONOS SE, headquartered in Germany, and its group entities act as Finomo's processors for hosting and e-mail. Finomo does not claim that the entire IONOS chain (technical support, mail filtering, provider-side copies) takes place exclusively in Spain; it relies on the IONOS data processing agreement and its guarantees within the European Economic Area.
Off-site backup (planned, not operational): Finomo has chosen IONOS Object Storage, in the Berlin region (Germany, within the EEA), as the destination for a future daily encrypted copy with thirty days' retention and a lock preventing deletion during that period. This off-site copy is not operational: its contracting and restore test are pending. Backups are currently made only on the server infrastructure in Spain. This policy will be updated when the off-site copy is in operation.
Payments: once charging is active, the payment service provider is Stripe Payments Europe, Limited (Ireland). Stripe receives the data needed to process the payment (amount, payment method, billing e-mail) and processes card data as an independent controller for fraud prevention under its own privacy policy. Finomo does not store full card numbers. Stripe may use group entities outside the EEA under the Chapter V GDPR safeguards set out in its contract.
Spanish Tax Agency (AEAT): receives data only for the actions actually authorised (transmission of approved returns with a power of attorney, sending of invoicing records when activated and VAT number checks in VIES). The AEAT acts as a recipient authority, not as Finomo's processor.
Finomo does not sell data, does not disclose it to third parties for advertising purposes and does not plan international transfers of its own. Additions or replacements of providers that process data on the client's behalf are notified at least fifteen days in advance under the Data Processing Agreement.
After the service has actually ended, the client keeps free access to view and download their file for six calendar months if complete receipt of the archive is not on record. Once the first complete download after closure is confirmed, access ends three calendar months later, even if that date is after the initial six-month limit. Finomo notifies the specific end-of-access and planned deletion date and updates it when the download is verified. Later downloads do not restart the period; an incomplete or defective delivery attributable to Finomo is corrected and does not shorten the right of access.
An initial notice is sent at closure; then reminders every fourteen days during the first three months and every seven days thereafter; during the last calendar month before the planned deletion date, every three days. All e-mails state the specific date. Closure occurs when the service actually ends; cancelling the renewal does not bring it forward. Months are calculated in the Europe/Madrid zone and access lasts until the end of the notified day. No payment of a debt, renewal or revocation of a power of attorney is required to view, download or exercise rights.
When access ends, data that no longer needs to be kept is deleted. Evidence needed under a legal obligation or to deal with liabilities is separated by category, purpose, access and period, with restriction and blocking where appropriate. The entire file is not kept indiscriminately. Backups follow their own cycle and a restore re-applies deletions and restrictions before data is re-enabled.
Periods by category. View-and-download archive: six months without a complete download, or three months from the first complete receipt. Finomo's own invoices and accounting records: the longer of two periods, that resulting from tax law or six years from the last entry under the Commercial Code. Subscription record, powers of attorney, approvals and return evidence: for the duration of the contract and the limitation period for actions arising from it, separating each category by purpose; no single period applies to the whole file. Copy of the grantor's identity document and check result: for the duration of the contract and five years after it ends, solely to evidence that check. Support conversations: twelve months after the request is closed, unless part of them is necessary evidence, which is separated with its own basis. Technical diagnostics: ninety days. Temporary export ZIP archive: seven days, regenerable within the archive window. Incomplete uploads: twenty-four hours. Ordinary form drafts in the browser: seven days of inactivity. Ordinary security logs: six months; those linked to an investigation, for as long as it lasts and is documented. Off-site backups, once operational: thirty days' retention.
The viewing period is not a silent period authorising deletion of what must be kept. For processing on the client's behalf, their choice of return or deletion is honoured under the Data Processing Agreement. On request you are informed of the categories kept, their basis and their period; rights remain available after the archive.
You may request access, rectification, erasure, restriction, objection and portability; withdraw a consent without affecting the lawfulness of earlier processing; and exercise rights relating to automated decisions, if any. You can do so from your Finomo account or by writing to gdpr@finomo.es. You do not need an active subscription or to pay a debt.
If the request is made from the authenticated account, that evidence is used and you are not asked for redundant documents. If there are reasonable doubts about identity or representation, verification is proportionate; a full copy of the DNI is not always required and another person's file is not handed over through an authenticated account. We reply without undue delay and, as a general rule, within one month; if an extension is warranted by complexity or the number of requests, you are informed within the first month, with the reasons and the new date, for up to two additional months.
Third parties whose data Finomo processes on a client's behalf (buyers, suppliers, employees) should contact that client, who is the controller; Finomo forwards requests received within a maximum of two working days. The workspace export is a return and access feature; legal portability has its own scope. Erasures, rectifications and restrictions are applied in the database, in later exports, in the logs and, through the deletion register, in restored backups.
You may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) and seek the appropriate judicial remedy.
The platform automatically prepares drafts of returns and their corrections from the data and documents the client provides, applying coded rules and consistency checks. Before making a draft available to the client, Finomo may verify that the system is working correctly; that verification is a software quality control, not a review of the client's tax situation, and never modifies their data.
Automatic warnings about missing, contradictory or blocking information are generated with the same rules for all clients and offer a general explanation of the rule applied; they do not tell the client which data to enter in their case.
The client reviews and approves each return; without their express and individual approval no return is transmitted and no file is delivered. Finomo therefore makes no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). Finomo does not receive, monitor or read AEAT notifications and communications addressed to the client.
Introducing analytics, advertising or features based on artificial intelligence requires prior assessment and information; this policy does not authorise them, except for sending news with consent as provided in section 3.
Finomo applies technical and organisational measures proportionate to the risk: minimal access and individual credentials, isolation between clients, encryption of communications, protection of credentials and of the electronic certificate, recoverable backups, operation logging and incident management. The measures are described in the Data Processing Agreement and reviewed periodically. Finomo holds no third-party security certifications and does not claim any.
Where Finomo is the controller in respect of a security breach, it notifies the Spanish Data Protection Agency without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals, documenting the decision. If there is a high risk, it informs you without delay. As processor, Finomo informs the client controller without undue delay and cooperates with them, without waiting to complete the full investigation. A technical incident is not automatically a notifiable breach; it is assessed and documented.
Finomo uses only cookies and browser storage strictly necessary for the session, security and recovery of forms you have started to fill in; they do not require consent. No advertising, tracking or third-party cookies for those parties' own purposes are used. There is no active analytics; if it were activated in the future, your consent would be requested with equally visible accept and reject options, and refusing would not prevent you from using the service.
When making a payment, the Stripe components embedded in the payment page may set cookies necessary to complete the transaction and prevent fraud, under Stripe's policy.
Clearing browser storage may lose a pending local recovery of a form; it does not delete documents already saved on the server. The browser may keep temporary copies of documents viewed. The linked Cookie Policy details each element, its purpose and its duration.
Each version of this policy is identified by its edition and date and its predecessor is retained. Changes affecting your rights are notified before they apply. The original is the Spanish version; translations are informational and state their version and source.
For any question about this policy or your data: gdpr@finomo.es.
Evgenii Ustinov · NIF Z2074293C
Juan Caturla Gosalvez 2, Alicante
Contact: support@finomo.es
Personal data: gdpr@finomo.es