How MyVATBridge collects, uses, and protects personal data.

1. Scope and who we are

This Privacy Policy explains how MyVATBridge handles information when you visit the website, create an account, add VAT clients, connect to HMRC, prepare VAT returns, or contact support.

The data controller for MyVATBridge is Amelia GB Ltd, a company registered in England and Wales (company number 07124049), with its registered office at 76 High Street, Colliers Wood, London SW19 2BY. Amelia GB Ltd is registered with the Information Commissioner's Office under registration Z2371623.

2. Data we collect

3. How we use the data

• to create and secure user accounts
• to let you manage VAT clients and prepare VAT returns
• to connect to HMRC and make VAT API calls on your behalf
• to generate HMRC fraud-prevention headers required for VAT integrations
• to troubleshoot issues, maintain audit trails, and improve platform reliability
• to respond to support requests and enforce platform security

4. Sharing

We may share relevant data with HMRC when you authorise or submit VAT-related actions, with infrastructure or software providers that help us run the platform, and with professional advisers or authorities where required for security, legal, or compliance reasons. We do not describe the service as an advertising platform and we do not use account data for ad targeting. For accountant and bureau workspaces, the current list of subprocessors and our processor commitments are set out in the Data Processing Addendum.

5. Retention

We keep data for as long as needed to operate the service, maintain filing history, support users, and meet tax, accounting, legal, or security obligations. Different categories may be kept for different periods. For example, filing and audit records may be kept longer than transient technical logs.

6. Security

We use access controls, encrypted credential storage, secure cookies, server-side logging, and restricted service routing to reduce unauthorised access risk. No internet-facing system can be guaranteed 100% secure, so you should also keep your own account credentials safe and review access regularly.

7. Cookies and browser storage

MyVATBridge uses essential cookies and session storage needed for login, security, and HMRC integration flows. The service also captures browser-side information to support HMRC fraud-prevention headers where required for VAT API requests.

Our website analytics (Umami) is cookieless. If you choose Accept all in the cookie banner, we additionally set Google Ads measurement cookies (_gcl_*) so that Google can tell us whether an advert led to an account sign-up; if you choose Essential only, Google receives no cookies and only aggregated, cookieless signals. You can change your choice at any time via Cookie settings in the page footer. The lawful basis for advertising cookies is your consent (UK GDPR Art. 6(1)(a); PECR reg. 6).

8. Your rights

Depending on the applicable law and context, you may have rights to request access, correction, deletion, restriction, objection, or export of personal data. Some requests may be limited where we need to keep records for compliance, audit, or legal reasons.

If you have concerns about how personal data is handled, contact us first at [email protected]. You may also have the right to complain to the Information Commissioner's Office in the UK.

9. International transfers

Some service providers may process data outside the UK. Where that happens, we apply appropriate contractual and organisational safeguards, such as UK-approved standard contractual clauses.

10. Updates

We may update this Privacy Policy as the product matures, especially when HMRC OAuth, payments, client onboarding, or agent workflows are expanded. The latest version will be published on this page.