Privacy Policy

Who we are

MTD Cymraeg is a free service that lets Welsh speakers submit Making Tax Digital (MTD) Income Tax Self Assessment updates to HM Revenue and Customs (HMRC). This policy explains what personal data we collect, why we collect it, and what rights you have over it.

What data we collect

To provide the service we collect and store: your email address and a securely hashed password, your National Insurance number, the income and expense transactions you upload, and an encrypted connection token that lets us submit updates to HMRC on your behalf once you have given permission through HMRC's own sign in process.

We also collect basic technical information required by HMRC's fraud prevention rules, including your device identifier, browser type, screen size, timezone, and IP address. This information is sent to HMRC with every submission and is not used by us for any other purpose.

Why we collect it

We use this data solely to let you prepare and submit your MTD Income Tax updates to HMRC. We do not sell your data, use it for advertising, or share it with anyone other than HMRC, except where the law requires us to.

Legal basis

We process your data because it is necessary to perform the service you have asked us to provide, and because we have a legal obligation to support HMRC's fraud prevention requirements when submitting data on your behalf.

How we protect your data

Your password is hashed and never stored in plain text. Your HMRC connection token is encrypted before it is stored. All traffic between your browser and our service is encrypted using TLS. Access to production systems is restricted to the people who need it to operate the service.

How long we keep your data

We keep your account data and submission history for as long as your account is active, and for a reasonable period afterwards in case it is needed for tax record keeping purposes. You can ask us to delete your account and data at any time, subject to any records HMRC or the law requires us to retain.

Your rights

Under UK GDPR you have the right to ask for a copy of the data we hold about you, to ask us to correct inaccurate data, and to ask us to delete your data. To make any of these requests, contact us using the details below.

Cookies

We use a small number of essential cookies to keep you signed in and to collect the technical information HMRC's fraud prevention rules require. We do not use cookies for advertising or tracking you across other websites.

Data breaches

If we become aware of a security incident affecting your personal data, we will notify the Information Commissioner's Office and affected users without undue delay, in line with our legal obligations.

Contact us

If you have any questions about this policy or how we handle your data, contact us at privacy@mtdcymraeg.wales.