GDPR & UK data protection

1. Principles we follow

• Process personal data lawfully, fairly, and transparently.
• Collect data for specified, explicit, legitimate purposes and not reuse it incompatibly.
• Keep data adequate, relevant, and limited to what is necessary.
• Keep data accurate and erase or rectify when needed.
• Keep data only as long as necessary — see our Data retention policy.
• Protect data with appropriate technical and organisational measures.
• Demonstrate accountability (records, assessments, and contracts with processors).

2. Lawful bases (examples)

Depending on the activity, we may rely on contract (providing the service you requested), legal obligation (tax and accounting records), legitimate interests (security, fraud prevention, proportionate product improvement), or consent (optional marketing or non-essential cookies). Our Privacy policy maps processing activities to these bases.

3. Your rights

In the UK, individuals generally have the following rights in respect of personal data:

• Right to be informed (this page plus the privacy policy).
• Right of access (subject access request).
• Right to rectification.
• Right to erasure (“right to be forgotten”) in certain cases.
• Right to restrict processing in certain cases.
• Right to data portability for certain automated processing based on contract or consent.
• Right to object to processing based on legitimate interests or direct marketing.
• Rights related to automated decision-making and profiling where applicable.

To exercise a right, email support@selfsubmit.co.uk with the subject line “Data protection request”. We will respond within statutory timeframes (normally one month, extendable in complex cases). You can also use in-app tools under Settings to export your data or delete your account.

4. Data minimisation

We design SelfSubmit to collect only data needed for MTD record-keeping, billing, and security. We do not ask for special category data. Tax identifiers are optional until you choose to store them and are encrypted at the application layer. See our Privacy policy for details.

5. Consent and records

When you sign up, accept our cookie notice, or opt into optional communications, we record your consent with a timestamp, policy version, and technical context (such as IP address) so we can demonstrate compliance. Essential cookies for sign-in and security do not require consent under UK PECR.

6. Processors and DPAs

We use subprocessors under UK GDPR Article 28 terms. Infrastructure services (hosting, databases, file storage, optional SMS, and technical monitoring) are described by category in our Privacy policy. The table below names providers you are most likely to interact with directly. Business customers who need a signed agreement should see our Data processing agreement.

7. International transfers

Some providers may process data outside the UK. We use appropriate safeguards (for example UK International Data Transfer Agreements or adequacy regulations) and document them.

8. ICO registration

See our About us page for full company registration details.

9. Supervisory authority

You may complain to the Information Commissioner's Office (ICO): ico.org.uk. We encourage you to contact us first so we can try to resolve your concern.

10. Privacy contact

For data protection enquiries, email support@selfsubmit.co.uk. We will publish a dedicated Data Protection Officer contact if we are required to appoint one.