Privacy Policy
Last updated: January 25, 2026
1. Who We Are
VoxaMTD is the data controller for your personal information. We are Making Tax Digital compliance software for UK sole traders and landlords.
- Contact: info@voxaautomation.com
- Address: Crossways Manor Road, Goring, RG8 9DT, United Kingdom
- Company registration: 16984959
- ICO registration: ZC113197
2. Information We Collect
We collect account information (name, email, phone, business address), financial data via Open Banking (bank transactions, account balances, account holder details), tax information (income and expense categorisation, HMRC submissions), technical data (IP address, browser type, device information, screen resolution, timezone — required by HMRC for fraud prevention) and usage data (features used, pages visited, login times).
3. Open Banking Authorization
We use Finexer (FCA FRN: 925695) to connect to your bank account with your explicit consent. When you connect your bank you authorize us to access your transaction history, account balances and account holder details. Access lasts 90 days, after which you must re-authorize. We access transaction information daily to keep your records up to date. You can disconnect your bank at any time through your account settings. We never see or store your online banking password — this remains with your bank. Finexer uses bank-grade encryption and is FCA-regulated.
4. Legal Basis for Processing
We process your data on the basis of contract necessity (managing your account, HMRC submissions), explicit consent (accessing bank data, marketing emails), and legal obligation (HMRC submissions and fraud prevention headers required by UK tax law).
5. HMRC Data Transmission
As Making Tax Digital software, we submit your tax information to HMRC on your behalf. This includes quarterly income and expense updates, annual Self Assessment data, device and connection information (fraud prevention headers) as required by UK tax law, and VAT information if applicable. You authorize these submissions when you use VoxaMTD to submit to HMRC.
6. Who We Share Your Data With
We share bank authorization details with Finexer (FCA FRN: 925695) to provide open banking access; tax data and fraud prevention headers with HMRC under legal obligation for MTD compliance; and all data with Supabase, our infrastructure provider. We do not sell your data to third parties.
7. Data Retention
Active account data is retained for the duration of your subscription. Tax records and submissions are retained for a minimum of 6 years (UK tax law requirement). Bank transaction data used for tax records is retained for 6 years. Cancelled accounts are deleted after 1 year. Database backups are retained for 2 years before permanent deletion. Fraud prevention logs are retained for 7 years (HMRC requirement). After these periods, your data is permanently deleted.
8. Your Rights Under UK GDPR
You have the right of access, rectification, erasure (subject to legal obligations like tax record retention), restriction of processing, data portability, the right to object to processing based on legitimate interests, the right to withdraw consent at any time, and the right to complain to the ICO. To exercise any of these rights, email info@voxaautomation.com — we will respond within 1 month.
9. Data Security
We protect your data with TLS 1.2+ encryption for transmission, bank-grade encryption for stored data, secure authentication with optional multi-factor authentication, regular security audits and monitoring, employee access controls, and UK/EEA cloud infrastructure storage. Finexer maintains ISO 27001 certification and FCA authorization.
10. International Transfers
Your data is primarily stored in the UK and European Economic Area. If we ever need to transfer data outside the UK, we will use UK Standard Contractual Clauses and the UK International Data Transfer Addendum to ensure equivalent protection.
12. Complaints
If you are unhappy with how we handle your data, please contact us first at info@voxaautomation.com.
You also have the right to complain to the UK data protection regulator: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Phone: 0303 123 1113. Website: ico.org.uk.
13. Changes to This Policy
We may update this privacy policy from time to time. We'll notify active users of significant changes via email to the address associated with your account. Continued use of VoxaMTD after changes take effect constitutes acceptance of the updated policy.