Privacy Policy

This Privacy Policy explains how PennyPort Limited (“we”, “us”, “our”), the provider of PennyPort, collects, uses and protects your personal data when you use the PennyPort service. We are the data controller for the personal data described below and are based in Taunton, United Kingdom. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What data we collect

• Account details — your name, email address and login credentials (authentication is handled by our identity provider).
• Tax and financial records — information you provide or import to prepare and file your Self Assessment, including National Insurance number, Unique Taxpayer Reference (UTR), business details, income, expenses, invoices and transactions.
• HMRC connection — authorisation tokens that let us file on your behalf with HMRC. These tokens are encrypted at rest.
• Technical and fraud-prevention data — device, browser and connection information that HMRC requires us to send with submissions under their Fraud Prevention Headers specification.

How we use your data

• To provide bookkeeping features and calculate your tax position.
• To submit Making Tax Digital for Income Tax Self Assessment (MTD ITSA) updates and declarations to HMRC on your instruction.
• To meet HMRC’s anti-fraud requirements for software that files tax returns.
• To secure, maintain and improve the service.

Cookies and analytics

PennyPort uses essential cookies that are needed to sign you in and keep the service secure — these are always on because the app can’t work without them.

On our public website we’d also like to use Google Analytics to see which pages people find helpful, so we can keep improving. These analytics cookies only load after you agree via the cookie banner — nothing is set if you decline, and you can change your mind any time by clearing your browser’s site data. Google Analytics records things like the pages you view, your approximate location and your device or browser type; we don’t use it to identify you personally and we don’t sell this data. You can also opt out across all sites with Google’s browser add-on at tools.google.com/dlpage/gaoptout.

Legal bases

We process your data to perform our contract with you (providing the service), to comply with legal obligations (including HMRC’s requirements), and where necessary for our legitimate interests in running and securing PennyPort.

Sharing your data

We share data with HMRC when you file, with our identity, hosting and payment processors who act on our behalf under appropriate safeguards, and where we are legally required to do so. We do not sell your personal data.

How long we keep it

We keep your records for as long as your account is active and for as long afterwards as needed to meet tax and legal obligations (HMRC generally requires Self Assessment records to be kept for at least the current and previous tax years, and longer in some cases). You can ask us to delete your account at any time.

Your rights

Under UK GDPR you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected and, where applicable, data erased;
• data portability — you can download a complete copy of your data at any time from Settings & privacy in the app;
• delete your account and all associated data from Settings & privacy;
• object to or restrict certain processing, and to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Security

We protect your data with encryption in transit and at rest, access controls and secure infrastructure. OAuth tokens used to connect to HMRC and accounting providers are encrypted at rest. To report a security issue, email security@pennyport.co.uk.

Contact us

For any privacy or data-protection question, contact us at privacy@pennyport.co.uk or write to PennyPort Limited, St Johns House, Castle Street, Taunton, United Kingdom, TA1 4AY.

PennyPort Limited is a company registered in England and Wales (company number 17311387). Registered office: St Johns House, Castle Street, Taunton, United Kingdom, TA1 4AY.