1. Who we are
This Privacy Policy explains how [COMPANY_NAME] (“we”, “us”, “our”), trading as DIY Tax Return, collects and uses personal data when you use the DIY Tax Return service at diytaxreturn.co.uk, our mobile app, and related services (together, the “Service”).
We are the data controller for the personal data we process about you. Our registered address is [REGISTERED_ADDRESS], registered in England and Wales under company number [COMPANY_NUMBER]. We are registered with the UK Information Commissioner’s Office (ICO) under registration number [ICO_REG_NUMBER].
If you have any questions about this policy or our handling of your data, contact us at privacy@diytaxreturn.co.uk.
2. What personal data we collect
The categories of personal data we hold about you are:
| Category | Examples | Where it comes from |
|---|---|---|
| Account identity | Name, email address, phone number, postal address | You, at sign-up |
| Authentication | Hashed password, one-time codes, session tokens, login history | You + automatically |
| HMRC credentials | OAuth access token + refresh token (encrypted at rest), National Insurance number (encrypted at rest) | You (NINO) and HMRC’s OAuth flow (tokens) |
| Financial data | Bank statement files you upload, individual transactions extracted from them, AI-suggested category labels you accept or override, tax-return figures and submission records | You (uploads) + our processing of them |
| Device & usage data | IP address, browser type, operating system, timezone, screen size, plus the device fingerprint values HMRC requires for fraud prevention on each filing | Automatically, from your device |
| Audit trail | Actions you and our staff take on your account, with timestamps and source IP | Automatically |
| Support correspondence | Tickets and messages you send us | You |
We do not store your HMRC sign-in password. We use OAuth 2.0, which means HMRC issues us a token after you sign in to them directly.
3. Why we use your data, and our legal basis
We process your personal data only when one of the lawful bases under the UK General Data Protection Regulation (UK GDPR) applies. The bases we rely on are:
- Contract (Art. 6(1)(b)) — to provide the Service you signed up for: account management, uploading and processing your bank statements, classifying transactions, calculating your tax position, submitting it to HMRC on your behalf, and customer support.
- Legal obligation (Art. 6(1)(c)) — to keep records HMRC requires (e.g. submission audit trail, fraud-prevention headers per HMRC’s MTD specification) and to respond to lawful requests from regulators.
- Legitimate interests (Art. 6(1)(f)) — to keep the Service secure (e.g. rate-limiting, abuse detection, security audit logs), to fix bugs reported by you, and to improve our product. We balance these interests against your privacy rights and only rely on this basis when our processing is reasonable, expected, and proportionate.
- Consent (Art. 6(1)(a)) — for any optional cookies and (in future) any marketing communications. You can withdraw consent at any time using the Cookie preferences link in the product app footer, or by emailing us.
For special-category data (notably your National Insurance number, which is treated as identifying data for HMRC purposes), we rely on Article 9(2)(g) UK GDPR — processing necessary for reasons of substantial public interest, on the basis of UK law (the Taxes Management Act 1970 and the Finance Act 2017 provisions on Making Tax Digital).
4. Who we share your data with
We only share personal data when we need to, and only with providers contractually bound to GDPR-equivalent protections:
- HM Revenue & Customs (HMRC) — we submit your tax filings and the required fraud-prevention data directly to HMRC’s MTD API on your instruction. HMRC is a separate data controller for what it does with that data; see HMRC’s own privacy notice.
- Cloud infrastructure providers — we host the Service on managed infrastructure ([CLOUD_PROVIDER]). They store data on our behalf as a processor under a Data Processing Agreement (DPA).
- AI classification providers — to suggest tax categories for your transactions, we may send individual transaction lines (description + amount only) to third-party large-language-model providers, currently Anthropic and OpenAI. We do not send your name, NINO, account number, or HMRC tokens to these providers. Both have committed contractually not to train models on the data we send.
- Email delivery — transactional emails (sign-up confirmation, OTP, password reset) are sent via our SMTP provider, currently [SMTP_PROVIDER].
- Professional advisers — lawyers, accountants and auditors when we need their advice or they are exercising statutory rights.
- Regulators and law enforcement — where we are legally required to disclose data (e.g. a court order or a request from HMRC, the ICO, the police).
We do not sell your personal data to anyone, and we do not share it for third-party marketing.
5. International transfers
Some of our processors operate outside the United Kingdom. Specifically:
- Anthropic and OpenAI process data in the United States.
- Our infrastructure provider may host data in EU/EEA datacentres or in the United States depending on the specific service.
For each transfer outside the UK, we rely on either an adequacy decision by the UK government (currently in place for the EU/EEA) or the UK’s International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses supplemented by the UK Addendum. Copies of the relevant transfer agreements are available on request to privacy@diytaxreturn.co.uk.
6. How long we keep your data
| Data | Retention |
|---|---|
| Account profile (name, email, etc.) | For as long as your account is active. Deleted within 30 days of account deletion request. |
| Bank statements, transactions | 6 years after submission to HMRC, in line with HMRC’s record-keeping requirements for Self Assessment. |
| Tax returns & HMRC receipts | 6 years after the tax year ends. |
| HMRC OAuth tokens | Deleted when you disconnect HMRC, or 18 months after last use. |
| Audit logs | 2 years rolling. |
| Support tickets | 3 years after the ticket is closed. |
7. Your rights
Under UK GDPR you have the following rights, free of charge:
- Access — ask for a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure (“right to be forgotten”) — ask us to delete your data, subject to our legal obligations (we may need to keep some data to comply with HMRC record-keeping rules).
- Portability — receive your data in a machine-readable format so you can move it to another provider. You can use the Settings → Download my data button in the product app at any time.
- Restriction and Objection — ask us to limit how we use your data, or object to specific processing.
- Withdraw consent — where we rely on consent (e.g. analytics cookies), you can withdraw it at any time without affecting prior lawful processing.
To exercise any of these rights, email privacy@diytaxreturn.co.uk. We’ll respond within one month.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe we’ve mishandled your data — though we’d ask you to contact us first so we can try to resolve things.
8. Cookies
We use cookies to keep you signed in, to remember your choices, and (with your consent) to measure how the Service is used so we can improve it. In the product app, the Cookie preferences link in the footer lets you accept or reject the optional categories, and you can change your mind at any time.
9. Security
We hold sensitive financial data, so we treat security as a first-class concern. Specifically:
- Passwords are hashed (bcrypt). We never store them in plaintext and they are not recoverable.
- Your HMRC OAuth tokens and National Insurance number are encrypted at rest using AES-CBC.
- All traffic between you and the Service is encrypted in transit using TLS 1.2+.
- Access to customer data by our staff is role-restricted and recorded in an audit log.
- We commission an independent penetration test of the Service at least once a year.
Despite this, no system is unbreakable. If we discover a security breach that affects your personal data, we will notify the ICO within 72 hours and notify you directly if there is a high risk to your rights and freedoms, in line with Articles 33 and 34 UK GDPR.
10. Children
The Service is intended for adults filing UK Self Assessment. We do not knowingly collect data from anyone under 18. If you believe a child has provided us data, please email us so we can delete it.
11. Changes to this policy
We may update this policy from time to time. Material changes will be flagged on this page and, where they affect you directly, communicated by email. The “Last updated” date at the top of this page always shows when the policy was last revised.
12. Contact us
For any privacy-related question or to exercise your rights:
Email:
privacy@diytaxreturn.co.uk
Post: [COMPANY_NAME], [REGISTERED_ADDRESS]
This policy is provided in plain English to comply with Article 12 UK GDPR. If you need it in another format (large-print, audio, another language), please ask.
← Back to DIY Tax Return