How MyVATBridge processes personal data for practices.
Last updated: 14 August 2026 · Forms part of the Terms of Service
1. Roles
Where an accountant, bookkeeper, or bureau workspace stores its clients' personal data in MyVATBridge (client names, VAT registration numbers, contact details, VAT return figures), that practice is the controller of the data and Amelia GB Ltd (company number 07124049, registered office 76 High Street, Colliers Wood, London SW19 2BY, ICO registration Z2371623) acts as its processor. For data about the account holder themselves, Amelia GB Ltd is the controller as described in the Privacy Policy.
2. Scope and purpose of processing
We process client data only to provide the service: storing VAT client records, connecting to HMRC on the practice's instruction, retrieving obligations and financial data, preparing and submitting VAT returns, and keeping the audit trail. Processing lasts for the life of the workspace plus the retention periods described in the Privacy Policy. We do not use client data for advertising or sell it to anyone.
3. Security measures
- All traffic is encrypted in transit (TLS); the application is only reachable over HTTPS.
- HMRC OAuth tokens are encrypted at rest; secrets are held in server-side configuration, never in code.
- Access to production systems is limited to named individuals using SSH keys; password login is disabled.
- Nightly encrypted off-server backups with 30-day retention; independent uptime monitoring.
- Every filing and HMRC call is written to an audit log.
4. Subprocessors
We use the following subprocessors to run MyVATBridge. Each is bound by a data processing agreement with safeguards appropriate to the transfer (UK GDPR; IDTA or standard contractual clauses where data leaves the UK).
| Subprocessor | Purpose | Location |
|---|---|---|
| DigitalOcean, LLC | Cloud hosting of the application and database | London, United Kingdom |
| Cloudflare, Inc. | DNS, content delivery, TLS, and security filtering | Global edge network (UK/EU points of presence) |
| Stripe Payments Europe, Ltd | Subscription billing and invoicing (billing data only - never VAT return data) | EU / United States |
| Microsoft Ireland Operations Ltd | Transactional email (login codes) and the support mailbox (Microsoft 365) | EU / United Kingdom datacenters |
HMRC is not a subprocessor: when you submit a return or authorise a connection, data is disclosed to HMRC as an independent controller, on your instruction.
We will update this page before adding or replacing a subprocessor and, for material changes, notify accountant and bureau workspaces by email so you can object before the change takes effect.
5. Confidentiality and personnel
Access to client data is limited to personnel who need it to operate or support the service, and everyone with access is bound by confidentiality obligations.
6. Assistance, deletion, and return
We assist the practice with data subject requests and regulator enquiries that concern data held in the service. On termination of a workspace we delete or return client data, subject to the audit and legal retention described in the Privacy Policy. You can export your VAT records at any time from the app or by asking support.
7. Breach notification
If we become aware of a personal data breach affecting a practice's client data, we will notify the affected workspace without undue delay with the information needed for the practice to meet its own obligations.
8. Contact
Questions about this addendum or requests for a countersigned copy can be sent to [email protected].