← Back to SmartScanit MTD

Privacy & what we send to HMRC

DRAFT — still needed before go-live: registered company name/number and address, ICO registration (if applicable), token/record retention decisions, and the full processor list. Last updated 20 July 2026.

Who we are

SmartScanit MTD is operated by SmartScanit Group ("we", "us"), [registered company name and number], [registered address]. We are the data controller for the personal data described on this page. Contact: automation@smartscanitgroup.co.uk. [If a Data Protection Officer or ICO registration number applies, state it here.]

What data we process, and why

• Identity and tax data — your name, National Insurance number, Unique Taxpayer Reference, business details, and the income and expense figures you provide. Purpose: preparing and letting you submit your own MTD quarterly updates, tax calculations and final declaration. Lawful basis: performance of a contract with you, and your legal obligations to HMRC.
• HMRC connection tokens — when you connect with your Government Gateway login, HMRC gives this software a temporary access token (valid about 4 hours) and a refresh token. We never see or store your Government Gateway password. Lawful basis: performance of a contract.
• Fraud prevention header data (legal requirement) — see the next section. Lawful basis: legal obligation (HMRC transaction-monitoring regulations).
• Support records — emails or messages you send us when you ask for help. Lawful basis: legitimate interests (running a support service).

What this software sends to HMRC

Every time you use a step on this site, the software sends to HMRC:

• The figures you have reviewed — turnover, expenses and adjustments for your quarterly updates; and your confirmation when you submit your final declaration.
• Fraud prevention headers — technical information that all Making Tax Digital software is legally required to attach to every request under HMRC's transaction-monitoring rules. This includes things like: your device's public IP address, browser and screen details, time zone, a device identifier stored in your browser, and your username on this portal. HMRC uses this to protect taxpayers against fraud and account takeover. We cannot switch this off — software that does not send these headers is not permitted to connect to HMRC.

You can read HMRC's own explanation of these rules on the HMRC Developer Hub ("fraud prevention" guidance) and HMRC's privacy notice on GOV.UK.

Where your data lives

• The website and its functions are hosted on Netlify. Connection tokens pass through these functions to HMRC.
• [If Airtable token/record storage is enabled in production: name it, the region, and the retention rule.]
• [List any other processors — e.g. email provider — with locations and safeguards for any transfers outside the UK.]

How long we keep it

• Access tokens expire after about 4 hours; refresh tokens are kept [for the tax year / until you disconnect] so you don't have to reconnect every visit.
• Submission records and figures: [retention period — HMRC record-keeping rules require you to keep your own business records for at least 5 years after the 31 January deadline].
• Support correspondence: [retention period].

Your rights

Under UK GDPR you can ask us for a copy of your data, ask us to correct it, ask us to delete what we hold (note: we cannot delete what has already been legally submitted to HMRC), object to or restrict processing, and take your data elsewhere. To use any of these rights, email automation@smartscanitgroup.co.uk. You can also disconnect this software from your HMRC account at any time via your Government Gateway "manage authorised software" settings. If you're unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk).

This page is part of SmartScanit MTD's compliance with the HMRC Developer Hub Terms of Use: transparency about what the software sends, user access to data, and a named support contact. See also Support.