Privacy Policy

1. Who we are

We are an independent third-party software provider. We are not HMRC, we are not endorsed by HMRC, and we process personal data to operate this service.

2. What data we collect

• Account information such as name, email, and login details
• HMRC connection data, including secure access tokens
• Submission records, responses, and confirmation references
• Technical and security data such as IP address, device/browser details, and audit logs

3. How we use data

• To authenticate users and keep accounts secure
• To submit VAT and ITSA totals to HMRC APIs
• To store submission history and provide confirmations
• To operate, support, and improve the reliability and security of the service

4. Legal bases

Depending on context, we process personal data on the basis of contract, legitimate interests, and legal obligations. Where consent is required, we rely on consent and you can withdraw it where applicable.

5. HMRC integration

When you connect HMRC, we process the data needed to authenticate and submit through HMRC APIs on your instruction. Submission and response data is retained in your account history for operational and compliance records.

6. Data sharing

We share personal data only where needed to run the service, including with HMRC and trusted infrastructure providers. We do not sell personal data.

7. Retention

We retain personal data for as long as reasonably required to provide the service, maintain audit trails, resolve disputes, and meet legal or HMRC-related compliance record requirements, then delete or anonymise where appropriate.

8. Data security

• Data is transmitted and stored using secure methods
• Sensitive credentials and tokens are stored securely
• Access is restricted to authorised service operations

9. Your rights and contact

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to certain processing. If you have privacy questions, contact us at info@itsa.tax. If you are unhappy with how we handle personal data, you may complain to the UK Information Commissioner's Office (ICO).

10. Third-party links and services

The service may link to third-party websites or services. We are not responsible for their content or privacy practices, and you should review their own privacy notices.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. The latest version will always be shown on this page with an updated "Last updated" date.