This policy explains how Truetax Systems Limited ("we"), which operates FileSDLTonline, handles personal data.
Our role
For the information in SDLT returns (buyers, sellers and property details), the firm using FileSDLTonline is the data controller and we act as its data processor, under a data processing agreement. For account holders and website visitors, we are the controller.
What we collect
- Account data: name, work email, firm details, role, sign-in times and IP addresses.
- Return data: information entered by firms to prepare and file SDLT returns, including names, addresses, National Insurance numbers, dates of birth and company references.
- HMRC credentials: firms' Government Gateway details and STORN, stored encrypted and used only to file returns.
- Enquiries: what you send us through the contact and demo forms.
How we use it
- To provide the service, including submitting returns to HMRC on the firm's instruction.
- To secure accounts, prevent misuse and keep an audit trail.
- To answer enquiries and provide support.
- To meet legal obligations.
We do not sell personal data, and we do not use return data for marketing.
Lawful basis
We process account data to perform our contract and for our legitimate interests in running a secure service. Return data is processed on the firm's instructions. Retention of filing records relies on legal obligation and legitimate interests, because HMRC can open an enquiry after filing and firms have regulatory record-keeping duties.
Sharing
Return data is sent to HMRC when a firm submits a return. We use hosting, email and (if enabled) postcode lookup providers under contract. We disclose data where the law requires it.
Retention
Case data is kept for the retention period set by each firm (6–15 years after completion, 7 by default), then deleted. Account data is kept while the account is active, and for up to 7 years after it closes.
Your rights
You can ask for access to, correction of or deletion of your personal data, or object to or restrict its processing. Requests about return data are passed to the firm that controls it. Erasure may be limited where records must be kept by law. You can complain to the Information Commissioner's Office (ico.org.uk).
Contact
Use our contact form for any privacy question.