VATRelay

Privacy notice

WarningDraft: 2 highlighted items still to be completed by the software provider.

Last updated: 3 November 2026

1. Summary

VATRelay sends your VAT return to HMRC for you. It sends HMRC only what the law requires: your VAT figures and the fraud prevention data HMRC asks all software to send.
We never see or store your Government Gateway user ID or password, or your card details.
We do not sell your data, show advertising, or use tracking or analytics cookies.
We store your account and VAT records for you, on servers in the European Economic Area (EEA).

2. Who we are

VATRelay is provided by Fishex Limited, company number 07206584, registered office 11 Canalside Square, London N1 7FN ("we", "us"). For anything about your personal data, contact compliance@vatrelay.co.uk or write to the address above. [If you have appointed a data protection officer, give their contact details here.]

We decide how your personal data is used, so we are the controller under UK data protection law.

3. What we collect, and why

Data	Why we use it	Lawful basis
Your account: email address, a protected (hashed) version of your password, and your authenticator app set-up	To create your account and sign you in securely	Contract
Your businesses: name, VAT registration number, and the name and address HMRC holds for that number	To check the VAT number with HMRC and file returns for the right business	Contract
Your HMRC connection: the secure key (token) HMRC issues when you give VATRelay permission	To read your VAT obligations and submit returns. Stored encrypted	Contract
VAT periods that HMRC says are due	To show which returns to submit	Contract
Your VAT returns: the nine figures, the name and a digital fingerprint (SHA-256) of the file they came from, and which cells were read. We do not keep the file itself	To prepare the return and record where the figures came from	Contract; legal obligation to keep VAT records
Each submission: the figures sent, HMRC's reply and receipt, and a copy of the fraud prevention data sent	To give you a permanent record of what was filed, and prevent duplicate filing	Contract; legal obligation
Payments: the amount, status, and Stripe's references for the payment. Not your card details	To take payment only when HMRC accepts a return, and to keep accounting records	Contract; legal obligation (accounting records)
Activity log: sign-ins, failed authenticator codes, password changes, businesses added or removed, connections, imports, submissions and payments, with the time	Security, fraud prevention, and evidence if something is disputed. Your recent activity is shown on the Account activity page	Legitimate interests (keeping accounts and filings secure)
Device cookie: a random identifier stored in your browser	Required by HMRC as part of the fraud prevention data (see section 4)	Legal obligation

Cookies: VATRelay uses two cookies, both essential, so we do not ask for consent:

vatbridge_session keeps you signed in. It ends when you sign out, after a period without activity (60 minutes unless set otherwise), and always within 12 hours.
vatrelay_device is the device identifier HMRC requires. It lasts 10 years, as HMRC asks that it should not expire.

We do not use analytics, advertising or tracking cookies.

4. What we send to HMRC

VATRelay sends data only to HMRC's official services, over an encrypted connection (HTTPS).

To provide the service:

your VAT return figures and the VAT period, when you submit a return;
your VAT registration number, to get your VAT obligations and to check the number is registered (HMRC's "Check a UK VAT number" service).

Fraud prevention data (required by law). HMRC requires all Making Tax Digital software to send information about the device and connection with every request, to protect taxpayers against fraud. VATRelay collects it just before each request and sends it automatically. It will not submit a return without it.

It includes:

your public IP address, when it was collected, and your browser's network port where available;
the device identifier from the vatrelay_device cookie;
your browser's description of itself (user agent), screen size and colour depth, window size, and time zone;
your VATRelay email address, as your user identifier;
that you signed in with an authenticator app, when, and a one-way coded reference to the authenticator (never the code or its secret);
VATRelay's name, version, a coded licence reference for your account, and our server's details.

HMRC uses this data as described in HMRC's privacy notice and fraud prevention guidance.

5. Who else sees your data

We use these suppliers to run VATRelay. Each one only processes data on our instructions, under a contract that protects it.

Supplier	What they do	Where
Supabase	Hosts the database and the sign-in service; sends sign-up and password-reset emails	EU (Ireland)
Render	Runs the website	EU (Germany)
Cloudflare, through Render	Delivers the website securely to your browser	Global network, nearest location to you
Stripe	Takes card payments. Stripe receives your card details and email address directly; we never see your card number	UK, EU and USA
HMRC	Receives your returns and fraud prevention data (section 4)	UK

[If you use an email service, for example to send emails from your own domain, add it here.]

We do not sell your personal data or share it with anyone else, unless the law requires us to (for example, a lawful request from HMRC or the police).

Stripe is also a controller of the payment data it collects, under its own privacy policy (https://stripe.com/privacy), for example to prevent fraud and meet financial regulations.

6. Transfers outside the UK

Your data is stored in the EEA, which the UK recognises as protecting personal data adequately. Where a supplier processes data in another country, such as the USA, they do so under safeguards approved under UK law, for example the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework.

7. How long we keep your data

Data	How long
VAT returns, submissions, receipts and payment records	At least 6 years after the end of the VAT period, as HMRC requires for VAT records, and as needed for our accounting records
The activity log	6 years, as evidence of what was filed and by whom
Your account	Until you ask us to close it. Records we must keep (above) are kept, but your account can no longer be used
HMRC connection key	Deleted at once when you disconnect or remove a business. HMRC's permission also expires after 18 months
Businesses with no submitted returns	Deleted when you remove them
Support messages	[2 years] after your request is closed

Removing a business you have filed returns for archives it: it is hidden and disconnected, but its records are kept for the 6 years HMRC requires.

8. Your rights

You have the right to:

access the personal data we hold about you;
have it corrected if it is wrong;
have it deleted, where we do not have to keep it;
restrict or object to how we use it;
receive it in a portable format.

Much of this you can do yourself: you can see your businesses, returns and activity in VATRelay, and download a PDF of any return. For anything else, contact compliance@vatrelay.co.uk. We will reply within one month.

If you are unhappy with how we use your data, you can complain to the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/ or 0303 123 1113. We would appreciate the chance to help first.

9. Keeping your data secure

Signing in needs a password and a code from an authenticator app.
HMRC connection keys are encrypted when stored. We never see your Government Gateway details.
All connections to and from VATRelay are encrypted (HTTPS).
Each customer sees only their own businesses and records.
Submitted returns and the activity log cannot be changed or deleted.
Payments are handled by Stripe, which meets the card industry's security standard (PCI DSS). We never see card numbers.

Our security process explains how we handle security problems, including telling you and the ICO if your data is at risk.

10. Changes to this notice

We will update this notice when VATRelay or the law changes, and change the date at the top. If a change affects you significantly, we will tell you by email or in VATRelay before it takes effect.