Privacy policy

1. Data controller

Alastia SLU (hereinafter, "we" or "Tributs") is the data controller for personal data processed when you use the service via tributs.ad and its subdomains.

Identification: Andorran limited liability company, NRT L-720150-X, registered office at C/ Prat de la Creu 96, 4-1, AD500 Andorra la Vella (Principality of Andorra). Privacy contact: hola@tributs.ad.

Dual role — important. With respect to your account data and the billing of your subscription, Alastia SLU is the data controller and this policy applies in full. However, with respect to the personal data of third parties (your customers, suppliers and employees) that you enter or upload into the service to run your accounting, invoicing and payroll, you are the data controller and Alastia SLU acts solely as a processor (art. 31 of Llei 29/2021), following your instructions. This second relationship is governed by the Data Processing Agreement (DPA), which forms part of the terms of service.

2. What data we process

Account data: full name, email, password (bcrypt-hashed), registration date. Source: signup form.

Company data: legal name, NRT, parish, incorporation date, tax data. Source: signup + editing in the panel.

Accounting and tax data: issued and received invoices, bank movements, tax filings, annual accounts. Source: use of the service.

Attached images and documents: photos and PDFs of invoices you scan with the AI capture feature. Source: voluntary upload by the user.

Help-assistant conversations: the text of the questions you type to the product-usage assistant and the generated answers, with your history. Source: voluntary use of the assistant.

Technical data: access logs (IP, browser, timestamps), session cookies. Source: navigation in the service.

3. Purposes of processing

Provide the contracted service (fiscal and accounting management of an Andorran company).

Generate tax filings from your accounting data.

Extract structured data from invoices you scan using generative AI providers (section 5).

Suggest an accounting categorisation of bank movements (when you ask) via the same AI providers (section 5); the suggestion is advisory and is not booked without your confirmation.

Provide a product-usage help assistant: the text of your questions is processed by AI providers (section 5) to return guidance based on our help knowledge base; it is not used for tax advice or to query your accounting data.

Send transactional notifications (verification, unpaid invoices, fiscal calendar reminders).

Manage billing of your Tributs subscription.

Comply with legal obligations.

4. Legal basis

Contract performance: for all processing necessary to provide the service.

Legal obligation: for retention of accounting and tax documentation during the periods required by Andorran law (basis: art. 6.1.c of Llei 29/2021; six-year accounting retention duty under art. 7 of Llei 30/2007, of 20 December, on the accounting of businesses).

Consent: for commercial communications unrelated to the service.

Legitimate interest: for service improvement, anonymous usage analysis, fraud prevention and technical error diagnostics (art. 6.1.f of Llei 29/2021). You may object at any time from /perfil → Error diagnostics without affecting the provision of the service.

5. Sub-processors

To provide the service we rely on external providers acting as sub-processors, organised into the following categories. With each one we maintain a Data Processing Agreement (DPA) and, where applicable, appropriate safeguards (Standard Contractual Clauses) for transfers outside the EEA.

• Generative AI providers (US, SCCs + Zero Data Retention) — for the invoice scanner, bank-movement categorisation and help assistant.
• Hosting and infrastructure (EU) — servers and databases.
• Attachment storage (EU region, SCCs) — encrypted storage of the files and images you upload.
• Transactional email (US, with EU sending region, SCCs) — verification, notifications and invoices.
• DNS, CDN and security (US, SCCs) — availability and protection of our domains.
• Public website hosting (US, SCCs) — the tributs.ad landing and anonymous analytics.
• Technical error diagnostics (EU ingest region, US parent, SCCs) — software errors, with no access to the content of your documents.

You can consult the named, up-to-date list of sub-processors (with each provider's identity and the version date). If you act as a data controller, the change-notification mechanism and your right to object are set out in the Data Processing Agreement (DPA).

6. International transfers

Some sub-processors (section 5) are located outside the European Economic Area (United States). For these transfers we rely on the appropriate safeguards under art. 44 of Llei 29/2021 — specifically Standard Contractual Clauses (SCCs) — within the framework of Chapter V (arts. 42 to 45).

For our transfers from Andorra to our AI providers (invoice scanner, bank categorisation and help assistant), the applicable safeguard is these same art. 44 SCCs, with Zero Data Retention (ZDR) enabled at the gateway.

You may request a copy of applicable SCCs by writing to hola@tributs.ad.

7. Retention period

Account data: while you have an active account + 30 days post-closure.

Fiscal and accounting documents: 6 years from the last closing of the financial year, in compliance with the legal accounting-retention duty (art. 7 of Llei 30/2007). This period also covers the 3-year tax limitation period (art. 54.1 of Llei 21/2014, on the bases of the tax system) and the retention of invoices for IGI purposes (art. 77.1 of Llei 11/2012). The storage-limitation principle is art. 5.2.e of Llei 29/2021.

Technical logs: 6 months.

Help-assistant conversations: 12 months from last activity, with automatic purge. You may delete them earlier by exercising your right to erasure.

Backups: 30 days (automatic rotation).

Before closing your account, you may export all your data in standard format.

8. Security measures

Encryption in transit: TLS 1.3 for all communication.

Encryption at rest: passwords stored with bcrypt. Attachments (scanned invoices) are stored encrypted at rest (SSE AES-256) on an object-storage service located in the EU region.

Physical isolation: each client company has its own physical database (multi-site model).

Access control: 2FA mandatory for internal staff.

Backups: daily automatic copies with rotating retention.

9. Data subject rights

Under articles 18 to 25 of Llei 29/2021, you have the following rights: access, rectification, erasure, restriction, portability, objection and automated decisions. Our service does not apply automated decisions with significant legal effects, but the right exists.

To exercise any right, email hola@tributs.ad. We will respond within one month of receiving the request (art. 15.3 of Llei 29/2021), extendable by a further two months for particularly complex requests.

If you are a customer, supplier or employee of a business that uses Tributs and your request concerns data that business processes with the service, please contact that business directly: it is the data controller. We, as processor, will assist it in handling your request.

If you believe we violate the regulation, you may lodge a complaint with the Andorran Data Protection Agency (APDA): www.apda.ad.

10. Breach notification

As controller, in the event of a personal-data security breach posing a risk to your rights, we will notify the APDA without undue delay and, where feasible, within 72 hours of becoming aware (art. 36 of Llei 29/2021); and we will inform you without delay where the breach is likely to result in a high risk to your rights and freedoms (art. 37). Where we act as a client's processor, we will inform that client without undue delay (art. 36.2) so it can meet these duties; the 72-hour limit applies only to the controller's notification to the APDA, not to our notification as processor.

11. Changes to this policy

If we change this policy substantially, we will email you at least 30 days in advance.

12. Contact

Data protection questions: hola@tributs.ad.

When we appoint a Data Protection Officer (DPO), their contact will be published here.