Privacy Policy

1. Definitions and interpretation

In this privacy policy, the following definitions are used:

Personal Data

Collectively all information that you submit to ArcTax when using our Services. This definition incorporates, where applicable, the definitions provided in the Data Protection Act (“The Act”).

Cookies

A small text file placed on your computer by this Website when you visit certain parts of the Website and/or when you use certain features of the Website. Details of the cookies used by this Website are set out in the Cookie Policy section below.

Data Protection Laws

Any applicable law relating to the processing of personal Data, including but not limited to the UK GDPR, as amended from time to time and as retained.

UK GDPR

The UK General Data Protection Regulation.

ArcTax (We, Us, Our)

ArcTax, the Making Tax Digital software service available at arctax.co.uk. For the purposes of UK GDPR, ArcTax is the data controllerof personal data you provide when using this service. ArcTax is registered with the Information Commissioner's Office (ICO).

UK and EU Cookie Law

The Privacy and Electronic Communications (EC Directive) Regulations 2003 as amended by the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 & 2018.

User (You)

Any third party that accesses the Website and is not either (i) employed by ArcTax and acting in the course of their employment or (ii) engaged as a consultant or otherwise providing services to ArcTax and accessing the Website in connection with the provision of such services.

Website

The website that you are currently using, www.arctax.co.uk, and any sub-domains of this site unless expressly excluded by their own terms and conditions.

2. Scope of this privacy policy

This privacy policy applies only to the actions of ArcTax and Users with respect to this Website. It does not extend to any websites that can be accessed from this Website including, but not limited to, any links we may provide to social media websites. Please visit third-party privacy policies for information about how they process personal data.

For purposes of the applicable Data Protection Laws, ArcTax is the “data controller”. This means that ArcTax determines the purposes for which, and the manner in which, your Data is processed.

3. Types of Data we collect

We collect the following Personal Data from you:

• Full name and date of birth
• Contact data: email address
• National Insurance Number (NINO) — stored encrypted (AES-256-GCM) at rest and never logged in plain text
• Tax data: income and expense figures, quarterly update submissions, Final Declaration data, and HMRC obligation schedules
• Agent Reference Number (ARN) and client NINOs, if you use ArcTax as a tax agent
• IP address (automatically collected)
• Web browser type and version (automatically collected)
• Operating system (automatically collected)
• A list of URLs starting with a referring site, your activity on this Website, and the site you exit to (automatically collected)
• Any information required by HMRC for relevant MTD Income Tax Self Assessment filings

4. How we collect your Data

We collect Personal Data from you in the following ways:

• Data is provided to us directly by you; and/or
• Data is collected automatically on our behalf by our sub-processor(s).

5. Data that is provided by you

ArcTax will collect your Data in a few different ways, such as:

• When you contact us through the Website, by post, e-mail or through any other means; or
• When you register for an account and use our services.
• We use Stripefor payment and subscription processing. Stripe's privacy policy governs payment card data, which we never see or store. You can learn more at stripe.com/privacy.

6. Data collected automatically

On some occasions when you access our Website, we will collect your Data automatically:

• We automatically collect some information about your visit to our site, including your IP address, the date, times and frequency with which you access the Website, and the way you use and interact with our content. This data is only collected for the purposes mentioned herein and will be fully anonymised wherever possible.
• We will collect your Data automatically via cookies, in line with the cookie settings you select. You can accept all cookies, or you have the right to object to our use of cookies. For more information about cookies, and how we use them on the Website, see our Cookie Policy below.

7. How we use your data

Any or all of the data we collect may be required by us from time to time to provide you with the best possible service and experience. Specifically, Data may be used by us for the following reasons:

• To authenticate you and provide the ArcTax service
• To transmit your tax submissions to HMRC on your behalf via the MTD API
• To send you obligation reminder emails (if enabled in Settings)
• Internal record keeping and improvement of our products and services
• To detect and prevent fraud, abuse, and security incidents
• To comply with legal obligations, including HMRC developer programme requirements

Legal basis: contract performance (Art. 6(1)(b) UK GDPR) for providing the service; legitimate interests (Art. 6(1)(f)) for security logging; legal obligation (Art. 6(1)(c)) for HMRC compliance.

8. Who we share Data with

We may share your Data with the following third parties for the following reasons:

We do not sell your personal data or share it with any third party for marketing purposes without your consent.

9. Technical and organisational security measures

The safety of your personal data is our paramount consideration. We use the following safeguards to protect your data against unauthorised or accidental disclosure:

• Secure access to your account, protected by bcrypt (cost factor 12) hashed passwords and multi-factor authentication (TOTP) available to all users.
• AES-256-GCM encryption of all NINOs stored in the database; never logged in plain text.
• AES-256-GCM encrypted, HTTP-only, Secure session cookies (iron-session). HMRC OAuth tokens are stored only in your encrypted session and never written to our database.
• All connections over TLS 1.2+ with HSTS.
• Structured audit logging of authentication and submission events. Logs do not contain NINOs or passwords.
• In the event of a security breach affecting your personal data, we will notify the ICO within 72 hours and affected users without undue delay, in accordance with UK GDPR Articles 33–34.

If you suspect any misuse, loss, or unauthorised access to your Data, please let us know immediately by emailing privacy@arctax.co.uk.

10. Data retention

• Unless a longer retention period is required or permitted by law, we will only hold your Data on our systems for the period necessary to fulfil the purposes outlined in this privacy policy.
• Account and tax data: retained for the duration of your account plus 7 years after your last submission, as required by HMRC record-keeping rules (HMRC inspection is possible for up to 6 years after a tax period).
• Audit logs: retained for 2 years for security and fraud investigation.
• Deleted accounts: personal identifiers are removed within 30 days of account deletion, subject to statutory retention periods above.

11. Your rights

You have the following rights in relation to your Data:

• Right to access: the right to request copies of the information we hold about you, or that we modify, update or delete such information. We will not charge you for this unless your request is manifestly unfounded or excessive.
• Right to correct: the right to have your Data rectified if it is inaccurate or incomplete.
• Right to erase: the right to request that we delete or remove your Data from our systems (subject to statutory retention obligations).
• Right to restrict: the right to block us from using your Data or limit the way in which we can use it.
• Right to data portability: you can export all your tax submissions and profile data from Settings > Export My Data at any time in machine-readable JSON format.
• Right to object: the right to object to our use of your Data, including where we use it for our legitimate interests.
• Right to withdraw consent: where consent is our legal basis (e.g., analytics or marketing cookies), you may withdraw it at any time by adjusting your cookie preferences.

To exercise any of these rights, email privacy@arctax.co.uk. We will respond within 30 days. If you are not satisfied with our response, you have the right to submit a complaint to the Information Commissioner's Office (ICO).

12. Links to other websites

This Website may, from time to time, provide links to other websites. We have no control over such websites and are not responsible for their content. This privacy policy does not extend to your use of such websites. You are advised to read the privacy policy of other websites prior to using them.

13. Changes of business ownership and control

ArcTax may, from time to time, expand or reduce our business, and this may involve the sale and/or transfer of control of all or part of ArcTax. Data provided by Users will, where it is relevant to any part of our business so transferred, be transferred along with that part. The new owner or newly controlling party will, under the terms of this privacy policy, be permitted to use the Data for the purposes for which it was originally supplied to us.

14. Changes to this policy

We may update this policy when our practices change or when required by law. The “Last updated” date at the top of this page will reflect any changes. We will notify users by email for material changes.

15. Contact

Questions or requests regarding this policy: privacy@arctax.co.uk