Privacy Policy
Privacy Policy
The Bluedot-group products, services and website are operated under VATBox Ltd (“VATBox”, “we”). VATBox is committed to maintaining the privacy of individuals (“user”, “you”) who use the VATBox Website and Platform (as defined below). The following information describes how VATBox collects and processes information about you when you use our Website, Platform and Services (as defined below).
Our privacy policy (“Privacy Policy”) explains:
- What information we collect and why we collect it
- How we use that information
- Your rights with regard to the collection of such information
By using our Website, Platform and Services, you agree to this Privacy Policy.
General
VATBox provides its customers (“Customers”) with a centralized, standardized & digitalized VAT Compliance Platform (“Platform”), that views into all employee-driven transactions, ensures tax compliance and reduces tax vulnerabilities for consumer-style spend across the enterprise (“Services”). The Platform includes various solutions such as the VATBox Solution, that enables the calculations of any eligible and qualified VAT/GST spend (“VATBox Solution”). The VATBox Solution optimizes, manages, and analyzes the user’s cross-border and domestic VAT/GST recovery processes, while identifying unclaimed returns and avoidable costs. VATBox also provides the Taxable Employee Benefit solution (“TEB Solution”), that provides the user with an efficient method to review transactional data from an employment tax perspective, while considering the tax regulation applicable to the respective user. The TEB Solution then optimizes, manages, and analyzes the user’s processes while identifying taxable employee benefits. The Services also include the Corporate Income Tax Solution (“CIT Solution”), that enables Customers to customize taxation rules to suit their needs, by utilizing an AI-driven application that analyses which part of the spend should not be allocated for business purposes and thus disallowed to be deducted from taxable profits. VATBox’s website (“Website”) provides information on VATBox, the Platform and the Services and enables its users to contact VATBox, with respect to the Website, Platform and Services.
Collecting Information
Please note that the scope of this Privacy Policy is limited only to information collected by VATBox through your use of its Website and Services. Some information may be automatically collected, and some is collected when you interact with our Website and Platform. The type of information that may be automatically collected is non-personal information, which includes your session durations, the content you accessed on the Website or Platform, the frequency and scope of your use of the Website and Platform and information about your computer and internet connection including the operating system you use and browser type.
Information from which you can be personally identified may also be collected, including but not limited to your name, address, email address, telephone number, company, job title and the location of the computer through which you used the Website and Platform (hereinafter: “Personal Information”).
VATBox will follow its Customer’s instructions with respect to any processing or restriction of processing of Personal Information. Please note that the provision of the Platform, does not require the collection of Personal Information. As further mentioned below, VATBox may process Personal Information when providing its Services, but only, and to the extent the Customer requires VATBox to do so, and when it is required for the provision of the VATBox Solution the Customer contracts to be provided with. In case Customer wishes VATBox to avoid the processing of Personal Information, VATBox will cooperate with the respective Customer and shall make its best efforts to tailor the Services to facilitate their request.
When Personal Information will be collected, it will be conducted, without limitation, via the following ways:
- Log in via the Website
If you wish to log in to the Platform or the Website, we will collect your Personal Information such as your assigned username and password, to enable you to use the Services that are made available via the Platform or Website.
- Personal Information Collected for Authentication and Access to the Platform
We collect some Personal Information to authenticate users who wish to utilize our Platform and who are authorized to do so by our Customers. Such information includes the name and surname of the user (Customer’s personnel), company or office address, corporate email address and corporate phone number.
- Using the VATBox, TEB or CIT Solution
If you wish to utilize the Services via the Platform, we will collect your Personal Information included in the account registration details which include, but may not be limited to, your name, email number and country. In addition, we will collect, to allow the Services to be performed, the available expense data and expense images (receipts, invoices or other documents associated with the data), made available by you directly or indirectly by allowing Vatbox access the systems where this data is stored.
Please note that the information and Personal Information we collect when we are provided with expense reports in a structured format may include if included un the reports; name and surname of expense reporter, company/office address, corporate email address, corporate phone number, if populated by the reporter – Guest IDs – (Names or email contacts) and if populated and depending on Customer’s process of expense reporting – custom fields that may include comments and details that may include Personal Information.
- Personal Information Collected via Expense Images (Invoice Images)
We store all images securely in original form as part of the evidence for tax processing. Any specific Personal Information included within images will not be further processed unless specifically requested by the Customer and such processing is not an infringement of applicable regulations.
We do not actively collect Personal Information from the expense/invoice images provided by our Customers, but Personal Information may be collected incidentally as such images can contain various data as listed below:
- Name and Surname of expense reporter.
- Company/office address.
- Corporate email address.
- Corporate phone number.
- Guest IDs – (Names or email contacts) if there are multiple guests to an invoice.
- Arbitrary Personal Information data handwritten or added to the image.
Please note that in respect to the above, VATBox’s Services do not require the processing of Personal Information included on expense images, and once incidentally exposed to such Personal Information because provided by Customer, VATBox shall not use it for the provision of its Services. Therefore, we advise our Customers to sanitize the images for any Personal Information content.
- Book a Demo
If you wish to book a demo via the Website we will collect your full name, email address, phone number, company name, country, job title, and whether you’re currently reclaiming VAT or having a TEB or CIT analysis process currently in place, to facilitate your inquiry.
- Contacting Us
If you wish to contact us for support regarding the Services, our Website or this Privacy Policy, we will collect your full name, email address, phone number, company name, job title, and the content you submitted to facilitate your inquiry.
- Applying for a Job
If you wish to apply for a job at VATBox, we will collect the information you provided in your resume, portfolio, your full name, your personal note, and contact information (email, and phone number), to process your resume in our information systems dedicated to recruitment and HR management, as well as to contact you with respect to a potential position at VATBox.
Use of Information
We use Personal Information we collect from you for a range of different business purposes according to different legal bases of processing. We may use or process your Personal Information for the following purposes. One or more purposes may apply simultaneously.
- Providing the Requested Services
- We collect Personal Information to provide Customers with the Services they contracted to receive, enable users to contact us with inquiries, and to provide users with opportunities to apply for a job at VATBox.
- We process expense related data to provide Services pertaining to tax reclamation, tax compliance or taxable employee benefits, and all in accordance with the service agreement we obtain with our Customers. Accordingly, we collect your VATBox Solution, TEB and CIT Platform registration details as well as the expense reports and expense evidence images (receipts, invoices or other documents associated with the data) you choose to upload to the Platform, or provide VATBox with access to, and all to enable you to use the Platform and provide our Customers with the Services.
Such collection of information will enable us to provide you with technical and professional assistance, with regard to the Services you use or intend to use. We process this Personal Information where it is necessary for the adequate performance of the contract regarding the requested Services or negotiation of an employment contract with you.
- Improvement and Development of the Services
- We collect Personal Information to improve and develop our Services and understand feedback on VATBox’s Services and Platform and to help provide more information on the use of the Platform and Services quickly and easily.
- We collect Personal Information for ongoing review and improvement of the information provided on our Website and Platform to ensure it is user friendly.
- We collect Personal Information to improve the management and administration of our business and maintain compliance with our internal policies and procedures.
- We conduct surveys and research, test features in development, and analyze the information we have to evaluate and improve our Services, develop new features, and conduct audits and troubleshooting activities.
We process this information in light of our legitimate interest in improving the Website, Platform and Services, to allow our users to have the best experience.
- Maintain a Safe and Secure Environment
We may use your information to detect and prevent fraud, abuse and security incidents in the following ways:
- Verify and authenticate your identity and prevent unauthorized or illegal activity;
- Enhance the safety and security of our Platform and Website;
- Conduct security investigations and risk assessments;
- Prevent or take action against activities that are, or may be, in breach of our terms of service or applicable law.
We process this information in light of our legitimate interest in securing our Website and Services and enabling our users to browse in a secure environment.
Obtaining consent
When consent is needed for collecting and processing Personal Information, we may obtain consent through one of the following mechanisms:
- Through an interactive form which the individual chooses whether to accept processing for purposes.
- Through forms on which the Personal Information is submitted by the relevant individual.
- Through the act of submitting the Personal Information to VATBox by the individual via any form (electronic or paper).
Disclosure of Information and Transfer of Data
We reasonably attempt to ensure that we never intentionally disclose any of your Personal Information, to any third party without having received your permission, except as provided for herein and in this Privacy Policy or otherwise as permitted or required under law.
In order to perform our contractual and other legal responsibilities or purposes, we may, from time to time, need to share your Personal Information with third parties. We may as well share your Personal Information with our affiliates, subsidiaries or any third party service providers and individuals to facilitate our Services or any portion thereof, such as marketing, hosting, data management or maintenance services. We may also share your information with analytics service providers for analytics services. Such analytics service providers set their own cookies or other identifiers on your computer, through which they can collect information about your usage of our Website and Platform. This helps us compile aggregated statistics about the effectiveness of our Platform, Website and Services.
The above mentioned third parties may be located in countries other than your own, and we may send them information we receive. When such third party service providers process your Personal Information on our behalf, we will assure that they comply with obligations similar to those which are set forth in this Privacy Policy. We will also assure that they will abide by our data privacy and security requirements, and will be allowed to use the Personal Information solely for the purposes we set. We will transfer your Personal Information while using appropriate and suitable safeguards, while using a variety of legal mechanisms, including contracts, to ensure your rights and protections travel with your data.
We may also transfer your information, including Personal Information, in connection with a corporate merger, consolidation, the sale of related assets or corporate division or other fundamental corporate changes. Furthermore, information about you may also be released in order to comply with any valid legal obligation or inquiry or process such as a search warrant, subpoena, statute or court order. We will also release specific information in special cases, such as if you use the Website and/or Platform to perform an unlawful act or omission or take any act or omission that may damage VATBox, its property and goodwill, or if there is an attempted breach of the security of the Website and Platform or a physical or property threat to you or others. The authority supervising such activities is the Israeli Privacy Protection Authority, and you have the right to file a complaint to it or any other relevant supervisory authority.
Roles and Responsibilities
Please note that certain data protection laws and regulations, such as the GDPR or the California Privacy Laws (as defined below) typically distinguish between two main roles for parties processing Personal Information: the “Data Controller” (or under the California Privacy Laws, “Business”), who determines the purposes and means of processing; and the “Data Processor” (or under the California Privacy Laws, “Service Provider”), who processes the data on behalf of the Data Controller (or Business). Please see the below explanation where we elaborate on how these roles apply to our Services, to the extent that such laws and regulations apply.
- VATBox is the “Data Controller” of its Website users and Customer’s contact details required to contractually engage with the respective Customer. With respect to such data, we assume the responsibilities of the Data Controller (solely to the extent applicable under the law), as set forth in this Privacy Policy. In such instances, our service providers processing such data will assume the role of “Data Processor”.
- VATBox is the “Data Processor” of the Personal Information of Customers’ employees and individuals which we process on behalf of our Customer (who is the “Data Controller” of such Personal Information). Our service providers who process such user Personal Information on our behalf are the “Sub-processors” of such Personal Information. Please note that the processing of Personal Information by us on behalf of our Customers, will be further addressed in a mutual Data Processing Agreement.
For the avoidance of doubt, each Customer is solely responsible for providing adequate notice to the individuals whose Personal Information may be processed by VATBox for the provision of the Services. This includes, to the extent required, sufficient reference to the processing of their Personal Information via the Platform, and any other information necessary to comply with all applicable privacy and data protection laws and obtaining all approvals and consents from individuals as required under the applicable laws.
Your Rights
You have the right at any time to request to access or modify your information. To exercise these options, please contact us at [email protected].
In some jurisdictions, in particular those located within the European Union (the “EU”) or within the European Economic Area (the “EEA”), you may be afforded specific rights regarding your Personal Information. Subject to such eligibility, you may have the following rights to:
- Request a rectification of your Personal Information where the information we hold about you is incorrect or incomplete.
- Object to the processing of your Personal Information for direct marketing purposes.
- Object to the processing of your Personal Information where our legal basis for that processing is that such processing is necessary for our legitimate interests.
- Object to automated decision-making (including profiling) in certain circumstances.
- Request the erasure of your Personal Information in certain circumstances, such as where processing is no longer necessary for the purpose it was originally collected for, and there is no compelling reason for us to continue to process or store it.
- Receive your Personal Information, or ask us to transfer it to another organization that you have provided to us, which we process by automated means, where our processing is either based on your consent or is necessary for the performance of a contract with you.
Generally, with regard to information collected on our Website, VATBox is a “Data Controller”. Therefore, if you wish to exercise the above mentioned rights, please contact us, and we will make our best efforts to fulfill your request.
If we are a Data Processor with respect to your Personal Information, we will notify the relevant Customer/Controller about your request, and make our best efforts to enable them to allow you to exercise your rights.
If you wish to file a request regarding any of the above, you may contact us at: [email protected]
Notice to California Residents
This section is designated for California residents and is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (“California Privacy Laws”). It explains your privacy rights, provides “notice at collection”, and provides certain mandated disclosures about how we handle your Personal Information. This section uses certain terms that have the meanings given to them by the California Privacy Laws, unless otherwise specified. Please note that some of the disclosure obligations required under the California Privacy Laws are satisfied within other sections of this Privacy Policy.
The California Privacy Laws permit some users to request to exercise certain rights. If these rights are applicable to you, you are afforded with the following rights:
- Right of access
You can request VATBox for certain information about our practices with respect to your Personal Information. In particular, you can request to receive information on the following:
- The categories and specific pieces of your Personal Information that we have collected.
- The categories of sources from which we collected your Personal Information.
- The business or commercial purposes for which we collected or share your Personal Information.
- The categories of third parties with which we shared your Personal Information.
- We do not sell your Personal Information
You can be rest assured that we do not sell your Personal Information.
- Right to Limit Use and Disclosure of Sensitive Personal Information
We do not share sensitive Personal Information for cross-context behavioral advertising and we do not sell sensitive Personal Information.
- Exercising your California Law Rights
Please note that we will be required to verify your identity and request before an action is taken to exercise your rights. As a part of this process, government identification may be required. Moreover, you may designate an authorized agent to make a request on your behalf. We make our best efforts to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. Any disclosures we provide, will only cover the 12 months period preceding your verifiable request’s receipt. If, for some reason, we cannot reply within such time frame, our response will include an explanation for our inability to comply. If you wish to exercise your California Privacy Laws rights, please contact us at: [email protected] .
- Right of No Retaliation Following Opt-Out or Exercise of your Rights
If you choose to exercise your rights, we will not charge you different prices or provide different quality of our Services, unless those differences are related to your provision of your Personal Information. We will not discriminate against you for exercising any of your rights and unless permitted by the California Privacy Laws, we will not:
- Deny you goods or services.
- Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
- Provide you with a different level or quality of goods or services.
- Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
CAN SPAM Act
The CAN-SPAM Act is a Federal US law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out strict penalties for violations.
To be in accordance with CAN-SPAM, VATBox agrees to the following:
- Not use false or misleading subjects or email addresses.
- Identify the commercial message sent to you as an advertisement when required.
- Include the physical address of our business or site headquarters.
- Monitor third-party email marketing services for compliance, if one is used.
- Honor opt-out/unsubscribe requests quickly.
- Allow users to unsubscribe by using the link at the bottom of each email.
If at any time you would like to unsubscribe from receiving future emails, you can email us at [email protected] and we will promptly remove you from ALL correspondence.
Cookies
We may use “cookies” and/or other technologies or files (collectively, “cookies”) to identify how visitors make use of this Website and our Platform. This aggregated tracking information may be used to help us improve and enhance the Website and Platform experience for all of our users. In addition, cookies are used for adjusting the Website and Platform to your personal preferences. Cookies contain information such as the pages you visited, the length of time you stayed on the Website and Platform, the location from which you accessed the Website, Platform and more. If you would prefer not to have cookies stored on your computer, you may modify your browser settings to reject most cookies, or manually remove cookies that have been placed on your computer. However, by rejecting the cookies, you may be unable to fully access the offerings on this Website and Platform. To find out more about cookies, visit www.allaboutcookies.org. or VATBox’s Cookie Policy.
Opt In or Opt Out
You are always in control of your data, and if you choose to receive information from us, or others, you can change your mind later. If, at any time, you would like to stop receiving such information or opt out of a feature, you may notify us by writing to [email protected] . You should be aware, however, that it is not always possible to completely remove or modify information in our databases and servers, although we will always make reasonable efforts to do so upon your request.
Links to Other Websites
This Website and Platform may provide links to other websites. Please be aware that these other websites are not covered by our Privacy Policy. This Privacy Policy does not cover the information practices exercised by other providers of products or services, advertisers or other websites, companies or individuals, which are not owned or controlled by VATBox. We suggest that when linking to another website, you always read that website’s privacy policy before volunteering any personally identifiable information.
Data Security
We deploy industry standard measures to ensure the security, confidentiality, integrity and availability of the Personal Information we process. We maintain physical, technical and administrative safeguards, and test and update these periodically. We endeavor to restrict access to Personal Information on a ’need to know’ basis for the provision of Website, Platform and Services to you. No such measures are perfect or impenetrable. In the event of a security breach, we will take all reasonable action to minimize any harm. Although we will do our best to protect Personal Information, we cannot guarantee the security of data transmitted to us and transmission is at the users own risk.
Technical Measures Implemented to Secure the Transmission of Personal Information
During the technical transmission of Personal Information between systems, we always aim to use secure transfers and communication channels that are established as secure for that transmission. Usually, such transmissions are either API based or SFTP based transmissions which guarantee source and destination verification and minimize the risk of interception or handling by unauthorized persons. All such transmission channels are encrypted using TLS1.2 or higher.
Data Retention
Generally, VATBox does not retain information longer than necessary to provide its Services and for its reasonable business and lawful needs.
Please note that the data processed and stored for the provision of our Services, is not automatically deleted. The Service that we provide pertains to tax reclamation, and the processed data is designated to support tax reclamation requests. Therefore, we must protect the Customer from any accidental loss of such data and ensure the Personal Information is stored for the statutory archiving periods for tax reporting. As such, our process for deletion of Personal Information from our systems is not automatic. Instead, our process for deletion of Personal Information is subject to a formal request sent by a Customer’s authorized representative. If a user or a Customer requests us to do so, we will erase Personal Information from our systems, unless the Personal Information is required for VATBox to establish, exercise or defend against legal claims or it is necessary for the performance of the requested Services.
Please note that in case there is no need for our further processing of Personal Information for the identified purposes, and subject to the agreement we obtain with the respective Customer, we will delete or anonymize Personal Information. In case no specific provisions for data retention are included in the contract we obtain with our Customer, Personal Information will be deleted at the end of the contract with the Customer. VATBox will make a reasonable effort to obtain instructions from the Customer for data deletion. If no such instructions are received, Personal Information will be deleted after 3 months of end of contract. Please note that in such cases, the user IDs to access the Platform shall be kept for one year after the end of service contract for audit purposes, after which Personal Information will be anonymized.
Retention of Personal Information collected for Marketing Purposes
If you have elected to receive marketing communications from us, we retain information about your marketing preferences for a reasonable period of time from the date you last expressed interest in our content or Services. You can request that we delete your information from marketing communication by unsubscribing from our communications.
Children’s Privacy
The Website and Services are not intended for children under the age of 16. We do not, knowingly or intentionally, collect information about children who are under 16 years of age. IF YOU ARE UNDER THE AGE OF 16 YOU MAY NOT USE THE WEBSITE AND SERVICES, UNLESS PARENTAL CONSENT IS PROVIDED ACCORDINGLY.
Questions Regarding Our Privacy Policy
If you have any questions regarding this Privacy Policy or the practices described above, you are always welcome to contact us at [email protected] .
Revisions and Modifications to our Privacy Policy
We reserve the right to revise, amend, or modify this Privacy Policy at any time. When changing the policy, we will update this posting accordingly. Please review this Privacy Policy often so that you will remain updated regarding our current policies.
Governing Law and Jurisdiction
This Privacy Policy will be governed and interpreted pursuant to the laws of the State of Israel without giving effect to its choice of law rules. You expressly agree that the exclusive jurisdiction for any claim or action arising out of or relating to this Privacy Policy shall be submitted to the competent courts in Tel Aviv, Israel, to the exclusion of any other jurisdiction.
This policy was reviewed for year 2025.This page was updated on 26th September, 2025
