Privacy law in some jurisdictions, such as CCPA in California and the GDPR in the EU, permits individuals to know what data of theirs third parties hold. These laws often permit data subjects to demand their data be deleted. There are instances where these requests may be denied. Check with your company's tax experts and privacy attorneys before responding to deletion requests.
Data access requests
AvaTax, Exemptions, and CertCapture let you respond to data subject access requests without contacting Avalara for assistance. Managed Returns data need not be reviewed separately from AvaTax data.
To find data in AvaTax:
- Log in to AvaTax and select Transactions.
- Select Filters. You can filter transaction data by document code, customer code, import ID, document type, document status, country, region, or date.
- After choosing filters, select Apply.
- When you find the transaction you’re looking for, select it to see transaction data and tax details.
To find data in Exemptions:
- Log in to AvaTax and select Exemptions.
- Select a search filter. You can search exemptions by customer code, customer name, or certificate ID.
- Enter your search term and select Apply.
To learn about finding customer data in CertCapture, see Search for Customers.
Data deletion requests
Because you can't delete AvaTax transactions, you must submit deletion requests to Avalara. Send data deletion requests to email@example.com, and make sure to provide the correct document code in the request.
Your tax managers and privacy counsel should carefully consider whether to fulfill deletion requests—your company has subsequent legal obligations to file returns and remit tax, and those returns are subject to audit. Deletion of data will negate any contractual obligations Avalara may have with respect to deleted transactions. Further, Avalara may require that you sign a waiver before deleting data.
Avalara won't delete transactions if you purchased Managed Returns in addition to AvaTax. Privacy laws permit companies to refuse to delete if there is need to maintain data to comply with legal obligations. Avalara has continuing legal obligations with respect to anti-money laundering and banking secrecy laws.
Exemptions permits data deletion when there are no active exemptions.
If the customer associated with the certificate also has AvaTax transactions, consult your company's tax experts and privacy counsel before deleting this data, as tax exemptions are subject to audit. Certification information may be separately stored if connected to AvaTax transactions. Data deletion requests must be submitted to firstname.lastname@example.org with the correct customer code identified. See further information above in the section on AvaTax data subject deletion requests.
You can delete CertCapture certificates yourself. See Delete a document for detailed instructions.
However, CertCapture data is stored in AvaTax to make it easier for these two services to work together. If you use both CertCapture and AvaTax and want to delete customer data, submit a deletion request by sending an email to email@example.com. See the AvaTax section above for more information.