What are EU requirements for listing VAT on receipts? I'm working with a U.S. dot-com that sells around the world. A lot of corporate customers, especially in Spain and Italy, insist that they need their VAT number listed on all receipts for payments they make to the U.S. company. Is this correct by law or regulation? Is there any guidance that makes it clear whether they can just print the receipt and write their company's VAT number on it? (Customers I've asked say that they can't do that. So our current solution is to give them blank letterhead and tell them to put whatever they need for their books on it.)
The EU VAT directive has harmonized rules for invoices. Relevant for your question: Article 226 requires, among others, that the invoice contains the customer's VAT identification number, as referred to in Article 214, under which the customer received a supply of goods or services in respect of which he is liable for payment of VAT, or received a supply of goods as referred to in Article 138 If the customers receive invoices by electronic means they are supposed to archive the electronic invoice (and not a printout). They are not allowed to alter it in any way for archiving purposes by Article 246 The authenticity of the origin and the integrity of the content of the invoices stored, as well as their legibility, must be guaranteed throughout the storage period. In respect of the invoices referred to in the second subparagraph of Article 233(1), the details they contain may not be altered and must remain legible throughout the storage period. (where Article 233(1) refers to electronically received invoices.) The rules where put in place to combat VAT fraud – putting the VAT number of both parties on the invoice makes it a bit harder. If you were allowed to alter invoices before giving them to the authorities you would circumvent the entire purpose.
You would not be required to do either of the things you state (unless you explicitly agreed to do so). What, strictly speaking, you need to do is to advise the seller that the original goods arrived and ask them if they want to collect them, have you return them at their expense or abandon the goods to you. (In all likelyhood they will give the goods to you because the cost of them recovering them is to high). Although I'm not in the UK, I believe the Sale of Goods Act 1979 applies. Strictly speaking, as you have not paid for the goods, they still belong to the seller - but you do not have to pay to return them.
That is private. Who you work for is not information that is disclosed publicly by any state actor in Germany, just like your taxes. In fact, that or who you are employed at is often regarded as personal and private information. Nigh impossible through agencies Public agencies like the Fiskus (tax), Agentur für Arbeit, and immigration are not allowed to give any information about a person to anyone but that person or another agency that has the right to that information. Yes, (generally speaking) the tax office may not even say that a person exists (or doesn't) and what their tax number is to anyone but the person in question.
I'm not sure about USA law, it's probably similar to UK law. In the UK a trademark is registered for a particular business activity, and you can't just blanket register for "all" activities as that would be anti-competitive. I have a trademark "Dreamcraft" for dream interpretation and related activities. However, the name "Dreamcraft" is also a registered trademark for a company selling luxury yachts, and again for a company selling up-market craft materials. A website or organisation that is a gripe-site using the same name would not be in breach of any of these trademarks because it wouldn't be in direct competition with any of these companies.
There is no requirement about "data" in the GDPR, so provided this is just "data", no. An empty form with fields for personal data contains no personal data. On the other hand, if the form is filled in by the user with personal data (as defined in GDPR article 4), and you receive a copy of the filled in form and process these personal data (as defined in GDPR article 4) - then the answer is: Yes. However, if you do not process the personal data (i.e. the form is just printed out on paper and filled in with a pen, and nobody except the data subject has access to the piece of paper with the filled in form - then the answer again is "no").
Whether GDPR applies does not depend on the country of residence. Instead, GDPR applies to a non-EU site or service if the data controller offers products or services to people in the EU (see Art 3(2) GDPR). This depends solely on the behaviour and intent of the data controller / the provider of the website – compare also the discussion of the “targeting criterion” in EDPB guidelines 3/2018 on the territorial scope of the GDPR. While your proposed measures might not be entirely ineffective (in that they document an intent to not serve people in the EU), they are both unnecessarily restrictive and overly lax. For example, they would unnecessarily prevent EU tourists in the US from registering but would nevertheless allow US tourists in the EU. For the targeting criterion, it matters whether the data subject is in the EU at the time of the offer, not at all what their residency is. Even if a person who is currently in the EU registers with your service, that doesn't necessarily mean that you are targeting people in the EU. Instead of implementing signup restrictions, a better strategy might be to clarify in the copy on your website that you are only targeting the domestic US market, not the European market with your services. I have discussed this in more detail in an answer to “How can you block GDPR users from US based sites?” If you have a site where GDPR doesn't apply, and you receive a GDPR data subject request, you shouldn't deny it on the basis that the user must have lied – instead you can deny it on the basis that GDPR just doesn't apply to you.
I do not believe that there is any requirement to number clauses, paragraphs, or pages, and I have certainly seen contracts where none of these are numbered. It is a common practice to number provisions in some way, in particular to make reference from one to another easier. But not all contracts include such internal references. Contracts presented in electronic form, such as on a web page, may not have any clear concept of separate pages, and so page numbers would be pointless on such contracts. Page numbers on contracts printed out are common, but I do not know of any legal requirement for such numbers. For contracts presented in electronic form, one can ensure against unauthorized modification by including a checksum or hash of the contract text. If a one-way hash function is used, it will be quite hard to produce a text with a different content but an identical hash value. This technique could also be used on printed contracts. However, I do not recall seeing this technique used in practice.
This will depend partly on what you use the e-commerce website for. If it is simply a point-of-sales and your accounting records are kept elsewhere, then it may be possible to delete their account including associated orders and payments, though you should check that the software doesn't simply update the record by setting the value for a column named deleted or del for short to 1 instead of 0 to identify deleted records, but instead actually deletes the record from the database. You should consider how you will refund a customer if required after doing so!! (i.e. perhaps you acknowledge the request but keep the information for at least as long as the customer is eligible for a refund, and then delete it). If the system is also used for accounting records, then if a customer/user wishes to assert their right to be forgotten, it is likely you'll need to disable the account and apply some kind of pseudonymisation (essentially replacing personal identifiers such as name, email address, date-of-birth, with dummy/null data), in order to preserve the integrity of your financial records. For example, in the UK, there is a statutory obligation on companies to retain financial records for at 7 years. In cases where data cannot be immediately erased due to other legitimate reasons for which it must be kept, once those retention periods expire the data must be erased. You'll need to keep a record of anyone that requests to be forgotten, and remember to follow-up to complete erasure at the appropriate dates if it can't be done immediately, and when the data is destroyed the user needs to be informed.