Compliance Engine Privacy Policy

This policy covers the GoLegally Compliance Engine: the software that prepares and files UK tax returns and Companies House filings from a business's books. It is run by Vadavision Private Limited, trading as GoLegally ("we", "us"). For the rest of the GoLegally website, see our general privacy policy.

1. What the Compliance Engine does

Prepares VAT returns and Income Tax updates under Making Tax Digital
Prepares Corporation Tax returns
Prepares Companies House filings, such as accounts and confirmation statements
Works from the business's books, kept in GoLegally's books product or imported from a file or another bookkeeping app
Sends a return to HMRC or Companies House only after you have checked and approved it

It is used by small businesses filing for themselves and by accountancy firms filing for their clients.

2. Who is responsible for your data

When a business files for itself, Vadavision Private Limited is the data controller.

When an accountancy firm files for a client, the firm is the controller of its clients' data and we process that data for the firm, on its instructions. Clients of a firm should contact the firm first about their data.

3. What we collect

Your account

Name, email address and phone number
The businesses you manage and your role in each

Tax and company details

Business name, address, VAT number, Unique Taxpayer Reference and company number
National Insurance number, where needed for Income Tax
Books: sales, purchases, expenses, bank transactions and ledger balances
Returns we prepare, what you approved, and HMRC's and Companies House's replies
Officer and shareholder details needed for Companies House filings

HMRC sign-in

The access token HMRC gives us when you sign in to HMRC and allow the Compliance Engine to act for you. We never see or store your HMRC password.

Fraud prevention data

HMRC requires every call to its Making Tax Digital services to carry fraud prevention data. We collect and send:

Your IP address and the port and time of the connection
Device and browser details: browser, operating system, screen size and time zone
A device identifier we create for your browser
Your user ID in the Compliance Engine and whether you used two-step sign-in
The version of our software and the address of our servers

We use this data only to send it to HMRC and to keep a record of what was sent.

4. Why we use it and our legal basis

Under UK data protection law we rely on these legal bases:

Contract: to prepare returns from your books, show them to you, and file the ones you approve.
Legal obligation: to send HMRC the fraud prevention data it requires, and to keep records the law asks us to keep.
Legitimate interests: to keep the service secure, stop misuse, and fix faults. We do not use your tax data for advertising.

5. Who we share it with

HMRC: the returns and updates you approve, and the fraud prevention data with each call.
Companies House: the filings you approve.
Your accountancy firm: if a firm files for you, it sees your books and returns.
Service providers: companies that run hosting, data storage, email delivery and error monitoring for us, under contract and only on our instructions.
When the law requires it: for example, a court order.

We do not sell your data.

6. Your HMRC authorisation

You give the Compliance Engine access to HMRC by signing in on HMRC's own page and choosing to allow it. HMRC's grant lasts up to 18 months. After that, we ask you to sign in to HMRC again before we can file.

You can remove access at any time, either in the Compliance Engine or in your HMRC account. When access ends, we delete the access token. We keep the returns already filed, as described below.

7. How long we keep it

Returns, books and filing records: while your account is open, and then for six years, the period UK law asks businesses to keep tax records.
Fraud prevention data sent to HMRC: for the same six years, as a record of each submission.
HMRC access token: until it expires or you remove access.
Account details: until you close your account, plus any time needed to settle a dispute.

8. Where it is stored and how we protect it

We are based in India and our servers may be outside the UK. When UK personal data leaves the UK, we protect it with the safeguards UK law requires, such as the UK International Data Transfer Agreement.

Data is encrypted when sent and when stored; HMRC access tokens are stored encrypted
Each business's data is kept apart from every other business's
Staff access is limited to what their work needs and is logged

9. Your rights

Under UK data protection law you can ask us to:

Give you a copy of your data
Correct data that is wrong
Delete your data, unless the law requires us to keep it
Limit how we use it, or object to our use of it
Send your data to you or another provider in a common format

Email dpo@golegally.com. We reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

10. Changes to this policy

If we change how the Compliance Engine uses your data, we will update this page and email you before the change takes effect.

11. Contact us

Data protection officer: dpo@golegally.com
Address: Vadavision Private Limited, Plot No 337, Phase 2, Industrial Area, Chandigarh 160002, India