1. Introduction
By accessing or using the EasyTaxer software ("the Service"), provided by Agile Release Limited (of which EasyTaxer is a trading name), a company registered in England and Wales under company number 13237670 with its registered office at 7 Larkshall Road, London, England, E4 7HS and UK VAT registration number 373385181 ("the Company", "we", "us", or "our"), we are committed to protecting the privacy and security of your personal and financial data. This policy explains how we handle your data when you use our Making Tax Digital (MTD) Income Tax software.
2. Data We Collect
We collect the following types of information to provide our tax submission services:
- Identity Data: Name, business name, email address, and contact details.
- HMRC Identifiers: Your National Insurance Number (NINO), Unique Taxpayer Reference (UTR), and Government Gateway credentials (processed securely via OAuth).
- Financial Data: Income records, expense receipts, bank transaction details, and tax liability calculations.
- User Content: Supporting documents (PDFs, images) you upload via our secure messaging or storage features.
- Social Sign-In Data: If you choose to sign in with a social provider (such as Google), we store the provider’s name, your unique account identifier at that provider, and the email address the provider asserts for you, so we can recognise your account on later sign-ins. We never receive or store your provider password. These linked identities are erased together with the rest of your account data when your account is deleted.
3. Legal Basis for Processing
Under Article 6 of the UK GDPR we must have a lawful basis for processing your personal data. The bases we rely on are:
- Performance of a contract (Art. 6(1)(b)) — for the data we need to provide the Service to you, including your account details, HMRC identifiers (NINO, UTR), bank transaction records, and financial data used to prepare and submit your tax obligations.
- Compliance with a legal obligation (Art. 6(1)(c)) — for retaining your HMRC submission evidence, fraud-prevention data, and billing records for approximately 6 years, in line with HMRC record-keeping requirements (see section 7, Data Retention).
- Consent (Art. 6(1)(a)) — for non-essential cookies and any future marketing communications. You can withdraw consent at any time via our cookie banner or your account settings.
- Legitimate interests (Art. 6(1)(f)) — for security monitoring, fraud prevention, service improvement, and our privacy-friendly, cookieless website analytics (which set no cookies and store no personal data, so they rely on legitimate interest rather than consent), where these do not override your rights and freedoms.
4. How We Use HMRC Data
Our software integrates directly with HMRC APIs to help you comply with UK tax law. We use this connection to:
- Retrieve your current tax obligations and liabilities.
- Submit quarterly updates and your final declaration on your behalf.
- View your tax calculation and payment history.
Authorization: We only access your HMRC data after you provide explicit authority via the official HMRC OAuth 2.0 authentication process. We do not view or store your Government Gateway password.
5. Data Storage and Security
We take the security of your data seriously and employ multiple layers of protection:
- Encryption in Transit: All data transmitted between your browser, our servers, and HMRC is encrypted using TLS 1.2/1.3 (HTTPS).
- Encryption at Rest: All personal data, financial records, and uploaded files are stored on encrypted storage volumes using infrastructure-level AES-256 encryption at rest provided by our hosting platform (IONOS).
- Data Location: Your data is hosted on IONOS Cloud infrastructure located in the United Kingdom or the European Economic Area (EEA). Both the UK and the EEA recognise each other under reciprocal adequacy decisions, so data may move between them without additional safeguards. We do not transfer your personal data outside the UK or EEA.
Reporting a security concern. If you believe you have found a security vulnerability or that your data may have been compromised, please report it to us immediately at info@easytaxer.com or via the in-app support feature. We investigate all reports promptly. Where a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, and inform affected users without undue delay where required.
6. Data Sharing and Sub-processors
6.1 HMRC
We share your financial data with HM Revenue & Customs (HMRC) solely to fulfil your Making Tax Digital obligations. Submissions are made via HMRC's official APIs after your explicit OAuth 2.0 authorisation.
6.2 Sub-processors
To deliver our service we engage a small number of trusted third-party processors. Each is bound by a data processing agreement and may only use your data on our documented instructions.
- IONOS Cloud — Hosting and encrypted data storage. Location: UK / EEA.
- Hostinger — Transactional and account email delivery (registration, password reset, submission confirmations, etc.). Location: EU (Lithuania).
- Umami Analytics (Umami Cloud) — Privacy-friendly, cookieless website analytics. It sets no cookies, stores no IP addresses, and does not track visitors across sites. Location: EU.
This list will be kept current. If we add a new sub-processor or materially change how an existing one is used, we will update this policy and, where required, obtain your consent before the change takes effect.
6.3 No sale of personal data
We do not sell, trade, or rent your personal information to any third party. Data is shared only with the parties listed above, and only for the purposes described.
7. Data Retention
We apply a two-tier retention model:
- Your app and account data (your profile, in-app working data and drafts, preferences, and the account record itself) is deleted 120 days after you cancel or your paid subscription term ends, if you have not re-subscribed in the meantime. During those 120 days your account is read-only and you can export your records; we send reminders before deletion. You remain responsible for keeping your own Self Assessment records for at least 5 years.
- Compliance and billing records — your HMRC submission evidence, fraud-prevention header data, and our own billing/invoice records — are retained for approximately 6 years, where we are required to keep them to meet a legal obligation (UK GDPR Art. 17(3)(b) and HMRC record-keeping requirements). These are carved out of the 120-day deletion above and survive it.
You may request the deletion of your account and associated data at any time by contacting support; the compliance and billing records above may be retained for the period the law requires.
8. Your Rights
Under the UK GDPR and Data Protection Act 2018, you have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data ("Right to be forgotten").
- Object to or restrict certain processing.
- Receive your data in a portable format.
- Withdraw your consent for HMRC integration, analytics, or any other consent-based processing at any time.
To exercise any of these rights, contact us at info@easytaxer.com. We will respond within one month.
9. Right to Lodge a Complaint
You have the right to lodge a complaint with the UK supervisory authority for data protection, the Information Commissioner's Office (ICO), if you believe we have not handled your personal data in accordance with the law:
We would, however, appreciate the chance to address your concerns first — please contact us before approaching the ICO.
10. Contact Us
If you have any questions about this Privacy Policy, please contact us via the support feature within the application or email us at: info@easytaxer.com
Data protection contact / responsible individual. The person responsible for data protection and HMRC-integration compliance at Agile Release Limited is Fatih Ucar (Director). You can reach our data protection contact at info@easytaxer.com.