Data Retention and Document Storage

Spanish law requires businesses to retain invoices and related documents for at least 7 years. Understanding these requirements and implementing proper storage practices is essential for tax compliance, audit preparedness, and good business management. Factumo automatically handles all retention requirements while giving you complete control over your data.

Legal Foundation

Spain's data retention requirements are established in several key regulations:

Ley General Tributaria (Ley 58/2003): Establishes the general 7-year retention period for tax-related documents.

Real Decreto 1619/2012: Specifies invoicing record requirements and acceptable storage methods.

Código de Comercio (Commercial Code): Additional retention requirements for accounting books and business records.

GDPR (Regulation EU 2016/679): European data protection regulation that must be balanced with retention requirements.

These laws work together to define what you must keep, how long you must keep it, and how it should be stored.

The 7-Year Retention Requirement

Why 7 Years?

The 7-year period stems from Spanish tax law's statute of limitations:

Standard audit period: Tax authorities can audit up to 4 years back from the current year.

Extended audit period: In cases of serious errors or fraud, audits can extend up to 10 years.

Legal safety margin: The 7-year requirement provides a buffer beyond the standard 4-year audit window.

Civil law considerations: Contract disputes and legal claims may require longer retention than basic tax compliance.

Calculating the 7-Year Period

The retention period starts from specific trigger points:

For invoices: 7 years from the end of the tax year in which the invoice was issued.

Example:

• Invoice issued: March 15, 2025
• Tax year ends: December 31, 2025
• Retention period: Through December 31, 2032
• Can dispose of: January 1, 2033

For VAT records: 7 years from the end of the tax period in which the transaction was reported.

For annual accounts: 7 years from approval of annual accounts.

Practical approach: Keep everything for at least 7 full calendar years after the year of creation to be safe.

What Happens After 7 Years?

Once the retention period expires:

Legal obligation ends: You're no longer legally required to keep the documents.

Voluntary retention: Many businesses keep records longer for business reasons.

Disposal procedures: If disposing of records, do so securely (shred physical documents, securely delete digital files).

GDPR considerations: After legal retention periods, data protection rules may require deletion of personal data (see GDPR section below).

Factumo's approach: We retain your data indefinitely unless you request deletion, exceeding the legal minimum.

What Documents Must Be Retained

Spanish law requires retention of comprehensive business documentation.

Invoice Records

All invoices issued:

• Regular invoices (facturas)
• Simplified invoices (tiquets)
• Proforma invoices
• Final invoices created from estimates
• Self-billed invoices

All invoices received:

• Supplier invoices
• Expense receipts
• Purchase documentation
• Import/export documentation

Credit notes (Facturas rectificativas):

• Credit notes you issued
• Credit notes you received
• Complete documentation of corrections

Supporting Documentation

Invoice-related documents:

• Contracts and service agreements
• Delivery notes and proof of delivery
• Purchase orders
• Payment confirmations and bank statements
• Email correspondence about invoices

VAT documentation:

• Quarterly VAT declarations (Modelo 303)
• Annual VAT summary (Modelo 390)
• EU VAT declarations (Modelo 349 for intra-community transactions)
• VAT calculation worksheets

Accounting records:

• General ledger
• Account books
• Bank reconciliations
• Cash flow statements
• Annual financial statements

Digital Records

Electronic invoices:

• PDF invoice files
• Structured data files (XML/JSON for Verifactu)
• Email records of invoice transmission
• Delivery confirmations

Digital signatures (for Verifactu compliance):

• Cryptographic signatures
• Digital certificates used
• Timestamp records
• Verification data

Audit trails:

• Complete activity logs
• User action records
• System-generated reports
• Compliance verification records

See our Audit Trail Guide for details on activity tracking.

Client and Business Data

Client information:

• Client contact details
• Tax identification numbers
• Contract terms
• Communication history

Company information:

• Business registration documents
• Tax registration certificates
• Licenses and permits
• Articles of incorporation

How Factumo Stores Your Documents

Factumo provides enterprise-grade document storage that exceeds legal requirements.

Cloud-Based Storage

All your Factumo data is stored securely in the cloud:

Automatic storage: Every invoice, credit note, and document is saved automatically when created.

Unlimited retention: Factumo stores your data indefinitely, far exceeding the 7-year legal requirement.

No manual backups needed: Unlike traditional software, you don't need to remember to back up your data.

Always accessible: Access your complete document history from anywhere with internet connection.

No storage limits: No caps on number of invoices or documents you can store.

Multiple Geographic Backups

Your data is protected with redundant backups:

Primary data center: All data stored in secure, EU-based data centers.

Real-time replication: Data automatically copied to multiple locations.

Geographic redundancy: Backups in different physical locations protect against regional disasters.

Continuous backup: Changes backed up immediately, not just at scheduled intervals.

Point-in-time recovery: Ability to restore data from any point in time if needed.

99.99% uptime: Enterprise-grade infrastructure ensures data is always available.

Data Security Measures

Factumo protects your documents with multiple security layers:

Encryption at rest: All stored data encrypted using AES-256 encryption (bank-level security).

Encryption in transit: All data transmission uses TLS 1.3 (latest secure protocol).

Access controls: Role-based permissions control who can view and modify data.

Multi-factor authentication: Optional 2FA for additional account security.

Intrusion detection: Automated monitoring for suspicious activity.

Regular security audits: Third-party security assessments and penetration testing.

ISO 27001 compliance: Data centers meet international information security standards.

GDPR compliance: Full compliance with EU data protection regulations.

Document Formats

Factumo stores documents in multiple formats for maximum compatibility and compliance:

PDF format:

• Human-readable invoice copies
• Professional layout with your branding
• Suitable for printing or client distribution
• Archival-quality format (long-term accessibility)

Structured data (for Verifactu):

• XML/JSON formats for e-invoicing compliance
• Machine-readable invoice data
• Required for upcoming Verifactu regulations
• Enables automated tax reporting

Database records:

• Complete invoice data in searchable database
• Fast filtering and reporting
• Relationship between invoices, payments, clients
• Enables business analytics

Audit trail data:

• Immutable record of all actions
• Complete activity history
• User action tracking
• Compliance verification data

Exporting and Backing Up Your Data

While Factumo handles automatic backups, you may want to export data for your own records.

Exporting Invoices

Individual invoices:

1. Open any invoice
2. Click Download PDF
3. Save to your local computer or cloud storage

Batch export:

1. Go to Invoices → Export
2. Select date range
3. Choose format:
   • ZIP of PDFs - All invoices as individual PDF files
   • CSV - Spreadsheet with invoice data
   • Excel - Formatted spreadsheet report
   • JSON - Machine-readable data format
4. Click Export

Scheduled exports: Set up automatic monthly or quarterly exports delivered to your email or cloud storage (Dropbox, Google Drive, etc.).

Exporting Client Data

Complete client list:

1. Go to Clients → Export
2. Download as CSV or Excel
3. Includes all client details, contact information, tax IDs

Client transaction history:

1. Open specific client
2. Click Export History
3. Get complete invoicing and payment history for that client

Exporting Reports

Financial reports:

• Income statements
• VAT reports (matching Modelo 303 format)
• Payment reports
• Aging reports (outstanding invoices)

Compliance reports:

• Invoice register (complete list with sequential numbers)
• Audit trail export
• Credit note register
• Annual summaries

Export formats: PDF, CSV, Excel, depending on report type.

Creating Local Backups

For extra security, some businesses maintain local backups:

Recommended approach:

1. Export all invoices quarterly as ZIP of PDFs
2. Export invoice data as CSV or Excel
3. Export audit trail for the period
4. Store on external hard drive or personal cloud storage
5. Keep organized by year and quarter

Example folder structure:

Factumo Backups/
  2025/
    Q1/
      Invoices-2025-Q1.zip
      Invoice-Data-2025-Q1.xlsx
      Audit-Trail-2025-Q1.pdf
    Q2/
      Invoices-2025-Q2.zip
      Invoice-Data-2025-Q2.xlsx
      Audit-Trail-2025-Q2.pdf

Important: Local backups are optional. Factumo's cloud storage is more secure and reliable than most personal backup systems.

Retrieving Data for Tax Audits

When tax authorities request documentation, Factumo makes retrieval simple.

Audit Preparation

When notified of an audit:

1. Determine audit period: Note which years the audit covers.
2. Notify your accountant: Share the audit scope with your tax advisor.
3. Access Factumo: Log into your account to prepare exports.
4. Review your data: Familiarize yourself with your records for the period.

Common Audit Requests

Tax inspectors typically request:

Complete invoice register:

1. Go to Reports → Invoice Register
2. Select audit period date range
3. Export as Excel or PDF
4. Provides sequential list of all invoices issued

Specific invoices:

1. Use search or filter by invoice number
2. Download individual PDFs
3. Or export multiple invoices as batch ZIP

VAT documentation:

1. Go to Reports → VAT Summary
2. Select quarterly periods
3. Export reports matching your Modelo 303 declarations
4. Includes breakdown by VAT rate, client, etc.

Payment records:

1. Go to Reports → Payments
2. Filter by date range
3. Export payment history with references

Credit notes:

1. Go to Invoices → Filter → Credit Notes
2. Export list of all corrections
3. Show clear audit trail of corrections

Client information:

1. Export client list with tax IDs
2. Show complete client transaction histories
3. Demonstrate proper client data collection

Audit trail:

1. Go to Settings → Audit Log
2. Export complete activity history
3. Demonstrate invoice integrity and compliance

See our Audit Trail Guide for details.

Providing Data to Authorities

Deliver in requested format:

• Physical copies if required (print PDFs)
• Digital files (USB drive or email)
• Online access (share specific exports)

Organize clearly:

• Label all files by period and type
• Provide table of contents for large submissions
• Include summary reports with detail backups

Respond promptly:

• Tax authorities often have deadlines (typically 10-15 days)
• Factumo's instant export capabilities help you meet tight deadlines

Keep copies:

• Save copies of everything you provide to authorities
• Document what was requested and when you responded

GDPR and Data Retention

Balancing tax law retention requirements with GDPR data protection creates unique considerations.

The GDPR Challenge

Tax law says: Keep invoices for 7+ years.

GDPR says: Don't keep personal data longer than necessary.

Resolution: Tax compliance is a lawful basis for retention that overrides general data minimization principles.

Personal Data in Invoices

Invoices contain personal data:

Client information:

• Names (individuals or business representatives)
• Tax ID numbers
• Addresses
• Email addresses
• Phone numbers

User information (your team):

• Names of staff who created invoices
• Email addresses
• Activity records

Lawful Basis for Retention

Under GDPR Article 6(1)(c), retention is lawful when:

Legal obligation: Spanish tax law requires 7-year retention.

This overrides: General data minimization principles that might otherwise require shorter retention.

After legal period: Once the legal retention period expires, GDPR obligations to minimize data may apply.

Data Subject Rights

Under GDPR, individuals have certain rights regarding their personal data:

Right of access: Clients can request copies of invoices containing their data.

Right to rectification: Clients can request correction of inaccurate personal information.

Right to erasure ("Right to be forgotten"):

• Limited during retention period: Cannot delete data required by tax law
• After retention period: Personal data can be deleted or anonymized
• Balancing act: Tax compliance takes precedence during legal retention period

Right to data portability: Clients can request their data in machine-readable format.

Factumo supports all rights: Contact support for data subject requests.

Data Protection Best Practices

Minimize data collection: Only collect personal data necessary for invoicing and tax compliance.

Secure storage: Encrypt and protect all personal data (Factumo does this automatically).

Access controls: Limit who can view client personal data (use role-based permissions).

After retention period: Consider anonymizing very old records:

• Replace client names with generic identifiers
• Remove contact information
• Preserve financial data for business analysis

Data processing agreements: If you share data with accountants or other service providers, ensure proper data processing agreements are in place.

Privacy Policy

Inform clients about data retention:

Transparency: Your privacy policy should explain:

• What personal data you collect
• Why you collect it (tax compliance, invoicing)
• How long you retain it (7+ years)
• Their rights regarding their data

Client communications: Include privacy notice in client agreements or on invoices.

Factumo's role: As your data processor, Factumo maintains its own privacy policy explaining how we protect your data.

Storage Best Practices

Beyond legal compliance, good storage practices benefit your business.

Organization

Consistent structure: Maintain organized filing even though digital storage allows chaos.

Clear naming: Use consistent file naming if storing local backups.

Metadata tagging: Use Factumo's tags and categories to organize invoices by project, client type, etc.

Regular reviews: Periodically review stored documents to ensure everything is accounted for.

Accessibility

Quick retrieval: Set up your system so you can find any document in under 1 minute.

Multiple access methods: Search by client name, invoice number, date range, amount, etc.

Mobile access: Use Factumo's mobile app for access to documents on the go.

Offline copies: Consider maintaining recent quarter backups locally for situations where internet is unavailable.

Business Continuity

Disaster preparedness: Cloud storage protects against fire, flood, theft affecting physical offices.

Redundancy: Multiple backups ensure no single failure causes data loss.

Access management: Ensure multiple authorized people can access documents if key person unavailable.

Documentation: Document where and how your business data is stored for continuity planning.

Long-Term Accessibility

Format longevity: PDF is the gold standard for long-term document storage.

Avoid proprietary formats: Relying on specific software versions creates risk if software becomes unavailable.

Regular migration: If technology changes, migrate old data to current formats.

Factumo advantage: As a cloud service, Factumo handles format migration and long-term accessibility automatically.

Common Data Retention Mistakes

Inadequate Retention Period

Wrong: Deleting invoices after 3-4 years.

Right: Retain for minimum 7 years; Factumo retains indefinitely.

Impact: Unable to provide documentation during extended audits, potential fines.

Missing Supporting Documentation

Wrong: Keeping invoices but deleting related contracts, emails, delivery proofs.

Right: Retain complete documentation package for each transaction.

Impact: Difficulty proving invoice validity during audits or disputes.

Poor Organization

Wrong: Storing all documents in single folder with no organization.

Right: Organized by year, quarter, client, or invoice number for easy retrieval.

Impact: Hours wasted searching for specific documents; frustration during audits.

No Backup Strategy

Wrong: Relying on single storage location (one computer, one external drive).

Right: Multiple backups in different locations (Factumo provides this automatically).

Impact: Complete data loss from hardware failure, theft, or disaster.

Format Incompatibility

Wrong: Storing invoices in obscure file formats or proprietary software formats.

Right: Standard formats like PDF that remain accessible long-term.

Impact: Inability to open old documents when software becomes obsolete.

Premature Deletion

Wrong: Deleting documents immediately after 7 years without considering ongoing matters.

Right: Retain longer if disputes, audits, or legal matters are ongoing.

Impact: Destruction of evidence needed for ongoing legal proceedings.

Ignoring GDPR

Wrong: Keeping personal data indefinitely without legal basis after retention period expires.

Right: Review and anonymize or delete personal data when no longer legally required.

Impact: GDPR violations and potential fines (up to €20 million or 4% of annual turnover).

Transitioning from Other Systems

If you're moving to Factumo from another invoicing system:

Import Historical Data

Bring your history with you:

1. Export invoices from old system
2. Import into Factumo using CSV import
3. Preserve invoice numbers and dates
4. Maintain continuity of invoice register

What to import:

• Client information
• All invoices from current year
• Recent invoices (past 1-2 years) for easy reference
• Outstanding invoices (unpaid)

Optional: Import older invoices for complete 7-year history in one system.

Maintain Dual Records During Transition

During transition year:

• Keep access to old system for historical lookups
• Generate new invoices in Factumo
• Export old system data as backup before discontinuing

After transition:

• Export complete history from old system
• Store as archive backup
• Use Factumo for all new invoices and primary record system

Ensure Complete Coverage

Verify you have complete 7-year coverage:

Gap analysis:

1. Identify earliest date for which you need records (7 years back)
2. Check what's in old system
3. Import to Factumo or maintain old system access until retention period expires
4. Document where historical records are stored

International Considerations

Different Retention Periods

Other countries have different requirements:

EU countries: Typically 5-10 years (varies by country).

United Kingdom: 6 years for most businesses.

United States: 3-7 years depending on document type.

Germany: 10 years for accounting documents.

If operating in multiple countries: Follow the longest retention period that applies to you.

Cross-Border Data Storage

EU data protection rules: Personal data of EU residents must be stored according to GDPR, even if business is based elsewhere.

Factumo's EU hosting: Data stored in EU data centers complies with European requirements.

Data transfer restrictions: Be careful about storing EU customer data on non-EU cloud services without proper safeguards.

Preparing for Verifactu

Spain's upcoming Verifactu e-invoicing regulation (2025-2026) adds new storage requirements.

Enhanced Storage Requirements

Digital signatures: Store cryptographic signatures for each invoice.

Structured data: Maintain XML/JSON format invoices alongside PDFs.

Transmission confirmations: Keep proof that invoice data was reported to tax authorities.

QR codes: Store verification codes and related data.

Certificate records: Maintain digital certificates used for signing.

Factumo will handle this automatically when Verifactu takes effect.

Longer Effective Retention

With digital signatures and real-time reporting:

Verifiable integrity: Signatures prove documents haven't been altered since creation.

Enhanced audit trail: More detailed records of all invoice lifecycle events.

Simplified compliance: Automated retention of all required Verifactu elements.

See our Verifactu Guide for complete details on upcoming requirements.

Next Steps

Learn more about compliance and record management:

• Verifactu - Upcoming e-invoicing regulations (2025-2026)
• Audit Trail - How Factumo tracks all account activity
• Spanish Requirements - Legal invoicing requirements
• Managing Invoices - Invoice lifecycle and management

Summary

Factumo's data retention and storage provides:

• Automatic 7+ year retention exceeding legal requirements
• Cloud-based storage with enterprise-grade security
• Multiple geographic backups protecting against data loss
• Easy export and retrieval for audits and business needs
• GDPR compliance balancing privacy and tax law requirements
• Verifactu readiness for upcoming e-invoicing regulations
• Peace of mind knowing your records are secure and accessible

You don't need to worry about data retention - Factumo handles it automatically while giving you complete control over your business records.

Questions about data retention? Contact support at support@factumo.com or consult your tax advisor for specific situations.