Privacy Policy
1. Introduction
This privacy policy describes the personal data we collect when you interact with our website, our online store and our software products, why we collect it, and how we store, use and protect it.
ABC Self Assessment Ltd is the data controller for the personal data described in this policy. We are a company registered in England and Wales (number 08416685) with our registered office at 30 Circus Mews, Bath BA1 2PW.
This policy covers:
- our website at www.abcsa.co.uk and our online store;
- ABC Digital Tax, our software for Making Tax Digital for Income Tax; and
- ABC SA100, our Self Assessment software.
The status of this policy. This is a privacy notice: it explains how we handle personal data, as we are required to do by the UK GDPR. It is not a contract term. Your purchase is governed by our terms and conditions of sale, and your use of our software by the End User Licence Agreement for that product, which you accept when you first run it.
If you have any questions about this policy, please contact us using the details in section 11.
2. The short version
The most important thing to know is this: your tax data stays on your own computer. Our software prepares your figures locally and sends them directly from your computer to HMRC. We never receive a copy of your tax return, your income, or your expenses, except where you choose to send it to us — in an error report, or in something you include when you contact support (see section 3.5).
What does reach us is limited to what we need to sell you a licence, operate your entitlement to submit, and help you when you contact support.
3. What personal data we collect
3.1 Online store
When you buy from our shop, our e-commerce system collects your name, address, telephone number, email address, IP address, orders and receipts, and whether you consent to receive marketing information from us. We do not store your payment card details — these are handled by our payment provider and never reach our systems.
3.2 Website
When you browse our website we receive your IP address and information about your operating system and web browser, including information from cookies set by us or our online store provider. Our cookie policy explains which cookies we use.
When you contact us through our contact form or by email, we store what you provide — your name, email address and the content of your message.
3.3 Licensing and entitlement
When you activate a licence key and submit through our software, we collect:
- the date of activation and the dates of successful submissions;
- your licence key, and the organisation account it belongs to if you have one;
- a taxpayer code — an irreversible cryptographic code derived from the reference for the tax record being submitted: a National Insurance number and tax year in ABC Digital Tax, or a Unique Taxpayer Reference in ABC SA100.
The taxpayer code needs explaining honestly. Our software creates a one-way code from the reference number, using a secret key held only by us. We never receive or store the reference number itself, and the code cannot be converted back into it. We use the code to tie a licence to one specific tax record — so that we can match paid entitlement to submissions, and so that a free first year is used only once for a given taxpayer.
The taxpayer code is what data protection law calls pseudonymised data. It is still personal data, and we treat it as such — we do not describe it as anonymous. A code is unique to one taxpayer, and we can recreate it from the reference number, so it identifies a person even though it does not name one.
3.4 Information we must send to HMRC about your device
HMRC requires software that connects to its APIs to send technical information about the device making each submission. This is a mandatory anti-fraud measure under HMRC’s terms of use for developers, and it applies to both our products. Our software cannot submit to HMRC without it.
The information sent includes:
- a device identifier generated by our software;
- your public IP address and port, and the local IP addresses of your device;
- the MAC addresses of your device’s network adapters;
- your screen size, resolution, colour depth and window size;
- your device’s timezone;
- your operating system, its version, and our software’s version;
- the user account name you are signed in as on your computer;
- a hashed form of your licence key.
This information goes from your computer to HMRC. We cannot switch it off, and neither can you — it is a condition of HMRC granting access to the APIs. HMRC is the controller for this information once it receives it, and its use is described in HMRC’s own privacy notice.
3.5 Product and support information
When you use our products we collect information about the computer and operating system you are using, so that we can provide technical support.
If you encounter a fatal error, we will ask whether you want to send us an error report. An error report describes the state of the software when the error happened, and it may include figures you have entered. Sending one is always your choice, and you can decline without affecting your ability to use the software. You may optionally include your email address so we can reply.
If you attach a file or paste figures into a support enquiry, we will hold what you send for as long as we keep the enquiry. Please send us only what we need to help you.
3.6 If your accountant or agent uses our software
If an accountant, bookkeeper, family member or other person files for you using our software, we do not receive your tax return or your figures — those go directly from their computer to HMRC.
What we do receive is the taxpayer code described in section 3.3, together with the dates on which submissions were made and the licence key used. We use this to operate licensing and entitlement and to prevent misuse of free entitlement.
We have no other relationship with you, and we hold no contact details for you unless you contact us yourself. Our lawful basis is our legitimate interest in operating our licensing system fairly and preventing abuse of it. Your agent is required by our licence terms to have told you that they use our software and that this transfer happens.
You have the same rights over this record as over any other personal data we hold — see section 8. The code itself would tell you nothing useful; what a request would normally be about is the record — whether we hold one for you, what it says, and whether we will delete it.
To find it, we have to recreate the code, which means you telling us the reference number it was made from. We use that only to run the check, and do not store it. Without it we have no way to connect any record to you, and we are not required to go looking for other ways to identify you.
We will not normally delete a record of entitlement that has been used, because keeping it is the only way the free first year can be limited to one per taxpayer. If we refuse a deletion request on that basis we will tell you why, and you can complain to the ICO if you disagree.
4. How we use your personal data and our lawful bases
We process personal data under the UK GDPR and the Data Protection Act 2018. The table below sets out what we do and why.
| What we do | Data used | Lawful basis |
|---|---|---|
| Fulfil your order, take payment, issue receipts | Order and contact details | Performance of a contract with you |
| Issue, activate and validate licence keys and credits | Licensing and entitlement data (section 3.3) | Performance of a contract with you |
| Check and enforce free-year entitlement across the service | Taxpayer code (section 3.3) | Our legitimate interest in operating our licensing fairly and preventing abuse |
| Send required anti-fraud information to HMRC with your submissions | Device and network information (section 3.4) | Performance of a contract with you — we cannot submit without it — and our legitimate interest in complying with HMRC’s conditions of access |
| Answer your enquiries and provide support | Contact details, message content, technical information, error reports | Performance of a contract with you, or our legitimate interest in supporting our customers |
| Fix faults and improve our products | Technical information and error reports | Our legitimate interest in maintaining and improving our software |
| Send you marketing about our products | Email address and consent record | Your consent |
| Display feedback or testimonials you have given | What you provided | Your consent |
| Keep accounting and VAT records, and respond to legal claims | Order records | Compliance with a legal obligation, and our legitimate interest in establishing or defending legal claims |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your interests and rights. You can ask us about that assessment, and you can object — see section 8.
We do not use your personal data for any automated decision-making that produces legal or similarly significant effects, and we do not carry out profiling.
Providing the data described in sections 3.1 and 3.3 is necessary in order for us to supply the software to you. If you do not provide it, we cannot sell you a licence or enable submissions.
5. Who we share your personal data with
We do not sell your personal data, and we do not share it with other organisations for their own commercial purposes.
We use the following service providers, who process personal data on our behalf under contract:
| Provider | What they do | Where |
|---|---|---|
| Shopify | Runs our online store and processes purchases | Canada, USA and other locations — see the Shopify Privacy Policy and Data Processing Addendum |
| Cloudflare | Runs our licensing and entitlement service | UK/EU, with global infrastructure |
| Amazon Web Services | Stores data, in the London region | UK |
| Freshdesk (Freshworks) | Runs our customer support system | EU/USA — see the Freshworks Privacy Notice |
| Scaleway (https://www.scaleway.com/en/transactional-email-tem/) | Sends transactional emails e.g. for registration | EU |
We share information with HMRC as described in sections 3.4 and 6. HMRC is a separate data controller for everything it receives.
We will otherwise share personal data only where we are legally required to do so.
6. Your tax data and HMRC
Our software is a desktop application. Your tax records are created and stored on your own computer, in files you control.
When you submit, the software sends your figures directly from your computer to HMRC over HMRC’s Making Tax Digital APIs. They do not pass through our servers, and we do not keep a copy.
To submit, you authorise our software through HMRC’s own sign-in process. HMRC then issues our software an access token and a refresh token, which are stored on your computer, not on our servers. These let the software submit on your behalf without you signing in each time. You can withdraw that authority at any time through your HMRC online account, under “Manage who can access your information”. Doing so does not delete anything we hold under section 3.3.
Tax calculations are produced by HMRC and displayed by our software. We do not generate or verify them.
Your relationship with HMRC is governed by HMRC’s own terms and its privacy notice, which we do not control.
7. How long we keep your personal data
We keep personal data only as long as we need it, then delete it securely or anonymise it.
| Data | Retention |
|---|---|
| Order and purchase records | 6 years from the end of the accounting period, to meet accounting and VAT record-keeping requirements |
| Licensing and entitlement records, including the taxpayer code, activation and submission dates | 7 years from the end of the tax year to which they relate, to cover HMRC record-keeping expectations and enquiry windows |
| Support enquiries and correspondence | 5 years from the last contact |
| Error reports | 12 months from receipt |
| Marketing consent records | For as long as you remain subscribed, plus 2 years to evidence the consent |
8. Your rights
Under the UK GDPR you have the right to:
- be informed about how we use your personal data — that is what this policy is for;
- request a copy of the personal data we hold about you;
- have it corrected if it is inaccurate or incomplete;
- have it erased, where we have no continuing lawful reason to keep it;
- restrict our processing of it in certain circumstances;
- object to processing we carry out on the basis of legitimate interests, and to object at any time to direct marketing;
- portability — receive data you provided to us in a machine-readable format, or have it sent to another provider, where processing is based on consent or contract and carried out by automated means; and
- withdraw consent at any time, where we rely on it. Withdrawing consent does not affect processing carried out before you withdrew it.
To exercise any of these rights, contact us using the details in section 11. We will respond within one month. We may ask you for information to confirm your identity. If your request concerns the taxpayer code described in section 3.3 — which is the only thing we hold about most people whose agent files for them — section 3.6 explains what we need in order to find the record.
Complaints. If you are unhappy with how we have handled your personal data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Opting out of marketing. Click the opt-out link in any marketing email we send you, or contact us.
9. Where your personal data is stored and transferred
We store data in the UK and the EEA wherever we can. Some of our service providers process data outside the UK, including in the USA and Canada.
Where personal data leaves the UK, we rely on one of the following safeguards, as required by the UK GDPR:
- UK adequacy regulations, where the Secretary of State has determined that a country provides an adequate level of protection — this covers Canada (for commercial organisations) and the EEA;
- the UK Extension to the EU–US Data Privacy Framework, where the US recipient is certified under it; or
- the International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses, together with a transfer risk assessment.
You can ask us for a copy of the safeguards that apply to a particular transfer by contacting us.
10. How we keep your personal data secure
We take appropriate technical and organisational measures to protect personal data in storage and in transmission.
- Data sent between our website, our software and our servers is encrypted using TLS 1.2 or above.
- Data at rest is held in encrypted databases with access restricted to those who need it.
- National Insurance numbers are never transmitted to or stored by us — only the irreversible code described in section 3.3.
- We keep our software and infrastructure patched and review our security arrangements periodically.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will tell you directly where the breach is likely to result in a high risk to you.
No system is perfectly secure, and we cannot guarantee the security of data you send us over the internet.
11. Contact us
To access, correct or delete your personal data, to exercise any other right, to register a complaint, or simply to ask a question:
Email: privacy@abcsa.co.uk Contact form: the ‘Contact us’ form on this website Post: ABC Self Assessment Ltd, 30 Circus Mews, Bath BA1 2PW, United Kingdom
We have not appointed a data protection officer, as we are not required to. Enquiries are handled by Kevin Wise.
12. Changes to this policy
We review this policy at least annually and whenever our processing changes. The version number and date at the top show when it was last updated. Where a change materially affects how we use your personal data, we will tell you.
ABC Self Assessment Ltd is a registered company in England and Wales (No 08416685), VAT registration number 232940029, with registered office at 30 Circus Mews, Bath BA1 2PW.
Version 2 — last updated 28 August 2026