How we collect, use and protect your information.
Version 1.0 | Last updated: July 2026
Using VatCake means trusting us with important information: your identity, your purchases and your refund details. We take that responsibility seriously.
✓ We only collect the information needed to provide our VAT refund service.
✓ We never sell your personal information.
✓ We explain why we ask for every piece of information.
✓ We use your passport and facial verification only to verify identity and eligibility for VAT refund purposes.
✓ We do not store your payment card details.
✓ We do not use your information for advertising or behavioural profiling.
✓ We share information only where necessary to provide the service, prevent fraud, process refunds or comply with legal obligations.
✓ You can contact us at any time to exercise your privacy rights.
Welcome to VatCake.
This Privacy Policy explains what information we collect, why we collect it, how we use it, who we share it with, how long we keep it and the rights available to you.
Our goal is to explain these things clearly, without unnecessary legal language. If we use a legal term, we explain what it means in plain English.
This page is part of the VatCake Trust Centre. It should be read together with our Terms of Service, Cookie Policy, Security page and Account Deletion page.
VatCake is operated by Retail Export Scheme Partners Ltd., an Irish company registered under company number 730220.
Item
Detail
Legal entity
Retail Export Scheme Partners Ltd.
Trading name / app name
Tax Back Europe / VatCake
Registered office
The Cube Building, Monahan Road, Cork, T12 H1XY, Ireland
Privacy contact
Support contact
Lead supervisory authority
Data Protection Commission, Ireland
For data protection purposes, Retail Export Scheme Partners Ltd. is the Data Controller for most personal information processed through VatCake. This means we decide why and how that information is used.
Some organisations involved in the service, such as Customs authorities, card issuers, payment providers or identity verification providers, may act as independent controllers for parts of their own processing. Where that happens, they are responsible for explaining their own privacy practices.
VatCake is operated by Retail Export Scheme Partners Ltd., an Irish company registered under company number 730220.
Item
Detail
Trading name / app name
Tax Back Europe / VatCake
Registered office
The Cube Building, Monahan Road, Cork, T12 H1XY, Ireland
Privacy contact
Support contact
Lead supervisory authority
Data Protection Commission, Ireland
For data protection purposes, Retail Export Scheme Partners Ltd. is the Data Controller for most personal information processed through VatCake. This means we decide why and how that information is used.
Some organisations involved in the service, such as Customs authorities, card issuers, payment providers or identity verification providers, may act as independent controllers for parts of their own processing. Where that happens, they are responsible for explaining their own privacy practices.
This Privacy Policy applies when you use or interact with:
• the VatCake mobile app;
• the Taxbackeurope website and VatCake Trust Centre;
• your VatCake traveller account;
• our customer support services;
• communications with us about VAT refund claims;
• our supported VAT refund workflows with participating retailers.
Different privacy notices may apply where you interact directly with a retailer, Customs authority, card issuer, payment provider, app store, or another third party.
We collect information only where it is needed to operate the service, verify eligibility, protect against fraud, process VAT refund claims, send refunds, provide support or comply with legal obligations.
• Full name
• Email address
• Phone number
• Password or authentication credentials
• Account status and verification status
We use your phone number for SMS verification. We may also use your email address for account, security, service and support communications.
You may be able to sign in using email and password, Google Sign-In or Sign in with Apple. If you use Google Sign-In or Sign in with Apple, we receive the information needed to authenticate your account, such as your email address and sign-in identifier. We do not receive your Google or Apple password.
To process VAT refund claims, we need to verify your identity and eligibility. Depending on the supported country and workflow, this may include:
• Passport information;
• passport image or passport photo page;
• nationality;
• date of birth;
• country of residence;
• home address;
• selfie or liveness image for facial verification.
Facial verification is performed by a specialist identity verification provider. VatCake does not use facial verification for advertising, profiling or any purpose unrelated to identity verification and VAT refund processing.
Address verification is part of the VatCake flow. We may ask you to enter payment card details and your address with our payment service provider so your card issuer can confirm whether the address you provided matches the address associated with your card.
Important
VatCake does not store your payment card details. We receive the result of the address verification check, not your full card details.
To prepare your VAT refund claim, we collect information about the purchases you submit through VatCake, including:
• retailer name and location;
• purchase date;
• receipt or invoice image;
• description of goods;
• purchase amount;
• VAT amount;
• transaction or invoice reference where available;
• claim status and supporting audit information.
Where required for VAT refund purposes, we may collect travel and export information, such as:
• departure country;
• destination country;
• departure date;
• flight, airport, ferry, train or other export details where required;
• customs validation status and related reference numbers.
To send your VAT refund, we collect the refund details you choose to provide. Depending on available payment methods, this may include bank account details, IBAN, SWIFT/BIC, wallet details, or other payment information needed to complete the refund.
Refund payment details are different from payment card details used for address verification. The card used for address verification does not need to be the account to which your VAT refund is paid.
If you contact us, we may collect the information you provide in your message, including your contact details, claim reference, support request, attachments and our response history.
When you use VatCake, we may collect technical information needed to run and secure the service, such as:
• device type;
• operating system;
• app version;
• browser type;
• IP address;
• date and time of access;
• authentication logs;
• security, error and audit logs.
We do not use Google Firebase Analytics or Firebase Crashlytics.
Our website may use cookies and similar technologies to operate the site, remember preferences, improve performance and understand basic website usage. Our Cookie Policy explains this in more detail.
VAT refund schemes are designed to return VAT only to eligible travellers. To protect travellers, retailers and Customs authorities, we need to verify your identity before a VAT refund claim can be processed.
Depending on the country and workflow, identity verification may include checking that your passport is genuine, confirming that the person creating the account matches the identity document provided, confirming your country of residence, and preventing duplicate or fraudulent claims.
We use specialist identity verification providers to perform these checks securely. Your identity information is used only for identity verification, eligibility checks, fraud prevention, VAT refund processing and legal compliance.
Address verification is one of several checks that helps us protect travellers, participating retailers and the integrity of VAT refund schemes.
To verify your address, you may be asked to enter your card details and address with our payment service provider. The payment service provider checks whether the address you provided matches the address held by your card issuer.
VatCake does not store your payment card details. We receive the verification result and use it as part of the identity, eligibility and fraud-prevention process.
VatCake uses technology providers to help extract purchase information from receipts. This reduces manual data entry and helps improve the accuracy of VAT refund claims.
Receipt scanning is used for sales receipts and purchase information. It is not used to perform passport verification or facial verification.
We treat receipt information as part of your VAT refund claim and protect it accordingly.
VatCake is operated from Ireland and uses trusted service providers to deliver the service. Where personal information is transferred outside the European Economic Area, we use appropriate safeguards where required, such as adequacy decisions, Standard Contractual Clauses, Data Processing Agreements and other lawful transfer mechanisms. We aim to keep core VAT refund and claim records within secure cloud infrastructure in Europe where practicable.
We use modern technical and organisational measures to protect your information. These include:
• encryption in transit;
• encryption at rest where supported by our service providers;
• role-based access controls;
• least-privilege access;
• multi-factor authentication for internal systems where appropriate;
• audit logging and status history;
• secure cloud infrastructure;
• data minimisation;
• processor due diligence and Data Processing Agreements;
• incident response procedures.
No system can be guaranteed to be completely secure. However, we design our processes to reduce risk and protect your information throughout the VAT refund journey.
We keep personal information only for as long as necessary for the purposes described in this policy, including providing the service, meeting legal obligations, preventing fraud, resolving disputes and maintaining audit records.
Information category
Typical retention approach
Account information
Kept while your account is active and for a reasonable period after closure, unless a longer period is required for legal, fraud-prevention or dispute-resolution purposes.
VAT refund claim records
Certain records submitted to, or required for, Customs and tax purposes may need to be retained for up to six years or another period required by applicable law.
Passport image and selfie/liveness data
Held by the identity verification provider only for the period needed to complete verification and meet related obligations. The current target retention period for this sensitive verification data is 60 days, unless a different period is required by law, dispute handling, fraud prevention or provider obligations.
Address verification result
Kept as part of the eligibility, audit and fraud-prevention record where necessary. VatCake does not store full card details.
Payment card details
Not stored by VatCake.
Refund payment details
Kept as long as needed to send the refund and maintain accounting, audit, fraud-prevention and legal records.
Support communications
Kept as long as necessary to handle the request and maintain an appropriate service record.
Security and technical logs
Kept for a limited period appropriate to security, troubleshooting and audit needs.
When information is no longer needed, we delete, anonymise or securely archive it in line with our retention practices and legal obligations.
Depending on your location and applicable law, you may have rights over your personal information. These may include the right to:
• ask for a copy of the personal information we hold about you;
• ask us to correct inaccurate information;
• ask us to delete information where we are not required to keep it;
• ask us to restrict certain processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent;
• complain to a data protection authority.
To exercise your rights, contact us at privacy@taxbackeurope.com. We may need to verify your identity before responding to a request.
If you are in Ireland or the European Union, you may also contact the Data Protection Commission in Ireland or your local supervisory authority.
You can request deletion of your VatCake account and associated personal information by contacting privacy@taxbackeurope.com or by using the account deletion method made available in the app or on our Account Deletion page.
Before deleting an account, we may need to verify your identity. Once verified, we will delete or anonymise personal information that we are no longer required to keep.
If you are in Ireland or the European Union, you may also contact the Data Protection Commission in Ireland or your local supervisory authority.
VatCake is intended for adult travellers. You must be at least 18 years old to use the service. We do not knowingly provide the service to children or target children with our app or website.
Our website may use cookies or similar technologies to operate the site, remember your preferences, support security, measure basic website performance and improve the user experience.
Where required, we will ask for your consent before using non-essential cookies. You can learn more in our Cookie Policy.
We do not use your personal information for behavioural advertising or profiling.
We may use automated checks to support identity verification, address verification, receipt processing, fraud prevention and claim workflow management. These checks help us operate the service securely, but VatCake does not make decisions producing legal or similarly significant effects about you solely by automated means.
Customs or tax authorities may make decisions about whether a VAT refund claim is approved, rejected or requires additional checks. Those decisions are part of the regulated VAT refund process and may be subject to the rules of the relevant authority.
We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date on this page. Where changes are material, we may also notify you through the app, by email or by another appropriate method.
If you have questions about this Privacy Policy or how VatCake handles your information, please contact us.
Purpose
Contact
Privacy questions and data rights
Customer support
Postal address
Retail Export Scheme Partners Ltd., The Cube Building, Monahan Road, Cork, T12 H1XY, Ireland
Please do not send passport images, payment card details, bank details or other sensitive information in the body of an ordinary email unless we specifically ask you to do so using a secure process.