Privacy Policy: VAT Monitoring System

1. Introduction

Outrise Limited (“we”, “us”, “our”) operates a VAT monitoring system that integrates with HM Revenue and Customs (HMRC) Making Tax Digital (MTD) APIs to monitor our clients’ VAT compliance status.

This privacy policy explains how we collect, use, and protect personal data when providing VAT monitoring services to our clients.

2. Data Controller Information

Data Controller: Outrise Limited
Address: 76 Canterbury Innovation Centre, Canterbury, Kent, CT1 3SA
Email: [email protected]
Phone: 01227 763400
ICO Registration: ZA222779

3. Legal Basis for Processing

We process personal data under the following legal bases:

• Contract Performance: To fulfill our professional services contract with you
• Legal Obligation: To comply with professional accounting standards and HMRC requirements
• Legitimate Interests: To monitor VAT compliance and prevent penalties for our clients

4. Personal Data We Collect

4.1 Client Business Data

• Company name and trading details
• VAT Registration Number (VRN)
• Business contact information
• VAT return data and compliance status
• Financial information related to VAT obligations

4.2 Technical Data (HMRC Fraud Prevention Requirements)

In compliance with HMRC MTD regulations, our system automatically collects:

• IP addresses (public and local)
• Device information and operating system details
• Browser information and user agent strings
• Time zone and timestamp data
• Connection method information
• Software version details

Legal Requirement: Collection of fraud prevention data is mandatory under The Delivery of Tax Information through Software (Ancillary Metadata) Regulations 2019.

4.3 Access Credentials

• HMRC Gateway credentials (encrypted and stored securely)
• OAuth tokens for API access
• Multi-factor authentication details

5. How We Use Personal Data

5.1 Primary Purposes

• Monitor VAT compliance status and deadlines
• Retrieve VAT obligations, returns, and payment information
• Provide proactive compliance alerts and reporting
• Maintain digital audit trails as required by MTD

5.2 HMRC Integration

We share necessary data with HMRC through their official APIs to:

• Retrieve your VAT information
• Comply with fraud prevention requirements
• Maintain MTD compliance records

5.3 Fraud Prevention

Technical data is transmitted to HMRC to prevent fraud and protect the tax system, as required by law.

6. Data Sharing and Recipients

6.1 HMRC

• VAT data is retrieved from HMRC systems
• Fraud prevention headers are transmitted to HMRC
• All data sharing is through official HMRC APIs only

6.2 No Third Parties

We do not share your personal data with any third parties except:

• As required by law or regulation
• With your explicit consent
• To our professional advisors under confidentiality agreements

7. Data Retention

7.1 Client Data

• VAT monitoring data: Retained for 6 years after client relationship ends
• Compliance records: Retained as required by professional standards
• HMRC data: Refreshed regularly, historical data retained per statutory requirements

7.2 Technical Data

• Fraud prevention data: Retained for 2 years as required by HMRC
• Access logs: Retained for 12 months for security purposes
• Authentication tokens: Deleted upon expiry or client termination

8. Data Security

8.1 Technical Measures

• All data transmission uses HTTPS encryption
• OAuth 2.0 authentication with HMRC systems
• Regular security updates and monitoring
• Access controls and audit trails

8.2 Organizational Measures

• Staff training on data protection
• Regular security assessments
• Incident response procedures
• Professional indemnity insurance

9. Your Rights

Under UK GDPR, you have the right to:

• Access: Request copies of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion (subject to legal retention requirements)
• Restriction: Limit processing in certain circumstances
• Portability: Receive data in a structured format
• Object: Object to processing based on legitimate interests

Note: Some rights may be limited due to professional obligations and legal requirements for record keeping.

10. International Transfers

Your personal data is processed within the UK. Data is only transmitted to HMRC systems within the UK jurisdiction.

11. Automated Decision Making

Our system uses automated processing to:

• Monitor VAT compliance status
• Generate compliance alerts
• Create compliance reports

These automated processes are designed to assist in compliance monitoring and do not make decisions that significantly affect your legal rights.

12. Complaints

If you have concerns about how we handle your personal data:

1. Contact us directly: [email protected]
2. Information Commissioner’s Office (ICO):
   • Website: ico.org.uk
   • Phone: 0303 123 1113
   • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Changes to This Policy

We may update this privacy policy to reflect:

• Changes in legal requirements
• Updates to our services
• Changes in data processing practices

We will notify clients of significant changes via email or through our client portal.

14. Professional Standards

This privacy policy is designed to comply with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Professional accounting body requirements
• HMRC MTD fraud prevention regulations

15. Contact Information

For any questions about this privacy policy or our data processing:

Outrise Limited
Address: 76 Canterbury Innovation Centre, Canterbury, Kent, CT1 3SA
Email: [email protected]
Phone: 01227 763400
Website: www.outrise.co.uk

Professional Body: ICAEW

---

This privacy policy demonstrates our commitment to protecting client data while ensuring compliance with HMRC Making Tax Digital requirements and professional accounting standards.