Selling software internationally and taxes I'm about to go crazy due to the amount of information I have explored on this matter and still I have no answers. Anyone with at least some knowledge, please share it. My case is very simple (I think), I create a small software application and want to sell licenses for it from my own web-site, taking payments using PayPal. I'm registered in Canada. If I was to sell it in Canada only I would have to collect and pay GST/HST taxes. But I have no clue where my clients will be from. According to the information I was able to find, every zone, country, or even states, have their own taxation rules for sales made there. Well, in no way it's possible that small companies or individuals that sell products internationally deal with tax rules for each buyer, that would be a non-sense, and paying such taxes worldwide would be a nightmare not worth having a small business at all. So it must not be the case. But PayPal's page on international sales suggests exactly that it's the case. The main question, if someone buys a license from my web-site, is it considered a sale in the buyer's country/state which requires me to collect and pay some remote tax, or it's a purchase in my country/state which requires me to collect HST from that buyer? Another question is regarding invoices, I know that Canada requires certain information to be included into an invoice for sales in Canada. If my sales will be considered sales in a buyer's Country with some other rules, does it mean I have to manage tons of invoice templates? I also known that usually countries specify certain limits before their taxes has to be collected, which makes it even more confusing. Let's say if my sales in UE exceed 30K EUR it looks like I need to register and pay VAT there. But what if I have less? I want to show tax amount in the invoice, but it such case it looks like there will be no tax collected at all.
According to the information I was able to find, every zone, country, or even states, have their own taxation rules for sales made there. Correct. Well, in no way it's possible that small companies or individuals that sell products internationally deal with tax rules for each buyer, that would be a non-sense, and paying such taxes worldwide would be a nightmare not worth having a small business at all. You are required to comply with the law. If it is complicated, or difficult or expensive to do so then, it's complicated, difficult and expensive and you still have to do it. The answer is obvious: if it's not worth having a small business, don't have a small business. The main question, if someone buys a license from my web-site, is it considered a sale in the buyer's country/state which requires me to collect and pay some remote tax, or it's a purchase in my country/state which requires me to collect HST from that buyer? It depends on the law in both Canada and the destination country. In most cases, the sale will be an export sale from Canada (GST/HST exempt) and an import sale in the destination country - requiring you to comply with GST/HST obligations there. Another question is regarding invoices, I know that Canada requires certain information to be included into an invoice for sales in Canada. If my sales will be considered sales in a buyer's Country with some other rules, does it mean I have to manage tons of invoice templates? Yes. Let's say if my sales in UE exceed 30K EUR it looks like I need to register and pay VAT there. But what if I have less? Then you don't need to register and remit tax. Nor are you allowed to collect it from your customers. By the way, I have no idea what country in the Eurozone goes by the initials UE. In most jurisdictions, you need to register either when you reach the threshold in fact or reasonably expect to reach the threshold. Also in most, you can usually register even if you are below the threshold. For example, these are the rules for Australia. Anyone, please advice. Hire an accountant versed in international digital services. They will be able to give you the advice you need. They will also be able to recommend sales/payment platforms that can handle most of this for you (for a fee, of course).
If GDPR applies, then no one can opt out. If it doesn't apply, then an IP block is superfluous. Whether GDPR applies is determined by Art 3 GDPR. For this, we must distinguish where the data controller is operating from. It is irrelevant where the site is hosted, but primarily relevant where the data controller (your colleague) has an “establishment”, e.g. where he resides or typically works from. Per Art 3(1), GDPR applies to all processing activities in the context of an European establishment, regardless of where the users are. So if your colleague were running this site from Europe, they wouldn't be able to circumvent GDPR by blocking European users. However, if your colleague is running this site from outside of Europe, then Art 3(1) doesn't trigger. Per Art 3(2), GDPR can apply to processing activities where there is no European establishment. There is the Art 3(2)(a) “targeting criterion”: if your colleague “offers” goods or services to people who are in Europe, regardless whether paid or gratis, then GDPR applies to all processing activities related to this offer. I'll discuss this more below. There is also the Art 3(2)(b) criterion: if your colleague monitors the behaviour of people that occurs in Europe, then GDPR applies. For example, an app collecting geolocation information or a website creating interest profiles for ad targeting might trigger this criterion. An IP block can help to establish that no offering/monitoring related to people who are in Europe is happening, but it might not be necessary. It may be worth talking a bit more about the targeting criterion. The GDPR explicitly says that mere availability of a website in Europe doesn't imply that GDPR would apply. Instead, it is necessary to establish the data controller's intention – are they soliciting users from Europe, or otherwise expecting that people from Europe might use those services? Recital 23 gives a couple of non-exhaustive factors that can be considered here, for example: the site uses a language or currency used in the EU but not used in the controller's own country the site mentions users or customers from Europe, e.g. in testimonials This means that a lot of US websites, written in English or Spanish, only mentioning payment in USD (if any), not mentioning any European countries, will not be subject to GDPR. Then, occasional European visitors are irrelevant. It wouldn't be necessary to IP-block potential European users. However, such an IP-based block would help establish that the data controller really doesn't intend for those services to be offered to people who are in Europe. My personal opinion is that it's wasted effort to block users from foreign countries in case their foreign laws claim to apply, but if such a block brings peace of mind that might be worth it. While geoblocking might not be necessary, is it sufficient? There is no clear guidance on this subject, but it seems to be generally accepted that IP-based geoblocking is fine, even though it is trivially circumvented using VPN services. Of course, if a website were to block European IP addresses but were to also advertise that people in Europe can use their services via VPNs, that would probably still be an “offer” and might defeat the point of doing any geoblocking. The Art 3(1)(a) targeting criterion is most easily applied to things like ecommerce where physical goods are shipped to the customer in return for payment – so essentially whenever the data controller participates in the EU Single Market. This is roughly similar to the concept of a Nexus in US tax law. But in principle the targeting criterion can also apply to other kinds of websites or apps such as blogs, even if they are gratis. GDPR does not just apply to for-profit commercial activity, and doesn't distinguish between controllers that are entities/LLCs and controllers who are natural persons. Things are slightly more complicated due to the Art 3(2)(b) monitoring criterion and the pervasive use of online trackers on websites, but this aspect of the GDPR is difficult to enforce and frequently ignored. In this answer, “Europe” means the European Union (EU), the European Economic Area (EEA), and the United Kingdom (UK). Note that countries like Norway are covered by GDPR, whereas Switzerland is not. Of course, the GDPR is not the only privacy law relevant internationally.
You can always get in trouble. Copyright is always protected by the laws of a particular nation, by the courts of that nation. Because of the Berne Convention and the Universal Copyright Convention, I can sue you outside of my country, and will be treated as a person of that country. The conventions don't say who has jurisdiction, that is where you have to sue, so you have to resort to conventional jurisdictional principles. If you are in Europe, under the Brussels Convention, that means I have to sue you in your country of domicile (if you reside in multiple European nations, I get to decide which country to sue you in). The English courts are slightly different in that they generally hold that you sue in the country where the act took place, but (Lucasfilm v Ainsworth) you can sue in UK courts for infringement that occurs in the US. As you can see, this can get complicated. I can't sue you in Mongolian courts (assuming neither of us has any connection at all to Mongolia), but I could sue you (being a hypothetical UK citizen) in UK courts if you did the infringing deed while in Mongolia. Mongolian courts enforce Mongolian copyright law, US courts enforce US copyright law. Therefore you first have to decide what country you plan to sue in (from the plaintiff's perspective).
"There's no ... contract" - wrong! The emails are the contract, see What is a contract and what is required for them to be valid? If you didn't agree on which laws will apply then that is a matter for the court to determine. In general, they will tend to look at where the bulk of the work was done - since you are being charged I assume the work was done in the UK so probably UK law applies, noting that the UK is actually 3 different jurisdictions (England &amp; Wales, Scotland and Northern Ireland). That said, many jurisdictions have non-excludable laws around contracts, particularly consumer contracts that apply irrespective of the substantial law applying to the contract. It is therefore possible that you apply English contract law subject to, for example, Australian Consumer Law. Usually any consumer protection law in the vendor's jurisdiction will also apply. General contract law dictates that where a price was not agreed a reasonable price must be paid. If its reasonable that the editing should have been included in the original price charged then you don't have to pay more but if it isn't then you have to pay a reasonable amount for it. There is generally no requirement for estimates or any other method of determining the price - you just have to do what's reasonable. However, consumer protection law generally imposes more obligations on a business than general contract law. It is likely that your contract is ambiguous - courts will endeavor to fill in any ambiguities to make the contract work. techniques include read in implied terms to give "business efficiency", from custom or business usage (e.g. if particular industries typically deal with particular issues in particular ways), from previous dealings (i.e. what the parties have done in the past), from statutes, whatever works to resolve uncertain, meaningless or ambiguous terms, from the express words used or from the nature of the contract or from the common intention of the parties (i.e. the court might ask you what you meant). "Breach of contract" is a very broad term - it simply means that one of the parties hasn't done what they were required to do and allows the other party to sue for damages.
You would not be required to do either of the things you state (unless you explicitly agreed to do so). What, strictly speaking, you need to do is to advise the seller that the original goods arrived and ask them if they want to collect them, have you return them at their expense or abandon the goods to you. (In all likelyhood they will give the goods to you because the cost of them recovering them is to high). Although I'm not in the UK, I believe the Sale of Goods Act 1979 applies. Strictly speaking, as you have not paid for the goods, they still belong to the seller - but you do not have to pay to return them.
The work and the copyright to the work are different property rights Buying one does not give you rights to the other. Copyright laws differ by country so its impossible to say which need transfers to be in writing and which don't. For example, the United States requires them (and also allows owners to rescind the transfer after a number of years) but in Australia, it isn't necessary and the Copyright Act makes a number of presumptions in civil actions (ss126-131) which favor the person claiming the copyright so that, in the absence of contrary evidence, their assertion will prevail.
Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU. GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.
Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR? Only if they offer goods/services to or monitor behavior of people in the EU (Art. 3(2)). Note that: having a commerce-oriented website that is accessible to EU residents does not by itself constitute offering goods or services in the EU. Rather, a business must show intent to draw EU customers, for example, by using a local language or currency. If it is then how (and by whom) would compliance be audited and/or enforced? Supervisory Authorities will care of it.