Companion to the main Privacy Policy. This addendum describes how Operula processes Artisan personal data specifically in connection with our obligations under EU Council Directive 2021/514 (DAC7), Italian Legislative Decree 32/2023, and equivalent OECD reporting frameworks. It supplements the main Privacy Policy without replacing it. Where the two documents address the same processing, this addendum prevails.
Data controller
Bluix Group LTD (UK Company 17097946), 41 Devonshire Street, Ground Floor, London W1G 7AJ, operating the Operula platform.
DPO contact: dpo@operula.com
Categories of data processed for reporting obligations
- Identifying data: legal name, date of birth (individuals), nationality
- Tax data: Tax Identification Number (Codice Fiscale or local equivalent), VAT number where applicable, country of tax residence
- Address data: primary residential or business address
- Contact data: email, phone
- Payment data: IBAN or equivalent payment-account identifier used for payouts
- Business-registration data: trade-register number where applicable, country, registration date
- Transactional data: per quarter — total consideration paid, number of transactions, fees and commissions retained, taxes withheld
Legal basis
The processing is necessary for compliance with a legal obligation to which the controller is subject (Article 6(1)(c) GDPR), namely the reporting obligations under DAC7 / D.Lgs. 32/2023.
For data collected before the seller crosses the reporting threshold, the legal basis is the legitimate interest of the controller (Article 6(1)(f) GDPR) in maintaining a single consistent dataset that becomes reportable if and when the threshold is crossed mid-year.
Recipients
The data is shared with:
- Tax authorities of the controller's jurisdiction of establishment, in DAC7 XSD-validated XML format, once per year by 31 January for the previous calendar year.
- Tax authorities of other Member States, indirectly: the controller's home tax authority forwards relevant items under the DAC7 inter-MS exchange.
- Auditors and external compliance reviewers, only under written confidentiality undertakings.
- Internal compliance and superadmin staff, under role-based access control logged in the audit trail.
The data is not sold, rented, or transferred to advertisers, marketing partners, or any third party outside the recipients listed above.
Cross-border transfers
The controller is established in the United Kingdom. The European Commission has issued an adequacy decision for the UK, so transfers from EU artisans to the UK-based controller proceed under that decision.
For onward transfers (e.g. non-EU sellers), the controller relies on Standard Contractual Clauses (Decision 2021/914) plus a transfer impact assessment as required by case law.
Retention
| Data category | Retention period |
|---|---|
| Identifying, tax, address, contact, payment, business-registration | 10 years from the end of the calendar year of the last reportable event |
| Transactional data (per-line) | 10 years |
| Acceptance-of-terms log (timestamp + IP) | 10 years |
| Audit trail of access, edit, suspension | 6 years |
| Identity verification documents (ID + selfie) | 365 days from verification completion, then automatically purged |
After expiry, the data is irreversibly deleted or, where deletion is impractical (immutable backups), encrypted with a key that is destroyed at expiry.
Your rights
You have the rights under Articles 15-22 GDPR: access, rectification, erasure, restriction, portability, object, and withdraw consent. To exercise any of these rights, write to dpo@operula.com or use the in-dashboard "Privacy Request" form. We respond within 30 days (extendable by 60 days for complex requests, with notice).
Note: DAC7-mandated data cannot be erased before its retention period expires.
Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority:
- UK: ICO (Information Commissioner's Office) — www.ico.org.uk
- Italy: Garante per la Protezione dei Dati Personali — www.garanteprivacy.it
- EU general: the supervisory authority of your Member State of residence
Specific note on minors
Operula does not knowingly enrol minors as Artisans. The Hobbyist tier requires you to be at least the age of legal capacity in your jurisdiction (typically 18). The Professional tier requires legal capacity to enter into commercial contracts.
Updates to this addendum
This addendum may be updated to reflect changes in law (e.g. amendments to DAC7) or in our processing. Material changes are communicated in the dashboard with at least 30 days' notice. The current effective version is always available at this URL.