What legal reasons preventing me for not providing VAT on registration form? I wanted to register on-line on some site (which seems to be owned by GmbH) as customer using my UK's Limited company. However it's required for UK to provide tax details: European sales tax-identification number (UID) which I assume it's the same as EU VAT. However my company doesn't have VAT yet. So when I'm trying to leave it blank, the error says: European sales tax-identification number (UID) can't be blank. I've contacted the company and they replied that for legal reasons, all customers have to provide a VAT number in order to register and there is no way around this. Really? Which legal reasons they refer which preventing me to register my company on the web site?
I doubt that they are legally required to get your VAT as a condition of registration. However, they are a private company, and they are allowed to attach almost any restriction they want to registration. It is more likely that they require your VAT for some of the business interactions that they expect will happen after you register for the site and have decided to make it a condition of registration.
The law of each country where you offer the app for download applies, and you have to consider: Privacy Policy (GDPR in EU, CCPA in California, APPI in Japan, LGPD in Brasil, and more - check each country to be on the safe side) Disclaimer versus AGB/Terms and Conditions (e.g. Germany), not required but recommended Impressum (Germany, Switzerland, Austria) Value Added Tax (VAT) which is taken care of e.g. by Google Play for most countries but not all (e.g. not for Japan) in case the app is not free Consumer Protection Law - applicable (and different) everywhere There might be more, but these are the important ones I am aware of.
There is no requirement about "data" in the GDPR, so provided this is just "data", no. An empty form with fields for personal data contains no personal data. On the other hand, if the form is filled in by the user with personal data (as defined in GDPR article 4), and you receive a copy of the filled in form and process these personal data (as defined in GDPR article 4) - then the answer is: Yes. However, if you do not process the personal data (i.e. the form is just printed out on paper and filled in with a pen, and nobody except the data subject has access to the piece of paper with the filled in form - then the answer again is "no").
To add to Nij's answer: You write I have not signed any paper document. You seem to assume that a binding contract can only be entered into in writing. This is wrong. In most countries (certainly in Germany), a binding contract generally does not require a written document. A contract can be entered into orally, or even silently ("Schlüssiges Handeln", "Implied-in-fact contract"). All that is required for a contract is that one party made a proposal, and the other party indicated their agreement, implicitly or explicitly ("Willenserklärung"). Clicking "yes" on a website can mean entering into a contract if you could reasonably be expected to understand that you were accepting certain obligations (such as that of paying a fee). So in your case, you probably entered into a valid contract, and will have to fulfill your obligation under it, which means paying. From a practical point of view: If you choose not to pay, the organizers will probably either drop the claim (if you are lucky), or they will pursue it. In that case, they can send you a "Mahnbescheid" for their claim. At that point you either pay within 14 days, or respond that you reject the claim, then there will be a trial, which you will probably lose, and pay a lot more than 40€. If you do not respond to the Mahnbescheid, you will receive a "Vollstreckungsbescheid", and then a visit by a Gerichtsvollzieher (officer of the court). My advice would be to pay and learn to properly cancel registrations.
The answer may vary depending on your state. If you're in a state that's a member of the Streamlined Sales and Use Tax Agreement,* there's a designated heirarchy for sourcing sales of digital goods: First, if you're making delivery to the customer at your location, source to the location where you make the sale. If not, source to the location where your customer will receive the product. Neither of those works for you, so you'd continue down the list to the first one you can apply: The purchaser’s address that you maintain in the ordinary course of the your business; The purchaser's address obtained during the consummation of the sale; The address where you first make the product available for transmission or the address from which you provided the service. By my reading, that means that in the absence of an address, you basically come back full circle and source the sale back to your own location. *Arkansas, Georgia, Indiana, Iowa, Kansas, Kentucky, Michigan, Minnesota, Nebraska, Nevada, New Jersey, North Carolina, North Dakota, Ohio, Oklahoma, Rhode Island, South Dakota, Tennessee, Utah, Vermont, Washington, West Virginia, Wisconsin and Wyoming
There are multiple issues with what you are trying to do, including issues with copyright, personality rights, and data protection. You are trying to use other people's content and likeness for your advertisement. Unless you are certain that you can do this in your relevant jurisdictions, without their consent, this sounds like a very bad idea. At least under GDPR, “but they made it public” is not an excuse. Personal data is personal data regardless of how you acquire it. The GDPR also has a very broad concept of identifiability that goes beyond direct identifiers or PII. If you want to use other people's personal data, you need a legal basis, and must provide them notice about your processing. Consent (informed opt-in) is one legal basis, legitimate interest (opt-out) another. You are suggesting to avoid this by blurring PII, but you may also have to blur other content that is indirectly identifiable. Real anonymization that meets the GDPR's definition is a really hard problem. In some cases, a legitimate interest is able to avoid such problems. E.g. if I make a video with commentary about a Tweet, it would likely be OK to show surrounding personal data like the responses including the identities of the various accounts, to the degree that this is relevant to the commentary and/or necessary for proper attribution. However, that commentary likely has strong protections under freedom of expression. At least from an European viewpoint, a tutorial, demo, or advertisement would not have a freedom of expression argument that would shift a GDPR legitimate interest balancing test in your favour. Instead of blurring almost everything in your video or working on GDPR compliance, content licenses, and release forms, you should consider a different solution: create dummy content just for your videos. You can use your own content, and maybe add a dummy profile.
You are missing something. The fact that you have a tick box and its state is saved in the database is enough. The burden of proof is only "on a balance of probabilities", so someone arguing that they didn't consent would have to demonstrate that you falsified the database entry somehow. In terms of GDPR requirements in general you don't need a greater level of proof than this, the key thing is that you have a robust system in place to obtain proof (such as not allowing data into the database without a tick in the box).
The GDPR allows the right to access to be limited if this access would “adversely affect the rights and freedoms of others” (Art 15(4) GDPR). However, access to the recording would not give you more information than you've already received during the phone call, so this exemption is quite unlikely to apply in any case. UK data protection law also has a large list of additional exceptions, as summarized here by ICO guidance. These exemptions also cover some aspects of trade secrets, and even mention insurance examples. However, not such exemption is likely to apply in your case: the recording would not give you more information than you already have. If the data controller is concerned about some parts of the conversation, they should provide a redacted copy and explain why the redactions were performed. They should not reject the request outright. If the data controller wants to reject the request entirely, they must do so within the time frame for the DSAR (one month), must explain their reasons, and must inform you that you're allowed to lodge a complaint with your supervisory authority or to sue them. However, ICO guidance is flexible on how detailed the reason for refusal can be: Where an exemption applies, the reasons you give to an individual for not complying with a request may depend upon the particular case. For example, if telling an individual that you have applied a particular exemption would prejudice the purpose of that exemption, your response may be more general. However, where possible, you should be transparent about your reasons for withholding information. Here, I don't see any reason why full transparency would be a problem, so I would expect that the data controller can point to a specific exemption in UK data protection law. If you are unsatisfied with the data controller's response, please consider lodging a complaint with the supervisory authority. In the UK, this is the ICO. On the ICO complaints page, you can fill out the online form about “your personal information concerns”.