Do I have to pay taxes if I register the domain but the website income belongs to someone else? If I am the registrar of the website domain name, meanwhile the website/business is running and registered in another country, who is obliged to pay taxes for the income of business, me as registrar of domain or the owner who runs the website/business in their country? I tried to do a research but I didn't found any answer to this specific question. Would be happy if I have your help here. Thanks in advance
Do I have to pay taxes if I register the domain but the website income belongs to someone else? No. The person or company who runs, and/or profits from, the business is the entity under obligation to pay all the applicable taxes: Value Added Tax, income tax, corporate tax, and so forth. Unless you charge a significant amount therefor (see the comments), the mere registration of just one domain is unlikely to trigger tax obligations.
It's not clear exactly what you're asking, when you say "the company I work for" – i.e. are you asking "can they fire me?" (almost certainly they can, even if their TOS thinking is legally misguided – unless in your country there are laws that prevent firing employees). To be certain, you need to hire an attorney who is sufficiently savvy about web page technology that they can accurately judge what you are doing, and whether you can fruitfully resist their demands. You seem to be skeptical of their position because you are "not affecting their servers in any way". The TOS is not about affecting their servers, it is about affecting their intellectual property. It appears that your code does a number of the prohibited actions such as and perhaps most importantly "modify". If you have distributed a program that allows users to modify company content on their own computers, then the user might be in violation of the TOS, but not you (since you're not running a server that redistributes). However, I am betting that in order to create and test the program you had to violate the TOS. Additionally, you could be vicariously liable for the infringements of others, especially if this program can only be used to infringe on copyright, and you know this fact. That is pretty much the end of the legal part. As for how you should respond, your attorney, and not Law SE, deals in recommendations.
I am unfamiliar with specifically US laws on this but under common law (which US law is derived from) there is the crime of "Theft by Finding", however, because you turned it over to the authorities who, after the required time period were unable to find the rightful owner, the money becomes yours. However, you still have to pay your taxes on it: http://www.foxbusiness.com/personal-finance/2014/07/03/found-money-is-awesomebut-must-pay-uncle-sam/ As far as I can see, income is income whether it comes as cash, diamonds or long lost antiques. As far as the money laundering aspect, that is something the authorities would need to prove - as opposed to you just being lucky.
If GDPR applies, then no one can opt out. If it doesn't apply, then an IP block is superfluous. Whether GDPR applies is determined by Art 3 GDPR. For this, we must distinguish where the data controller is operating from. It is irrelevant where the site is hosted, but primarily relevant where the data controller (your colleague) has an “establishment”, e.g. where he resides or typically works from. Per Art 3(1), GDPR applies to all processing activities in the context of an European establishment, regardless of where the users are. So if your colleague were running this site from Europe, they wouldn't be able to circumvent GDPR by blocking European users. However, if your colleague is running this site from outside of Europe, then Art 3(1) doesn't trigger. Per Art 3(2), GDPR can apply to processing activities where there is no European establishment. There is the Art 3(2)(a) “targeting criterion”: if your colleague “offers” goods or services to people who are in Europe, regardless whether paid or gratis, then GDPR applies to all processing activities related to this offer. I'll discuss this more below. There is also the Art 3(2)(b) criterion: if your colleague monitors the behaviour of people that occurs in Europe, then GDPR applies. For example, an app collecting geolocation information or a website creating interest profiles for ad targeting might trigger this criterion. An IP block can help to establish that no offering/monitoring related to people who are in Europe is happening, but it might not be necessary. It may be worth talking a bit more about the targeting criterion. The GDPR explicitly says that mere availability of a website in Europe doesn't imply that GDPR would apply. Instead, it is necessary to establish the data controller's intention – are they soliciting users from Europe, or otherwise expecting that people from Europe might use those services? Recital 23 gives a couple of non-exhaustive factors that can be considered here, for example: the site uses a language or currency used in the EU but not used in the controller's own country the site mentions users or customers from Europe, e.g. in testimonials This means that a lot of US websites, written in English or Spanish, only mentioning payment in USD (if any), not mentioning any European countries, will not be subject to GDPR. Then, occasional European visitors are irrelevant. It wouldn't be necessary to IP-block potential European users. However, such an IP-based block would help establish that the data controller really doesn't intend for those services to be offered to people who are in Europe. My personal opinion is that it's wasted effort to block users from foreign countries in case their foreign laws claim to apply, but if such a block brings peace of mind that might be worth it. While geoblocking might not be necessary, is it sufficient? There is no clear guidance on this subject, but it seems to be generally accepted that IP-based geoblocking is fine, even though it is trivially circumvented using VPN services. Of course, if a website were to block European IP addresses but were to also advertise that people in Europe can use their services via VPNs, that would probably still be an “offer” and might defeat the point of doing any geoblocking. The Art 3(1)(a) targeting criterion is most easily applied to things like ecommerce where physical goods are shipped to the customer in return for payment – so essentially whenever the data controller participates in the EU Single Market. This is roughly similar to the concept of a Nexus in US tax law. But in principle the targeting criterion can also apply to other kinds of websites or apps such as blogs, even if they are gratis. GDPR does not just apply to for-profit commercial activity, and doesn't distinguish between controllers that are entities/LLCs and controllers who are natural persons. Things are slightly more complicated due to the Art 3(2)(b) monitoring criterion and the pervasive use of online trackers on websites, but this aspect of the GDPR is difficult to enforce and frequently ignored. In this answer, “Europe” means the European Union (EU), the European Economic Area (EEA), and the United Kingdom (UK). Note that countries like Norway are covered by GDPR, whereas Switzerland is not. Of course, the GDPR is not the only privacy law relevant internationally.
Term 1 isn't going to hold up, but that is not a GDPR matter. It's just a matter of basic consumer protection law in the EU. You can't offload responsibility for your mistakes. Looking at 2, Dale M. already pointer out that it's now how the GDPR works. You are the Data Controller. X,Y and Z are Data Processors. Article 28(1) of the GDPR is in direct conflict with your disclaimer. You accept zero responsibility, the GDPR says you are fully responsible. That's the exact opposite.
We don't know the circumstances. It could be that his business didn't owe any taxes, or that he did clever things to avoid having to pay taxes (legal tax avoidance), or that he did illegal things to avoid having to pay taxes (illegal tax evasion). In the UK, it is possible to run a company completely legal without having to pay taxes: You must make no profits to avoid paying corporation tax. You must keep your revenue below £83,000 a year to avoid paying VAT, alternatively only sell things that have 0% VAT tax (I think children's clothing fit that category), You must pay employees less than £11,500 a year each to avoid having to pay income tax on their behalf, and you must pay yourself less than about £8,000 a year to avoid paying tax and national insurance. (The company could pay you dividends to increase the money up to £16,500 tax free, but it can't really pay dividends to yourself without making profits).
You premise is correct. The processor is someone that processes data on your behalf, and since the GDPR definition of processing is extremely broad, that is about every third party subcontractor that you use for data processing, including various cloud providers. I'm afraid it will soon become a huge mess with a gazillion contracts to sign. I disagree. Yes, the GDPR says that a contract between the controller and processor must exist, but Article 28 of the GDPR does not say anything about how the controller shall document these instructions. Basically, in cases like the one you describe where John Doe relies on a web agency for having a contact form on the web, there will be a standardized (by the web agency) service agreement between the John Doe (controller) and the web agency (processor). There is nothing stopping the parties from agreeing that this service agreement that John Doe accepted as part of the onboarding procedure is also the DPA as required by the GDPR. Putting something like the following in the service agreement would do it: The parties agree that this Service Agreement between You (controller) and Us (processor) set out Your complete and final instructions to Us in relation to the processing of Personal Data and that processing outside the scope of these instructions (if any) shall require prior written agreement between You and Us. You also agree that We may engage Sub-processors to process Personal Data on Your behalf. The Sub-processors currently engaged by Us and authorized by You are listed in Annex A. I think we will se a lot of amendments in service contracts as the GDPR gets better understood, but I don't really see a flood of DPAs in addition to these amended service contracts.
On what grounds would you sue? Contract Well, I think that you would struggle to find the necessary elements (see What is a contract and what is required for them to be valid?) In particular, you would struggle to prove that there was intention to create legal relations on their part and possibly on yours. Are you able to identify in your "back &amp; forth" a clear, unequivocal offer and acceptance? Without knowing the details of the "back &amp; forth": I was hoping that someone at $organization might be willing to write an article explaining what you do, the history of the organization and how it works appears on the face of it to be a request for a gift; not an offer to treat. Promissory Estoppel If you don't have a contract then it is possible (IMO unlikely) that they induced you by your actions to commit resources (your time in writing) in anticipation of a reward (them publishing what you wrote). To be estopped they would have to have known that you were writing the article in the expectation that it would have your organisation's name in it, that they did not intend for that to happen and that they allowed you to invest those resources notwithstanding. If you can prove all of that then you can require them to do what they promised. The big difficulty I see in this is did you tell them that a) you were writing the article, b) it would have your name in it and c) you expected it to be published in that form. Copyright If they publish the work or a derivative work without your permission you can sue for breach of copyright. As it stands, they probably have an implied licence to publish and you would need to explicitly revoke that. Options There are two reasons to go to court: Money Principle If you are going to court for money then this is at best a risky investment and at worst a gamble: balance your risk and reward carefully. If you are going to court for a principle then I simultaneously admire your principles and think you're an idiot. Make a deal Explain that the reason that you wrote the article was a) to support their fine publication and the fantastic work it does (even if you don't) and b) to garner good publicity for your organisation. You understand and admire their strong editorial stance (especially if you don't) but the article involved a considerable amount of work and could they see their way clear to give you a significant discount (~80%) on a full page ad facing the article.