Privacy policy for our accounts and tax software.
This policy covers Deplexify's accounts and tax software at tools.deplexify.com, including the parts that connect to HM Revenue & Customs (HMRC) for Making Tax Digital for Income Tax. Our general privacy policy covers the rest of our website and services.
Who we are
Deplexify is run by Glenn Broome, Chartered Accountant, trading as Deplexify, Christchurch, New Zealand. Contact: hello@deplexify.com.
- When we prepare accounts or tax returns for you as our client, we are the controller of your personal data.
- When an accounting firm uses the software for its own clients, the firm is the controller and we are its processor: we act only on the firm's instructions.
What we collect
- Account details: your name and email address, and a record of when you sign in.
- Tax details of the person a return is for: name, National Insurance number, Unique Taxpayer Reference, date of birth and postcode.
- Financial records: bank statements and trial balances you upload, income and expenses, employment and pension figures, and other income and reliefs.
- Your connection to HMRC: the access tokens HMRC issues when you sign in to HMRC through the software. We never see or store your HMRC password.
- What was sent to HMRC: each submission, when it was sent, by whom, and HMRC's reply.
- Fraud prevention data: see the next section.
Fraud prevention data sent to HMRC
The law requires software that connects to HMRC's Making Tax Digital services to send fraud prevention data with every call. HMRC uses it to protect your tax affairs and public money. When you use the HMRC features, we send:
- your public IP address and port, and when that IP address was seen;
- a random identifier for your browser (a device ID, stored in your browser);
- your browser's user agent, screen size, window size and time zone;
- your user ID on our software, and details of how you signed in (the sign-in method and when);
- our server's IP address, and the name and version of our software.
We send this data to HMRC only, and do not use it for anything else. HMRC explains how it uses this data in its own privacy notice.
Why we use it, and the legal basis
- To prepare and submit accounts and tax returns you ask for: to perform our contract with you, or the accounting firm's contract with its client.
- To send fraud prevention data to HMRC, and to keep tax records: to meet a legal obligation.
- To keep the software secure and working: our legitimate interests in running a safe service.
We do not sell personal data, use it for advertising, or use it to train artificial intelligence models.
Who we share it with
- HMRC, when you choose to send something to HMRC.
- Hetzner Online GmbH (Nuremberg, Germany) hosts the software and stores its data.
- Cloudflare, Inc. carries the connection between your browser and our server and protects it from attacks.
- SparkPost sends the sign-in codes we email to you.
Cloudflare and SparkPost may process data in the United States. Where data leaves the UK, we rely on the UK's adequacy regulations or the International Data Transfer Addendum to protect it.
How long we keep it
We keep accounts and tax records for 7 years after the end of the tax year they relate to, to meet record-keeping rules. We delete HMRC access tokens when you disconnect from HMRC, or when HMRC's 18-month authority ends. When an accounting firm stops using the software, we return or delete its clients' data, as the firm instructs.
How we protect it
- Connections are encrypted in transit.
- Each account can see only its own data.
- HMRC access tokens are kept in files that only the software can read.
- Sign-in uses a code sent by email each time a new device signs in.
Your rights
Under UK data protection law you can ask to see, correct or delete your personal data, or to restrict or object to how we use it. Email hello@deplexify.com. If an accounting firm is the controller, we will pass your request to the firm. You can also complain to the Information Commissioner's Office at ico.org.uk.
Changes
We will update this page when the software changes how it uses personal data. The date at the top shows the latest version.