1. Who we are
Quartax ("we", "us") is responsible for protecting your personal data. We process your data in accordance with the UK General Data Protection Regulation (UK GDPR).
2. What personal data we process and why
- Account data: Email, name (optional), password hash - to create and secure your account.
- HMRC connection: OAuth tokens (encrypted), NINO, UTR - to submit your quarterly updates to HMRC on your behalf. We do not store your HMRC sign-in credentials.
- Transaction data: Bank transaction descriptions, amounts, categories - to prepare your MTD returns. To suggest a category for each transaction, we send its description, amount and business type (landlord or sole trader) to our AI providers, OpenAI and TypeSafe AI, which process it in the United States. Before sending, we remove account numbers, sort codes, card numbers, IBANs, postcodes, street addresses, email addresses and phone numbers, and people's names where we can detect them; for money coming in, we keep only standard banking and platform words. Descriptions keep merchant names and can occasionally still contain a name we don't recognise. We never send your account details, email address, NINO, UTR or HMRC details. Both providers act as our data processors under data processing agreements that include the UK's approved international data transfer terms, and neither uses this data to train its models.
- Submissions: Period dates, income and expense totals - to file returns and show your history.
- Payment data: Stripe customer ID - to manage your subscription. Payment details are held by Stripe, not by us.
3. Lawful basis
We process your data on the basis of contract (to provide the service you signed up for) and legal obligation (where we must retain data for tax or regulatory purposes).
4. Your rights
You can request to access, correct, export, or delete your data at any time. Use the Export and Delete account options in Settings, or contact us at team@quartax.co.uk.
5. Security and encryption
We encrypt access tokens and personally identifiable data when stored. Data in transit is protected by TLS (HTTPS). Each customer's data is isolated and cannot be accessed by other users.
6. Security incidents and breach notification
If you become aware of a security risk or incident, please contact us immediately at team@quartax.co.uk. We will investigate and, where required, notify HMRC (SDSTeam@hmrc.gov.uk) and the ICO within 72 hours of becoming aware of a personal data breach.
7. Data retention
We retain your data for as long as your account is active and as required for legal or tax purposes. When you delete your account, we remove your data within 30 days, except where we must retain it for legal obligations.