Privacy Policy

TaxRatesByCountry.com — Last updated: 28 April 2026 — Applies to EU/EEA users under GDPR (Regulation (EU) 2016/679)

1. Who We Are (Data Controller)

TaxRatesByCountry.com is operated as an independent editorial platform. The data controller for the purposes of the GDPR is:

Henri Bousquet
Toulouse, France
Email: contact@taxratesbycountry.com

This website is a static informational site. It does not maintain its own user account system or proprietary database of registered users.

2. Data We Collect

We collect only the minimum data necessary to operate this service:

Category	Data collected	Source
Server logs	IP address (anonymised), browser user-agent, page URL, referrer, HTTP response code, timestamp	Hosting provider (Namecheap) — automatic
Lead capture form	Email address submitted voluntarily to receive the "Expat Tax Checklist"	User-submitted via the newsletter form
Analytics	See section 3 below	Third-party tool (if active)

We do not collect: names, postal addresses, payment data, government identification numbers, or sensitive personal data within the meaning of Art. 9 GDPR.

3. Analytics & Cookies

3.1 Current state

At the time of writing, this website does not deploy any third-party tracking or advertising cookies. No Google Analytics, Facebook Pixel, or similar tracking scripts are currently loaded. If this changes, this policy will be updated and a cookie consent banner will be displayed in accordance with Art. 7 GDPR and the ePrivacy Directive (2002/58/EC).

3.2 Strictly necessary cookies

The site may use session-scoped technical cookies essential to page delivery (e.g. Cloudflare security token, load-balancer sticky session). These cookies do not require consent under the ePrivacy Directive as they are strictly necessary.

3.3 Future analytics deployment

If we introduce an analytics solution, we will prefer privacy-preserving, cookieless tools (e.g. Plausible Analytics or Fathom) that operate without setting persistent identifiers. Should any tool require consent under GDPR, a clearly dismissible banner will appear on first visit and consent will be logged with a timestamp.

4. Legal Basis for Processing

Processing activity	Legal basis (GDPR Art.)
Server log data (IP, user-agent, page URL)	Art. 6(1)(f) — Legitimate interest (security, abuse prevention, uptime monitoring)
Email address collected via lead-capture form	Art. 6(1)(a) — Consent (freely given, specific, informed, unambiguous)
Analytics cookies (if deployed)	Art. 6(1)(a) — Consent, collected via banner before any cookie is set

5. Data Retention

• Server logs: retained for 30 days by the hosting provider for security and debugging, then automatically purged.
• Email addresses: retained until the subscriber unsubscribes or requests deletion. No email is retained beyond 3 years of inactivity without re-confirmation.
• Analytics data: if collected, aggregated data retained for up to 24 months; no individual event records after 12 months.

6. Data Sharing & Third-Party Transfers

We do not sell personal data. Data may be shared only with the following sub-processors, under appropriate contractual safeguards:

Sub-processor	Purpose	Transfer basis
Namecheap Inc. (US)	Web hosting and server log storage	Standard Contractual Clauses (SCCs)
Cloudflare Inc. (US)	DDoS protection, CDN, TLS	SCCs + Cloudflare DPA
Email delivery provider (if any)	Sending the Expat Tax Checklist	DPA in place; SCCs for non-EU providers

No data is transferred to countries outside the EEA without an adequate transfer mechanism (SCCs, adequacy decision, or Binding Corporate Rules).

7. Your Rights Under GDPR

If you are located in the EU/EEA, you hold the following rights under Regulation (EU) 2016/679:

• Right of access (Art. 15): obtain confirmation of whether we process your data and receive a copy.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") (Art. 17): request deletion of your personal data.
• Right to restriction (Art. 18): limit how we use your data pending a dispute.
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interest or direct marketing.
• Right to withdraw consent (Art. 7(3)): withdraw at any time, without affecting lawfulness of prior processing.

To exercise any of these rights, contact us at contact@taxratesbycountry.com. We will respond within 30 days in accordance with Art. 12 GDPR. Identity verification may be required before disclosure.

8. Children's Privacy

This website is not directed at children under 16 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided data to us, contact us immediately and we will delete it.

9. Changes to this Policy

We may update this Privacy Policy when our practices change or when required by law. Material changes will be notified via a prominent notice on the homepage for at least 30 days. The "Last updated" date at the top reflects the current version.

10. Contact & Supervisory Authority Complaints

You have the right to lodge a complaint with your national supervisory authority. For France (our place of establishment): Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, 75007 Paris — www.cnil.fr. For other EU member states, contact your local data protection authority.