Data Processing & GDPR

Introduction

This Data Processing & GDPR Notice explains how Submitandgo Ltd processes personal data when providing the https://www.submitandgo.com website, the Submit&GO platform at app.submitandgo.com and related services.

It should be read together with our:

• Privacy Policy, Cookie Policy and Terms & Conditions.

We are committed to protecting personal data and processing it fairly, lawfully and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.

Our Role

Depending on the service provided, Submitandgo Ltd may act as either a Data Controller or a Data Processor.

• Data Controller – where we determine the purposes and means of processing your personal information.
• Data Processor – where we process personal data solely on behalf of our customers, accountants or authorised organisations in accordance with their instructions.

Categories of Personal Data

Depending on the services you use, we may process:

• Name and contact details.
• Business and company information.
• Taxpayer and client information.
• HMRC-related information where authorised.
• Identity verification information where required.
• Authentication and security information.
• Device and browser identifiers used for fraud prevention.
• Support requests and communications.
• Bank transaction data, where you connect a bank account through Open Banking.
• Financial records such as invoices, expenses and accounting entries.

Purpose of Processing

Personal data may be processed in order to:

• Provide and operate the https://www.submitandgo.com website.
• Provide the Submit&GO platform at app.submitandgo.com, including bookkeeping, invoicing and bank feed features.
• Create and manage user accounts.
• Support HMRC digital services and authorised submissions.
• Facilitate secure integrations with third-party providers.
• Provide customer support.
• Maintain platform security and prevent fraud.
• Comply with legal and regulatory obligations.
• Improve the reliability and security of our services.

Third-Party Service Providers

Where necessary, personal data may be processed by carefully selected third-party service providers acting on our behalf. These may include:

• Cloud hosting providers.
• HMRC services and authorised HMRC APIs.
• Open Banking providers.
• Identity verification providers.
• Email and communication providers.
• Payment providers.
• Professional advisers where legally required.

All third-party providers are expected to process personal data securely and in accordance with applicable data protection legislation.

International Transfers

Where personal data is transferred outside the United Kingdom, appropriate safeguards will be implemented to ensure an adequate level of protection in accordance with UK GDPR requirements.

These safeguards include a UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU-US Data Privacy Framework.

Data Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, disclosure, alteration or destruction.

Security measures may include encryption, secure authentication, access controls, monitoring, logging and other industry-standard security practices.

Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes and enforce our agreements.

In general, we keep account data for as long as your account is active and for up to six years afterwards, as described in our Privacy Policy.

Processor Terms

Where we process personal data as a processor on behalf of a customer (such as an accountant, bookkeeper or tax agent), these Processor Terms form part of our Terms of Supply of Services and meet the requirements of Article 28 UK GDPR. We will:

• (a) process the personal data only on the customer's documented instructions, including as set out in these Terms, unless required by law, and tell the customer if we believe an instruction infringes data protection law;
• (b) ensure that persons authorised to process the data are bound by confidentiality;
• (c) implement appropriate technical and organisational security measures, as required by Article 32 UK GDPR;
• (d) use sub-processors only under a written contract with equivalent data protection obligations. The customer gives general authorisation for our current sub-processors (cloud hosting, email delivery, business email, website security and Open Banking providers), and we will notify customers of any intended changes, giving them the opportunity to object;
• (e) assist the customer, taking into account the nature of the processing, in responding to requests from data subjects exercising their rights;
• (f) assist the customer in meeting its obligations relating to security, personal data breach notification, data protection impact assessments and prior consultation with the ICO;
• (g) notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data;
• (h) at the end of the services, delete or return the personal data at the customer's choice, unless retention is required by law; and
• (i) make available the information reasonably necessary to demonstrate compliance with these obligations and allow for and contribute to audits, including inspections, on reasonable notice.

The subject matter, nature and purpose of the processing is the provision of the Submit&GO services. It concerns the customer's clients and their personnel, and the categories of personal data listed above, for the duration of the Contract.

Your Rights

Subject to applicable law, you may have the right to:

• Access your personal data.
• Request correction of inaccurate information.
• Request erasure where applicable.
• Restrict or object to certain processing activities.
• Request data portability.
• Withdraw consent where processing relies on consent.
• Lodge a complaint with the Information Commissioner's Office (ICO).

Contact Us

If you have any questions regarding this Data Processing & GDPR Notice or wish to exercise your data protection rights, please contact us at support@submitandgo.com. Our Data Protection Officer is Mr Attila Cseko.

Submitandgo Ltd is registered in England and Wales under company number 10096069, with its registered office at 171 Kingston Road, Teddington, TW11 9JP.