Privacy policy

DueFile (duefile.co.uk) is UK VAT filing software, a trading name of Lemae Tech Limited (registered in England and Wales, company no. 06029775, registered office 64 Ryeish Lane, Spencers Wood, Reading, RG7 1SS; VAT GB894252007). This notice explains what personal data we hold when you use it, why, and your rights. Lemae Tech Limited is the data controller; contact us at privacy@duefile.co.uk.

What we hold and why

• Your email address — to operate your account and sign you in (we use emailed sign-in links; there are no passwords). Lawful basis: contract.
• HMRC authorisation tokens — issued by HMRC when you connect your VAT registration, stored encrypted (AES-256-GCM). Your Government Gateway sign-in details are entered only on HMRC's own website and never reach us. Lawful basis: contract.
• Your VAT registration number and the nine figures of each return you submit, plus HMRC's submission receipts — kept as your permanent proof of filing. Lawful basis: contract, and legal obligation for retention of tax records.
• Fraud prevention data — HMRC legally requires all Making Tax Digital software to send device information with every API call: a software-generated device identifier, your public IP address and port, timezone, screen and browser window characteristics, and browser user agent. We collect this and pass it to HMRC. Lawful basis: legal obligation. See HMRC's transaction monitoring privacy notice.
• Server logs including IP addresses, kept briefly for security and troubleshooting. Lawful basis: legitimate interests.

Who receives your data

• HMRC — your returns and the fraud prevention data above, when you file.
• OVH — hosting; our servers are in the United Kingdom (London).
• Resend — delivers sign-in and reminder emails (processes your email address).

We do not sell or share your data with anyone else, and we run no advertising or cross-site tracking.

Cookies & analytics

Signed-in pages use only essential cookies: your session, sign-in state, and the fraud-prevention device data HMRC requires. On our public pages we ask before setting one optional Google Analytics cookie to understand how people find DueFile — nothing loads unless you accept, declining is remembered, and analytics never runs inside your account. Google processes this data on our behalf; see Google's privacy policy.

Retention

Account data is kept while your account exists. Submitted returns and their HMRC receipts are kept for six years in line with UK tax record-keeping rules — including after account deletion, which we are legally permitted to do. Expired sessions and sign-in links are purged.

Your rights

You can ask for a copy of your data, correct it, or ask us to delete your account (we must retain filed returns as above) — email privacy@duefile.co.uk. You can revoke DueFile's access to your VAT data at any time from your HMRC account. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.