Privacy policy

QuickTaxFiler Limited (“QuickTaxFiler”, “we”, “us”, “our”) is a company registered in England and Wales, company number 11471794, with its registered office at 124 City Road, London, EC1V 2NX. We are registered with the Information Commissioner’s Office (ICO), registration reference ZA813484, as a data controller under UK data protection law (the UK GDPR and the Data Protection Act 2018).

This policy explains what personal data we collect through the QuickTaxFiler Self Assessment software, why we collect it, how long we keep it, who we share it with, and the rights you have over it.

We collect the following categories of personal data:

• Account details: name, email address, mobile number, and a scrypt-hashed password. We do not store the password in recoverable form.
• Tax return data: the figures and answers you enter to prepare a Self Assessment return, including income, expenses, reliefs, Unique Taxpayer Reference (UTR) and National Insurance number. This is stored in our UK/EEA Postgres database, encrypted at rest by the application.
• Government Gateway user ID: collected at the moment you submit a return so we can authenticate that submission. We store the user ID with the return. We do not store the Government Gateway password.
• HMRC VAT connection: OAuth access and refresh tokens if you connect Making Tax Digital VAT. Tokens are encrypted at rest and can be revoked from your account.
• Billing information: processed by Stripe. We retain a record of the package purchased, amount and Stripe session reference, not full card details.
• Usage and device data: session activity, browser type, a persistent device identifier required for HMRC fraud-prevention headers, and IP address, used for security and HMRC API requirements.
• Support correspondence: anything you send us by email or in-app chat.

• To create and administer your account and save your progress between sessions.
• To calculate your Income Tax, National Insurance and any reliefs due, and to prepare your SA100 and supplementary pages.
• To transmit VAT returns to HMRC Making Tax Digital, and to record a Self Assessment submission in the software after Government Gateway checks.
• To provide an Assisted-package tax adviser review where you have requested one.
• To process payment for optional filing credits and send receipts.
• To respond to support requests and communicate service or security updates.
• To detect, investigate and prevent fraud, misuse and security incidents, including sending HMRC fraud-prevention headers with VAT API calls.
• To meet our own legal and regulatory obligations, including HMRC recognition and audit requirements.

• Contract: processing needed to provide the account and filing service you sign up for.
• Legal obligation: record-keeping required by tax and company law.
• Legitimate interests: keeping the service secure, preventing fraud, and improving the product, balanced against your right to privacy.
• Consent: where we ask separately, for example for marketing email. You can opt out in Account.

Your Government Gateway password is used only in memory to authenticate the specific submission you authorise, at the moment you click submit. It is not written to the database, logs or backups. The Government Gateway user ID may be stored with the return so you can see which ID was used. We do not sell or share these credentials with anyone other than HMRC as part of that submission.

We share personal data only where necessary, and always under a written agreement:

• HMRC — to submit VAT via Making Tax Digital, and to authenticate Self Assessment with the credentials you provide.
• Stripe — to take payment for optional filing credits.
• Cloud hosting and infrastructure providers — to store and run the service securely.
• Qualified tax advisers engaged by QuickTaxFiler — only where you request an Assisted-package review, and only the return data needed for that review.
• Regulators, law enforcement or professional advisers where we are required to by law, or to establish, exercise or defend legal claims.

We do not sell personal data. We do not run third-party advertising on the service.

We retain account and return data for as long as your account is active, and for six years after the end of the tax year to which a submitted return relates, in line with HMRC record-keeping requirements. You can download a portable copy from Account, or ask us to delete your account and personal data at any time, subject to these retention obligations. Payment records are kept for as long as required by accounting and tax law.

Under UK data protection law you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete your data, where we are not required to keep it.
• Ask us to restrict or object to certain processing.
• Receive your data in a portable format (JSON download from Account, or by email).
• Withdraw consent at any time, where processing is based on consent.
• Complain to the Information Commissioner’s Office (ico.org.uk) if you believe your data has been mishandled.

Signed-in customers can download a copy or close the account from Account. You can also email connect@tekreign.com. We aim to respond within one month.

Traffic between your browser and QuickTaxFiler is encrypted in transit (HTTPS / TLS). Passwords are hashed and salted with scrypt. Tax-return JSON, VAT figures, chat messages and HMRC OAuth tokens are encrypted in the database with an application key. Hosting disks should also be encrypted at rest by the infrastructure provider. Staff access to production data is limited to need-to-know. No online service can guarantee absolute security.

Report a suspected security incident to connect@tekreign.com. If a personal-data breach is likely to result in a risk to individuals we will notify the ICO without undue delay and, where required, the people affected. Where the incident involves HMRC APIs or credentials we will also notify HMRC as required by the Developer Hub terms.

We do not use advertising or analytics cookies. The signed-in session is a token stored in your browser’s local storage (not a tracking cookie). We also store a random device identifier in local storage so HMRC fraud-prevention headers can identify the originating device. Both stay on your device until you sign out or clear site data.

Personal data is hosted within the UK or European Economic Area. Where a service provider is located outside the UK, we put appropriate safeguards in place, such as the UK International Data Transfer Addendum, before any transfer takes place.

We may update this policy as the service changes or to reflect new legal requirements. Material changes will be signposted in-app or by email. The date at the top of this page shows when it was last revised.

Questions about this policy or your personal data can be sent to connect@tekreign.com, or by post to QuickTaxFiler Limited, 124 City Road, London, EC1V 2NX.