Privacy Policy

1. Who we are

VATTY is operated by:

Vatty Ltd Company number: 17088818 Registered office: 37 Limes Road, Beckenham, BR3 6NS, United Kingdom Email: info@vatty.co.uk In this Privacy Policy:

"VATTY", "we", "us" or "our" means Vatty Ltd.

"Customer", "you" or "your" means the accounting firm, business, organisation or individual using VATTY.

"User" means any person authorised to use VATTY under a customer account.

"Firm" means an accounting firm, bookkeeping firm, tax adviser, professional services business or other organisation using VATTY.

"Client Company" means a VAT-registered or other business entity managed within VATTY.

"Client" means a client or customer whose VAT documents or evidence are managed through VATTY.

"Supplier" means a third party asked to provide invoice, VAT or other supporting evidence.

"VAT Documents" means receipts, invoices, tax invoices, credit notes, refund documents, supplier evidence, uploaded files, email attachments, document images, extracted data and related records.

"Evidence Pack" means an exportable document or collection of records generated by VATTY to support VAT evidence review.

"Customer Data" means data, documents, files, notes, records, user information, client company details, supplier details, invoice data, VAT evidence, messages and other content uploaded to or generated within VATTY by or for the Customer.

2. Scope of this Privacy Policy

This Privacy Policy applies when you:

• visit the VATTY website
• create a VATTY account
• use the VATTY software
• upload or forward VAT Documents
• create or manage Client Companies
• use the receipt/invoice review workflow
• use VAT validation features
• create client or supplier evidence requests
• use the client portal
• use supplier upload links
• use mailboxes or email forwarding
• export Evidence Packs
• contact us for support
• interact with billing, subscription or payment features
• take part in a pilot, beta, demo or early-access programme
• otherwise interact with VATTY. This Privacy Policy also applies to personal data contained within uploaded VAT Documents, including invoices, receipts, supplier records, client records, audit trails and notes.

3. Controller and processor roles

VATTY may act as either a controller or a processor, depending on the context.

The ICO explains that controllers decide the purposes and means of processing personal data, while processors act on behalf of controllers and process personal data under instructions.

3.1 Where the Customer is controller and VATTY is processor

For most VAT Documents and Client Company data uploaded by an accounting firm or business into VATTY, the Customer is likely to be the controller and VATTY is likely to act as processor.

This includes personal data contained in:

• uploaded invoices and receipts
• Client Company files
• supplier records
• VAT evidence
• client portal responses
• supplier upload responses
• audit trail records
• accountant notes
• document extraction results. In these cases, the Customer decides why the data is processed and is responsible for ensuring there is a lawful basis for processing. VATTY processes that data to provide the Service according to the Customer's instructions and our Terms and Conditions.

3.2 Where VATTY is controller

VATTY may act as controller for personal data we use for our own business purposes, including:

• account administration
• customer relationship management
• billing and payment administration
• website analytics
• product analytics
• platform security
• service improvement
• support
• marketing to prospective customers
• legal compliance
• fraud prevention
• operational reporting. Where VATTY acts as controller, we are responsible for deciding how and why that data is processed.

4. Personal data we collect

We may collect and process the following categories of personal data.

4.1 Account and user data

This may include:

• name
• email address
• phone number
• job title
• firm name
• business address
• login details
• account role
• permissions
• authentication data
• user preferences
• account activity
• support history.

4.2 Customer and firm data

This may include:

• accounting firm name
• company number
• business address
• billing details
• subscription plan
• number of active companies
• payment status
• users and permissions
• support contacts
• pilot or onboarding notes.

4.3 Client Company data

This may include:

• company name
• trading name
• company number
• VAT number
• registered address
• trading address
• contact name
• contact email
• contact phone number
• VAT period dates
• accounting software references
• internal notes
• client activity logs.

4.4 Supplier data

This may include:

• supplier name
• supplier VAT number
• supplier address
• supplier contact name
• supplier email address
• supplier phone number
• invoice reference
• correspondence history
• supplier upload activity
• supplier response records.

4.5 VAT Document data

This may include:

• invoices
• receipts
• tax invoices
• credit notes
• refund documents
• email attachments
• email body content
• uploaded images
• PDF files
• supplier statements
• transaction references
• invoice numbers
• invoice dates
• gross amounts
• net amounts
• VAT amounts
• VAT rates
• payment references
• billed-to names
• billed-to addresses
• supplier names
• supplier VAT numbers
• accountant notes
• client comments
• supplier comments. Some VAT Documents may contain personal data if, for example, an invoice is addressed to an individual, director, sole trader, landlord, consultant or named contact.

4.6 Extraction, validation and assessment data

VATTY may generate additional data from uploaded documents, including:

• extracted supplier name
• extracted VAT number
• extracted gross, net and VAT amounts
• extracted invoice date
• extracted invoice number
• extracted billed-to details
• confidence scores
• issue labels
• assessment labels
• action statuses
• duplicate detection results
• VAT validation results
• calculation checks
• rationale
• audit trail entries.

4.7 Client portal and supplier upload data

This may include:

• portal access logs
• uploaded replacement documents
• missing information supplied by clients
• supplier email addresses
• authority to contact supplier
• supplier uploaded evidence
• client comments
• supplier comments
• timestamps
• action history.

4.8 Usage and analytics data

This may include:

• pages viewed
• features used
• buttons clicked
• documents uploaded
• evidence packs exported
• requests created
• requests resolved
• automation mode selected
• mailbox use
• validation checks performed
• error logs
• upload failures
• OCR failures
• response times
• device/browser information
• IP address
• approximate location derived from IP address
• session activity
• performance metrics.

4.9 Support and communications data

This may include:

• emails to us
• support tickets
• bug reports
• demo requests
• pilot feedback
• survey responses
• onboarding notes
• call notes
• chat messages
• attachments sent to support.

4.10 Billing and payment data

This may include:

• billing name
• billing email
• billing address
• subscription plan
• company count
• invoices
• payment status
• VAT on subscription charges
• payment processor customer ID
• payment method metadata. We do not intend to store full card details ourselves. Payment processing may be handled by a third-party provider such as Stripe.

5. How we collect personal data

We collect personal data in the following ways.

5.1 Directly from you

For example, when you:

• create an account
• invite users
• add company details
• upload VAT Documents
• add notes
• send support messages
• submit pilot feedback
• configure billing
• set automation preferences.

5.2 From other users in your organisation

For example, a firm administrator may invite you, assign permissions, upload documents or add your contact details.

5.3 From clients and suppliers

For example, when a client or supplier:

• accesses a secure VATTY link
• uploads a corrected invoice
• enters missing details
• provides a supplier email
• authorises supplier contact
• submits a response.

5.4 From uploaded documents

Personal data may be extracted from invoices, receipts, email attachments and other VAT Documents uploaded or forwarded into VATTY.

5.5 Automatically through the Service

We collect technical and usage data automatically when the Service is used.

5.6 From third-party services

We may receive data from third-party services where authorised or necessary, such as:

• VAT validation providers
• HMRC services
• accounting software integrations
• email systems
• authentication providers
• payment processors
• analytics tools
• cloud hosting platforms.

6. How we use personal data

We use personal data for the following purposes.

6.1 To provide the VATTY Service

This includes:

• creating and managing accounts
• hosting Customer Data
• processing uploaded VAT Documents
• extracting invoice and receipt data
• validating VAT numbers
• creating assessment and issue labels
• managing VAT periods
• maintaining audit trails
• generating Evidence Packs
• enabling client and supplier requests
• enabling document assignment and review
• enabling export and deletion features.

6.2 To support VAT evidence workflows

This includes:

• identifying missing VAT numbers
• identifying missing VAT invoices
• identifying billed-to mismatches
• identifying duplicate documents
• checking calculations
• assigning action statuses
• preparing client requests
• preparing supplier chases
• recording resolution history.

6.3 To provide client and supplier portals

This includes:

• generating secure access links
• showing relevant document/request information
• receiving uploaded evidence
• recording responses
• updating request statuses
• updating audit trails.

6.4 To provide automation

This includes:

• preparing suggested requests
• sending automated requests where enabled
• sending reminders where enabled
• tracking request outcomes
• updating action statuses.

6.5 To provide support

This includes:

• responding to support queries
• investigating bugs
• helping with onboarding
• reviewing pilot feedback
• diagnosing upload or extraction issues
• resolving account issues.

6.6 To manage billing and subscriptions

This includes:

• calculating subscription fees
• managing plan usage
• issuing invoices
• handling failed payments
• processing upgrades, downgrades or cancellations
• administering credits or partner incentives.

6.7 To improve VATTY

This includes:

• analysing product usage
• improving OCR and extraction
• improving VAT evidence workflows
• improving user experience
• testing new features
• monitoring error rates
• measuring evidence issue categories
• improving request and resolution workflows
• developing integrations
• improving help content and onboarding.

6.8 To monitor security and prevent misuse

This includes:

• detecting unauthorised access
• monitoring suspicious activity
• preventing fraud
• protecting Customer Data
• investigating incidents
• enforcing our Terms.

6.9 To communicate with you

This includes:

• service updates
• account notices
• billing notices
• support responses
• onboarding emails
• pilot communications
• security alerts
• product announcements
• marketing communications where permitted.

6.10 To comply with legal obligations

This includes:

• accounting and tax records
• responding to lawful requests
• complying with data protection law
• handling complaints
• resolving disputes
• maintaining records required by law.

7. Lawful bases for processing

Under UK GDPR, organisations need a lawful basis to process personal data. The ICO explains that organisations must identify and explain their lawful basis for processing personal information.

Where VATTY acts as controller, we rely on one or more of the following lawful bases.

7.1 Contract

We process personal data where necessary to provide the Service or take steps before entering into a contract.

Examples:

• creating user accounts
• providing access to VATTY
• processing uploaded documents
• managing subscriptions
• providing support
• sending service notices.

7.2 Legitimate interests

We may process personal data where necessary for our legitimate interests, provided those interests are not overridden by individual rights and freedoms.

Examples:

• improving the Service
• analysing product usage
• monitoring performance
• securing the platform
• preventing misuse
• supporting customers
• developing new features
• understanding customer needs
• maintaining business records
• sending relevant business-to-business communications where permitted. The ICO explains that legitimate interests is one of the lawful bases under UK GDPR.

7.3 Legal obligation

We may process personal data where necessary to comply with legal obligations.

Examples:

• accounting records
• tax records
• fraud prevention obligations
• responding to lawful requests
• complying with data protection law.

7.4 Consent

We may rely on consent where required, such as:

• optional marketing where consent is required
• non-essential cookies where consent is required
• certain optional analytics or tracking features
• any other processing where we specifically ask for consent. Where we rely on consent, you may withdraw consent at any time.

7.5 Vital interests and public task

These bases are unlikely to apply to normal VATTY use but may apply in exceptional circumstances.

8. Processing Customer Data as processor

Where VATTY processes Customer Data as processor, the Customer is responsible for determining the lawful basis.

The Customer must ensure that personal data uploaded to VATTY is processed lawfully, fairly and transparently.

The Customer must also ensure that clients, suppliers, employees and other individuals receive appropriate privacy information where required.

VATTY will process Customer Data according to the Customer's instructions, our Terms and Conditions, and applicable data protection law.

9. Data used for analytics and product improvement

VATTY may use platform data and Customer Data to generate analytics, measure performance, improve the Service and develop new features.

This may include:

• number of companies added
• number of documents uploaded
• number of VAT periods created
• number of evidence issues detected
• number of missing VAT numbers
• VAT validation success and failure rates
• extraction accuracy metrics
• duplicate detection metrics
• request creation rates
• request resolution times
• evidence pack export rates
• feature usage
• support issues
• error logs
• performance metrics. Where possible, we use aggregated, anonymised or pseudonymised data for analytics and improvement.

We may use analytics to:

• improve OCR and extraction accuracy
• improve VAT evidence logic
• identify bugs
• improve workflows
• understand which features are useful
• monitor platform performance
• support business planning
• prepare aggregated reporting
• support product development
• support investor or commercial reporting in anonymised form.

We will not sell Customer Data.

We will not disclose identifiable VAT Documents, Client Company data, supplier data or personal data to third parties for their independent marketing purposes.

We may continue to use aggregated or anonymised analytics data after an account is closed, provided it does not identify you, your clients, suppliers or individuals.

10. AI, OCR and machine learning providers

VATTY may use OCR, AI, machine learning and similar technologies to process uploaded documents and improve the Service.

This may involve sending document images, text, extracted fields or metadata to third-party providers such as OpenAI, Google/Gemini or other AI/OCR infrastructure providers.

AI/OCR processing may be used to:

• read invoices and receipts
• extract supplier information
• extract VAT numbers
• extract dates and amounts
• identify document type
• identify evidence issues
• improve extraction accuracy
• prepare summaries or suggested actions
• support workflow automation. We will take reasonable steps to ensure that AI/OCR providers are subject to appropriate contractual and security protections. We will not knowingly use Customer Data to train third-party public AI models unless this is clearly disclosed and permitted under applicable law and contract. VATTY may use aggregated, anonymised or pseudonymised information to improve its own extraction, validation and workflow performance.

11. Cookies and similar technologies

Our website and software may use cookies, pixels, local storage, session storage and similar technologies.

These may be used for:

• keeping users logged in
• remembering preferences
• security
• fraud prevention
• analytics
• product improvement
• support tools
• marketing attribution. Some cookies are necessary for the Service to work. Others may be optional. Where required by law, we will ask for consent before using non-essential cookies or similar technologies. You can manage cookies through your browser settings or any cookie controls we provide. We may publish a separate Cookie Policy or cookie notice.

12. Marketing communications

We may send marketing communications to business contacts where permitted by law.

Marketing may include:

• product updates
• pilot invitations
• feature announcements
• webinars
• case studies
• partner programme information
• accountant-focused content.

You can opt out of marketing emails at any time by using the unsubscribe link or contacting info@vatty.co.uk.

We may still send service, security, billing or legal notices even if you opt out of marketing.

13. Who we share personal data with

We may share personal data with the following categories of recipients.

13.1 Authorised users

Personal data may be visible to authorised users within the Customer account according to their permissions.

13.2 Clients and suppliers

Where you use the client portal or supplier upload features, limited information may be shared with the relevant client or supplier to complete the evidence request.

This may include:

• client company name
• supplier name
• invoice/reference details
• issue detected
• document amount/date
• what evidence is needed
• secure upload link. You are responsible for ensuring that client and supplier details are correct before sending requests.

13.3 Service providers and sub-processors

We may share data with providers of:

• cloud hosting
• database storage
• file storage
• authentication
• email delivery
• OCR and AI processing
• VAT number validation
• analytics
• monitoring and logging
• payment processing
• customer support
• accounting software integrations
• API infrastructure. These may include providers such as OpenAI, Google/Gemini, Amazon Web Services, Supabase, Stripe, Xero and similar infrastructure, software, analytics, email, validation or integration providers, depending on the features used and technical architecture in place at the time.

13.4 Payment processors

Payment information may be processed by providers such as Stripe.

We do not intend to store full payment card details ourselves.

13.5 Professional advisers

We may share information with lawyers, accountants, auditors, insurers or advisers where necessary for business, legal, tax, accounting or insurance purposes.

13.6 Regulators, authorities and legal requests

We may share information where required or permitted by law, including with courts, regulators, government bodies, law enforcement or tax authorities.

13.7 Business transfers

If VATTY is involved in a merger, acquisition, investment, sale of assets, restructuring or similar transaction, personal data may be shared as part of that process, subject to appropriate confidentiality and data protection safeguards.

14. Sub-processors

We may use sub-processors to provide the Service.

Sub-processors may process personal data on our behalf.

We will take reasonable steps to ensure sub-processors provide appropriate contractual, technical and organisational protections.

We may maintain a list of current sub-processors on our website, in-app documentation or by request.

If you require a detailed sub-processor list, contact info@vatty.co.uk.

15. International transfers

Some of our providers may process personal data outside the United Kingdom.

The ICO explains that UK GDPR contains rules for transfers of personal information to separate organisations outside the UK, often referred to as restricted transfers.

Where international transfers take place, we will take steps intended to ensure that appropriate safeguards are used where required. These may include:

• UK adequacy regulations
• international data transfer agreements
• standard contractual clauses
• UK addendums
• other lawful transfer mechanisms.

16. How long we keep personal data

We retain personal data for as long as reasonably necessary for the purposes described in this Privacy Policy and our Terms and Conditions.

These purposes may include:

• providing the Service
• maintaining VAT evidence records
• preserving audit trail integrity
• enabling Evidence Pack generation
• supporting VAT period review and sign-off records
• complying with legal, accounting, tax and regulatory obligations
• resolving disputes
• enforcing agreements
• investigating security issues
• preventing fraud or misuse
• maintaining backups
• supporting analytics, service improvement and product development. The ICO explains that UK GDPR does not set one fixed retention period for all personal data. Organisations must decide and justify retention based on the purposes for processing. We do not keep personal data indefinitely without purpose. Where possible, we may retain aggregated, anonymised or pseudonymised analytics data after account closure, provided it does not identify the Customer, Client Companies, suppliers or individuals. You may request export or deletion of Customer Data. We will comply with valid deletion requests where required by law and where deletion is technically and legally possible. We may retain certain data where continued retention is necessary for:
• legal obligations
• accounting records
• legitimate business purposes
• dispute resolution
• audit trail integrity
• backup recovery
• security
• fraud prevention
• compliance
• analytics in anonymised or pseudonymised form.

Deletion from active systems may not immediately remove data from encrypted backups or system logs, but such data will remain protected and will be deleted or overwritten in accordance with our backup and retention processes.

17. Security

We use reasonable technical and organisational measures designed to protect personal data.

These may include:

• authentication
• access controls
• role-based permissions
• encryption in transit
• secure file storage
• secure hosting
• audit logs
• monitoring
• backups
• restricted administrative access
• incident response procedures
• supplier due diligence
• confidentiality obligations. No system is completely secure. You are responsible for:
• using strong passwords
• protecting login details
• keeping devices secure
• managing user permissions
• removing users who no longer need access
• checking client/supplier recipient details before sending requests
• protecting exported Evidence Packs.

18. Data breaches

If we become aware of a personal data breach affecting personal data we process as controller, we will assess the breach and take appropriate action under applicable law.

If we become aware of a personal data breach affecting Customer Data that we process as processor, we will notify the relevant Customer without undue delay where required by law.

You are responsible for notifying us promptly if you suspect unauthorised access, disclosure, loss or misuse of data in your VATTY account.

Contact:

info@vatty.co.uk

19. Your rights

Depending on the circumstances, individuals may have rights under UK GDPR, including:

• right to be informed
• right of access
• right to rectification
• right to erasure
• right to restrict processing
• right to data portability
• right to object
• rights relating to automated decision-making and profiling
• right to withdraw consent where processing is based on consent. If your request relates to personal data controlled by one of our Customers, such as an accounting firm or business using VATTY, we may direct your request to that Customer. If your request relates to data for which VATTY is controller, we will respond in accordance with applicable law. To exercise rights, contact: info@vatty.co.uk

We may need to verify your identity before responding.

20. Automated decision-making and profiling

VATTY may use automation to assist with:

• OCR extraction
• VAT number detection
• duplicate detection
• issue detection
• evidence classification
• confidence scoring
• request preparation
• workflow status updates. These automated outputs are intended to support accountant review and workflow management. VATTY does not intend to make legally binding decisions about VAT recovery, VAT return submission or tax compliance without human review. The accountant, business or authorised user remains responsible for reviewing outputs and making final decisions.

21. Children

VATTY is not intended for use by children.

You must not create an account if you are under 18.

VATTY is designed for accounting firms, businesses, professional users, clients and suppliers involved in VAT evidence workflows.

22. Special category data

VATTY is not designed to process special category personal data, such as health information, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership or sexual orientation.

Customers should avoid uploading special category data unless strictly necessary, lawful and protected by appropriate safeguards.

If special category data appears incidentally in an uploaded document, the Customer remains responsible for ensuring the processing is lawful.

23. Client and supplier privacy responsibilities

If you are a Customer using VATTY, you are responsible for ensuring that your clients, suppliers, employees and other relevant individuals understand how their personal data may be processed.

This may include updating your own privacy notice to explain that you use VATTY to:

• collect and manage VAT evidence
• process invoices and receipts
• validate VAT details
• request missing evidence
• contact clients and suppliers
• maintain an audit trail
• create Evidence Packs. You are responsible for ensuring that personal data uploaded to VATTY is lawful, relevant, accurate and necessary.

24. Privacy wording for clients and suppliers

Where appropriate, you may use or adapt the following wording with your clients or suppliers:

We use VATTY, a VAT evidence management platform, to help collect, review and document VAT invoices, receipts and supporting evidence. Documents and information you provide may be processed in VATTY to support VAT evidence review, issue resolution and audit trail records.

Supplier upload pages and client portals may also include short privacy notices explaining that information provided will be shared with the relevant accountant/business and processed by VATTY.

25. Payment data

Where payments are processed through a third-party payment provider such as Stripe, payment data will be processed by that provider according to its own terms and privacy policy.

We may receive payment-related information such as:

• payment status
• invoice number
• customer ID
• last four digits of card
• billing email
• subscription status. We do not intend to store full card numbers or full payment credentials.

26. Integrations

VATTY may integrate with third-party software such as Xero, QuickBooks, Sage, Dext, Hubdoc, HMRC services, VAT validation providers, email systems or other tools.

When you connect an integration, we may process data received from or sent to that integration.

This may include:

• company details
• accounting transaction data
• invoice data
• attachment data
• supplier/contact data
• VAT period data
• evidence status
• document references
• user authorisation tokens. Your use of third-party integrations may also be governed by the third party's own terms and privacy policy. You can disconnect integrations where supported.

27. Pilot, beta and early-access data

If you take part in a pilot, beta or early-access programme, we may collect additional feedback and usage information.

This may include:

• pilot setup notes
• feedback scores
• usability comments
• bugs reported
• documents processed
• issues detected
• companies added
• feature requests
• willingness-to-pay feedback
• expansion intent. We use this information to improve VATTY, validate the product and support development. Pilot and beta features may change over time.

28. Aggregated benchmarking and reporting

VATTY may create aggregated or anonymised benchmarking and reporting data.

Examples may include:

• average number of VAT evidence issues per VAT period
• percentage of documents missing VAT numbers
• average supplier chase response time
• average evidence pack export rate
• average VAT at risk by document type
• extraction accuracy trends
• feature usage across firms. We will not publish or share benchmarking data in a way that identifies a specific Customer, Client Company, supplier or individual unless agreed.

29. Data accuracy

We rely on Customers and Users to provide accurate information.

You should keep account, company, VAT, billing, client and supplier information up to date.

If you believe personal data is inaccurate, contact us or update it within the Service where possible.

Automated extraction may produce inaccurate results, so extracted data should be reviewed before relying on it.

30. Third-party websites

Our website or Service may link to third-party websites or services.

We are not responsible for the privacy practices of third-party websites or services.

You should review their privacy policies before using them.

31. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

If changes are material, we will take reasonable steps to notify you, such as by email, in-app notice or website update.

The updated Privacy Policy will take effect from the date stated at the top of the policy or as otherwise notified.

Continued use of VATTY after the updated Privacy Policy takes effect means you acknowledge the updated policy.

32. How to contact us

For privacy, data protection or support questions, contact:

Vatty Ltd 37 Limes Road Beckenham BR3 6NS United Kingdom Email: info@vatty.co.uk

33. Complaints

If you have a concern about how we use personal data, please contact us first at:

info@vatty.co.uk You also have the right to complain to the UK Information Commissioner's Office.

The ICO website is available here:

https://ico.org.uk

Appendix 1 - Summary of processing activities

Account administration

Data used: name, email, firm details, login details, role, permissions.

Purpose: create and manage VATTY accounts.

Lawful basis where VATTY is controller: contract, legitimate interests.

VAT evidence processing

Data used: uploaded invoices, receipts, supplier data, client data, VAT details, extracted fields.

Purpose: provide VAT evidence review workflows.

Role: usually Customer as controller, VATTY as processor.

Client and supplier requests

Data used: client/supplier names, emails, invoice references, document issues, upload links.

Purpose: request missing or corrected evidence.

Role: usually Customer as controller, VATTY as processor.

Product analytics

Data used: usage metrics, feature usage, error logs, workflow outcomes, anonymised or pseudonymised data where possible.

Purpose: improve VATTY and monitor performance.

Lawful basis where VATTY is controller: legitimate interests, consent where required.

Billing

Data used: billing contact, subscription plan, invoices, payment status.

Purpose: manage subscriptions and payments.

Lawful basis: contract, legal obligation, legitimate interests.

Marketing

Data used: name, email, firm details, product interest, communication preferences.

Purpose: send relevant business communications.

Lawful basis: legitimate interests or consent where required.

Security

Data used: login logs, IP address, activity logs, error logs, device/browser data.

Purpose: protect the Service and Customer Data.

Lawful basis: legitimate interests, legal obligation.

Appendix 2 - Example customer privacy notice wording

Accounting firms using VATTY may wish to add wording like this to their own privacy notice:

We may use VATTY, a VAT evidence management platform, to process invoices, receipts, VAT documents and supporting evidence for VAT review and record-keeping purposes.

This may involve uploading or forwarding documents to VATTY, extracting invoice and VAT information, validating supplier VAT details, identifying missing or weak VAT evidence, requesting corrected evidence from clients or suppliers, and creating an audit trail or evidence pack.

VATTY may process personal data contained in VAT documents, including names, business addresses, email addresses, supplier details, invoice references and transaction information.

We remain responsible for deciding how and why this data is processed where we act as controller.

Appendix 3 - Client/supplier portal privacy notice

Short wording for client/supplier upload pages:

This secure VATTY page is used to provide VAT evidence requested by the accountant or business named on this page.

Information and documents you provide will be shared with that accountant or business and processed by VATTY to support VAT evidence review, issue resolution and audit trail records.

Only provide information that is relevant to the request.

Appendix 4 - Cookie notice wording

Short cookie notice:

VATTY uses necessary cookies to operate the website and software securely. We may also use analytics cookies to understand usage and improve the Service. You can manage non-essential cookies where cookie controls are provided.

Expanded cookie categories:

Cookie type Purpose Necessary Login, security, session management, platform operation Preferences Remember user settings and interface preferences Analytics Understand usage, improve product performance

Cookie type Purpose Support Provide in-app help or support tools Marketing Measure campaigns or website conversions where enabled

Appendix 5 - Data retention summary

Indicative retention approach:

Data type Retention approach Active account Retained while account is active data Retained while needed for Service, audit trail, evidence packs and VAT Documents legal/business purposes Audit trail Retained while needed to preserve evidence history records Billing records Retained as required for accounting/tax/legal purposes Support Retained as needed for support, training, dispute resolution and service messages improvement Retained in aggregated, anonymised or pseudonymised form where Analytics data possible Backup data Deleted or overwritten according to backup cycles Closed account Retained for a reasonable period, then deleted, anonymised or retained data only where justified