Privacy Policy

Scope: This document applies exclusively to the TCSL VAT Submission System, including its integration with HMRC’s Making Tax Digital services. It does not govern TechCo Systems Ltd’s hosting services or other commercial activities.

TCSL Business Management System — TechCo Systems Ltd
Effective date: 10 November 2026

This policy explains how TechCo Systems Ltd handles information when using its TCSL Business Management System, including its HMRC VAT submission application. The software is currently used for TechCo's own business operations and is not offered as a public multi-customer service.

1. Who is responsible

TechCo Systems Ltd is responsible for the personal data it processes for its own business activities. Privacy enquiries and requests to exercise data protection rights may be sent by post to the company address shown below.

2. Information processed

The system processes purchase orders, invoices, VAT calculations, VAT return figures, HMRC obligation information and submission confirmations. Hosted sales invoice records generally identify customers by internal reference codes rather than personal names or contact details. Information linking those codes to customers is maintained separately on locally controlled storage, with offsite backup.

Customer reference codes may still be personal data where an individual can be identified using other information. Business records may also contain personal data incidentally, for example supplier or account information.

3. HMRC authorisation and VAT submissions

The separate local Python VAT submission application uses HMRC's OAuth authorisation mechanism to access VAT obligations and submit VAT returns when authorised. OAuth tokens are held in application memory for the session only. They are not saved in files or databases and are not retained between executions.

Following a submission, the system records relevant HMRC submission metadata, including period key, processing date, form bundle number and submission environment, for accounting, audit and reconciliation. If the hosted system cannot be reached, limited non-token handshake or recovery values may be saved locally to support reconciliation without making a duplicate submission.

4. Purposes and lawful bases

Information is processed to maintain accounting records, administer business transactions, meet VAT and other legal obligations, secure the system and reconcile HMRC submissions. Where personal data is involved, the applicable UK GDPR lawful basis will generally be compliance with a legal obligation or TechCo's legitimate interests in operating and securing its business, depending on the activity.

5. Storage and disclosure

Selected transaction records are stored on shared hosting supplied by HostGator. HostGator publishes that it operates data centres in the United States and other locations; the precise location of TechCo's hosted instance has not yet been verified. Customer identity information is maintained separately on local storage with offsite backup. Information required for VAT administration is transmitted to HMRC through its authorised API.

Where personal data is processed or transferred outside the UK, TechCo will assess the applicable UK data protection requirements and ensure any required international-transfer safeguards are in place. The use of customer reference codes reduces exposure but does not, by itself, make all information anonymous.

6. Security and retention

TechCo restricts access to its systems and separates customer identity information from hosted transaction records. OAuth tokens are not persisted. Business and VAT records are retained for the periods required by applicable tax and accounting law, or for another justified period where necessary. Temporary recovery information is retained only as needed for reconciliation and secure operation.

7. Your rights

Where UK data protection law applies, individuals may have rights to access, correct, erase or restrict the use of their personal data, object to certain processing, and complain to the Information Commissioner's Office (ico.org.uk). Some rights are limited where information must be kept to comply with legal obligations.

8. Changes

This policy may be updated as the system, hosting arrangements or legal requirements change. The effective date above identifies the current version.