Privacy statement EU VAT Check API
Version 1 November 2026
Who we are
Klik&Shop (sole proprietorship), Paramaribohof 55, 2315 VW Leiden, the Netherlands, KvK 98148362, is the controller for data processed through this website and the EU VAT Check API. Contact: info@klikshop.tech, +31 6 11188391.
As little data as possible
We do not ask for a name, email address or account to issue an API key. We use no cookies, no analytics and no trackers.
What data, why and how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Hash of your API key, key ID, creation time, monthly usage and credit | Providing the service, limits and credit | Performance of contract | While the key is active, then max. 12 months |
| Hashed daily derivative of your IP address | Preventing abuse of key creation (max. 3 per day) | Legitimate interest | 2 days |
| Hashed derivative of your IP address (for IPv6: of the /64 network) and a random browser code in your browser's local storage (localStorage), with a counter | Enforcing the 5 one-time free checks on the website so they cannot be reused. Your IP address cannot be recovered from the hash. | Legitimate interest | As long as needed to enforce the one-time limit |
| Checked VAT numbers with the VIES result (name and address may be personal data for sole traders) | Cache: speed and availability during VIES outages | Legitimate interest | Max. 7 days |
| Payment data (via Stripe), key ID, amount, session ID | Processing payment, adding credit, bookkeeping | Contract, legal obligation | 7 years (Dutch tax retention) |
| Technical logs of our hosting provider (incl. IP address) | Security and troubleshooting | Legitimate interest | Per Cloudflare's (short) retention |
Recipients
We use Cloudflare (hosting and API, global network), Stripe (payments, with its own privacy policy for payment data) and the European Commission's VIES system (the VAT number is forwarded for the check). Transfers outside the EEA are covered by appropriate safeguards such as the EU-US Data Privacy Framework or standard contractual clauses. We do not sell data.
Use via RapidAPI
If you use the API through RapidAPI, RapidAPI processes your registration and payment under RapidAPI's own privacy policy. RapidAPI forwards the content of your requests to Klik&Shop's server, together with an anonymous RapidAPI user ID. Klik&Shop uses this data only to carry out the request and does not receive name or card details from RapidAPI.
Your rights
You have the right of access, rectification, erasure, restriction, objection and portability. Since we cannot identify you without your key, please mention your key ID in a request. Email info@klikshop.tech. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Security
API keys are stored as hashes only. All traffic uses HTTPS.
Changes
We may update this statement. The current version is always on this page.