Micro businesses in EU selling electronic goods, how to comply with EU VAT regulations? According to EUVATACTION Key Facts the business is among other things required to: store personal data securely for 10+ years calculate taxes for every EU country based on client's location as determined by 2 distinct and non-contradictory pieces of evidence Points 1 and 2 mean that a small/micro business can not do this alone. Period. Thankfully, there are services like Taxamo which claim to be able to do it for you, but: nobody really knows what the exact EU VAT rates are for every country, region, time of year, product, ... There is no central EU authority at the moment which supplies "official" information on EU level and Taxamo and others don't have a crystal ball that the EC doesn't have the technical aspects of the integration enable you to get the transaction counts "99.9% right" simply knowing a tax rate doesn't really help you apply the tax rate all the time - in Croatia for example you need to pay the tax when you issue the invoice, not when funds get billed to your account, for example you are liable, not the service provider, if something is calculated badly in some EU countries like Croatia your business will get a huge fine if it's just 2-3 euros off So... Here's the little chain question :) is there any way to comply with these rules 100%? if not, how much bad stuff can happen if you don't comply with the regulation 100%? But 99.9% for example :D (simply because of technical limitations some transactions will not be presented or calculated properly) Does the bad stuff depend on your country, the country of the buyer or combination of both? if the bad stuff is bad, and if there's no way of complying technically are there ways for a subscription based service selling an online service (using recurring credit card charges) to avoid being subject to this VAT scheme? (i.e. presenting the product in a different way or restricting yourself just to B2B transactions) if there's no way to avoid the VAT scheme does it make sense to open a company outside of the EU to handle payments if the said country does not acknowledge jurisdiction of EU law over its businesses, and if so, where? :) Or in short :D What would Google do? :D
I think you vastly exaggerate the difficulty. Basically: when a user registers, ask for their address, including country, as well as a phone number (including country code, which you may validate via SMS for instance). This should give you the 2 pieces of information that help you determine the country In the case of the UK, HMRC says: Support for MOSS registered micro-businesses UK micro-businesses, that are below the current UK VAT registration threshold and are registered for the VAT Mini One Stop Shop (VAT MOSS), may use best judgment and base their ‘customer location’ VAT taxation and accounting decisions on a single piece of information, such as the billing address provided by the customer or information provided to them by their payment service provider. based on the country, use the standard VAT rate for that country. The difficulty here is to track when those rates change, but your accountant should be able to keep up with that. There is very little chance any special reduced rate would apply to such services, and in any case, no tax authority will complain if you apply the standard rate instead of the reduced one! then declare everything online to your local MOSS (you don't need to register with each tax authority! You can, but you don't need to). In the case of a micro-business, this should be more than enough to comply with the rules.
That GDPR Disclaimer is no protection in some jurisdictions: the applicable laws to that situation in germany for example don't care about the GDPR: Cold calling, mailing, or e-mailing private people to advertise services all is handled by the same law: Without the consent it is expressly illegal under §7 of the law against unfair competition (Gesetz gegen unlauteren Wettbewerb UWG) and such cases are rather Slam-Dunk if the origin can be made out. The punishment can be a 300.000 € fine. The fact that to email someone you need their e-mail address and that e-mail addresses and private addresses are by default considered personally identifiable information is making it worse for the advertizer: Without either an exception (there is none available to cold-emailing) or special allowance of the person the data belongs to, you violate §4 of the federal data protection law (Bundesdatenschutzgesetzes BDSG) just by handling their e-mail address. That's a separate crime from the UWG one, adding up to another 300.000 € fine under §43 BDSG - or even up to 2 years in prison under §44 BDSG! Oh, and if the email does not contain a proper sender's address, that's another chance for a huge fine under the UWG... So, GDPR is your least trouble, if you violate the marketing laws of a country, or their own data privacy laws. A disclaimer means nothing as the act of sending the mail, even to an unintended addressee, is what is illegal and the law as written does not give a damn about 'I didn't want to advertise to that person' when in fact you sent them unwanted advertisements. Oh, and the very repository you suggest? It would violate the very same §4 BDSG and be illegal for processing private data if it was not actively asked to do that by the end user. As a result, that database is useless: It does kick back all people not in its database. Its database is incomplete because only few people give their address to that database as people not aware of the database never add their data on their own. So it regularly violates §4 BDSG with every German citizen's e-mail address it gets and kicks back, and claiming those addresses would be OK, it throws the company trying to check the database under the bus because they rely on data that is impossible to be reliable. tl;dr Don't do cold-(e)-mail marketing. You throw yourself into boiling oil with a lit torch in hand. further reading Other laws banning such behavior I had listed here, and I quote myself: The US has the CAN-SPAM-Act, which illegalizes sending unsocialised advertisements. You may NOT send a mail if any of the following is true: it has no opt-out the email was gained by 'harvesting' contains a header not matching the text contains less than one sentence the adressee does not have any relation to you In fact, you are liable for a 5-digit fine per infringing e-mail in the US. The FTC itself suggests to never buy e-mail lists - as E-mail harvesting or generating any possible e-mail adress itself is illegal.
No The contract is created at the moment that an offer was accepted. In normal circumstances: You accepted an offer that they made to the general public by sending a purchase order for specific items at specific prices, or They accepted your offer by communicating their acceptance to you (being advised that the goods have been dispatched counts). However, in this circumstance, the company has been explicit that the contract is only created when either: You checkout and pay, or They “supply an invoice to you.” It appears that neither event happened so there is no contract. Their specific terms have overridden the common law rules on offer and acceptance (as they are allowed to do) and the offer has not been accepted until you receive their invoice. Specifically, it cannot be accepted by performance (dispatching the goods) and the requirement for the invoice to be supplied overrides the postal rule. Note that, in this case, you got lucky. 99 times out of 100 there would have been a valid contract and you would have breached it. In future, cancel orders specifically, don’t make assumptions.
Yes, this violates the GDPR if the user is in Europe. Data which is tied to a personal device can be tied to the person who owns it. From "What Is Personal Data" by the UK Information Commissioner's Office (ICO) (emphasis added): Personal data is information that relates to an identified or identifiable individual. What identifies an individual could be as simple as a name or a number or could include other identifiers such as an IP address or a cookie identifier, or other factors. If it is possible to identify an individual directly from the information you are processing, then that information may be personal data. If you cannot directly identify an individual from that information, then you need to consider whether the individual is still identifiable. You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual. The bit about "all means reasonably likely" in the last bullet includes the kind of de-anonymisation tactics described in the NYT article. There are 6 lawful bases for data processing in the GDPR, and all processing must fall under at least one of them. (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) Selling data isn't covered by any of the others, so consent must be obtained. Permission must be clear and positive, and you cannot predicate delivery of a service on the processing of data that isn't necessary for that service. So for instance you cannot say "You can use this service as long as we are allowed to collect and sell your data" because selling the data isn't necessary to the provision of the service. From "Consent" by the ICO: Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. Explicit consent requires a very clear and specific statement of consent. Keep your consent requests separate from other terms and conditions. Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough. [...] Avoid making consent to processing a precondition of a service. This applies to any processing of data about individuals within the EU, so just being an American company doesn't get you a free pass to ignore the GDPR if your app gets used by Europeans. The "Legitimate interests" basis is more problematic, in that the company collecting the data has to conduct a vague "balancing test" to determine if this basis applies. For direct marketing the ICO has written this, which says that direct marketing may be a legitimate interest, especially if you can show that the user has expressed interest in such adverts. For instance a location service which promises to tell you about nearby special offers would fall into this category. Against this, the impact on the user's privacy has to be considered, and location data is "special category data" because it can reveal medical information (e.g. hospital attendance) or religious affiliation (e.g. which church you go to). So unless the relationship between the recorded location data and the service is very direct its not going to pass the balancing test. The company would also need to distinguish between knowing the current location and keeping a record of historical locations; the two need separate justification. And of course nothing about this covers the sale of the data; this is considering a company which sells advertising space in it's app, not one that sells the data itself.
The main tax law is that you have to pay income taxes on your income even when you're in a foreign country. You may also be subject to income tax requirements in the foreign country, so that depends on local law and the existence of tax treaties between the US and that country (which will also involve details of the employer, employment and why you are in that country). For example, if you're working for a solely-US company (not e.g. Amazon) and go to Norway for 3 months &quot;working holiday&quot;, just doing your job online in a different country while skiing, you almost certainly would not have any Norwegian tax liability. It just depends on the specifics.
No, it does not. There is indeed a 2-year guarantee for all goods, but "goods" is defined to be a "tangible movable item" according to Directive 1999/44/EC Article 1, subsection 2(b). In less legalese, a physical item; software doesn't count. While there has been discussion about extending this protection to software, I'm not aware of this having been done yet. Even if it were, determining whether goods are "faulty" ultimately comes down to whether it conforms to the contract of sale (Article 2). I think it's likely that vendors in this area would put a disclaimer for unforeseen security vulnerabilities, or something to that effect.
Per Art 3(2), GDPR only applies to non-European companies when their processing activities relate to the offering of goods or services to people in Europe, or when the processing activities relate to monitoring people in Europe. However, the word “offer” of this targeting criterion requires some level of intent. It is not enough for GDPR to apply that they're marketing to someone who happens to be in Europe, but GDPR would apply if they are intentionally marketing to people who are in Europe. I don't know what they are marketing, so I don't know if that would be the case here. Even if GDPR were to apply, it would not be the most appropriate law. Yes, there's the GDPR right to erasure, which applies under some conditions (though there's a pretty absolute right to opt-out from marketing). The EU's ePrivacy Directive provides more specific rules though, in particular that every such marketing email must offer a way to unsubscribe. Other countries have comparable anti-spam laws, potentially also the home country for this online service.
Online stores shipping stuff internationally usually include a clause in their Terms along the lines &quot;buyer is responsible for all clearance/import fees and taxes&quot;. What those fees and taxes are depends on: destination country (the actual tax) carrier (e.g. FedEx) (clearance charges as the carrier also acts as your customs broker) value and, sometimes, what the item is. The onus is on the buyer to check all those charges in advance before deciding to buy. It would have been naive to assume that, when you buy internationally, all that you pay is what the store gets plus import tax (unless you're ready to be present at the customs when the item arrives, fill forms and liaise with them yourself).