1) Who we are

SmartC Digital LTD

Company number: 16595390

Registered office: Flat 1 Caine House, 6 Greycaine Road, Watford, England, WD24 7GP

Email: support@smartc.co.uk

We are registered in the UK and comply with the UK GDPR and the Data Protection Act 2018.

2) Data we collect

We do not intentionally collect special-category data unless you provide it within documents.

3) Sources of data

You (or your firm) provide most information directly. We also receive data from HMRC APIs (with your permission), payment providers (e.g., Stripe), email/analytics tools, and document parsing services used to extract invoice data.

4) How we use personal data

We never sell your personal data.

5) Legal bases (UK GDPR)

• Contract: to create your account, process filings, and provide support.
• Legal obligation: to comply with HMRC and other regulatory requirements.
• Legitimate interests: product security, fraud prevention, analytics and improvement (balanced with your rights).
• Consent: HMRC authorisations, certain cookies, marketing, and optional features.

6) Sharing & recipients

We share data with service providers under contract (e.g., hosting, email, analytics, payments, AI extraction), and with HMRC when you fetch obligations/liabilities or submit returns. We may engage vetted IT subcontractors under NDA and GDPR-compliant terms. We may disclose data if required by law, to regulators, or to protect rights, users, or the service. Firms may grant accountants access to specific client records. See our sub-processors list.

7) International transfers

Data is stored on secure UK/EU servers. Where data leaves the UK/EEA, we use appropriate safeguards (e.g., UK Addendum to SCCs, adequacy decisions, or other lawful mechanisms). Details available on request.

8) Retention

• Client tax/accounting data: 6 years (as required by HMRC), unless a longer period is required by law.
• Account details: retained until you close your account (or as needed to resolve disputes/comply with law).
• Payment data: retained according to Stripe’s policies; we keep only necessary tokens/records.

You can request deletion where applicable (see Your rights).

9) Security

• Encryption in transit and at rest; secure UK/EU hosting.
• Passwords encrypted (hashed + salted); tokens stored securely and refreshed automatically.
• Role-based access, least privilege, 2FA support.
• Per-submission audit trails and activity logs.
• Backups and disaster recovery procedures.
• Access limited to authorised personnel.

No system is 100% secure; we work continuously to protect your data.

10) Your rights

Under UK GDPR you may have rights to access, rectify, erase, restrict or object to processing, and data portability. Where processing relies on consent, you can withdraw it at any time. We will respond within applicable timeframes.

11) Cookies

We use essential cookies for authentication/session and optional analytics cookies (with consent) to improve user experience. You can manage cookies in your browser settings. For details and controls, see our Cookies page.

12) HMRC data & authorisations

When you connect an HMRC account, we process OAuth2 tokens and tax data to fetch obligations/liabilities and submit returns on your instructions. Tokens are stored securely and refreshed automatically. You can revoke HMRC access from your account or via HMRC. We log submissions and responses for compliance and support.

13) Contact & complaints

Contact: support@smartc.co.uk. You can also write to our registered address (see above). If you are not satisfied, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

14) Changes to this policy

We may update this notice to reflect changes in law or our practices. We will post the new version here and update the effective date.

Effective date: 4 September 2025.