ReturnMateScope of this policy
This policy covers the ReturnMate website and, where made available under a customer agreement, ReturnMate tax and accounting services for professionals. The information involved depends on the features used. The website accepts early-access requests, but not tax returns, document uploads, payments, or tax-service account registrations.
A service agreement identifies the legal operator responsible for the subscription. For its own account administration, billing, security, and communications, the operator acts as controller. Where a practice controls its clients’ records, ReturnMate processes those records under the practice’s documented instructions and the applicable Data Processing Agreement.
Early-access requests
ReturnMate is for accountants, tax advisers, and accountancy practices. When you request early access, we use the name, phone number, and email address you supply to respond and contact you about access for your practice. The required contact choice records your consent for these early-access communications. We do not use it as consent to an unrelated newsletter. You may withdraw that consent by replying to a ReturnMate early-access message; withdrawal does not affect earlier lawful processing.
The form also transmits a form identifier, enquiry source, privacy-notice version, and contact choice. Like other online requests, the form processor may receive technical information for delivery, security, and spam prevention. Static Forms, operated by Qualascend, processes submissions for us, including delivery and dashboard storage under its applicable arrangements. See its Privacy Policy and Data Processing Agreement.
Static Forms may use automated spam checks and service providers, including AI-assisted filtering. It may process information outside the UK, including in the United States. Its form-processing locations and retention are separate from the intended UK hosting of customer tax records. The early-access form is limited to business contact details; it must not be used for client tax information.
Information associated with website visits
Hosting and access services may process technical information such as IP addresses, request times, browser details, and authentication or security events to deliver and protect the website. The site is published through ChatGPT Sites; the hosting and account provider’s handling is also governed by its applicable privacy information. Read OpenAI’s Privacy Policy for information about its services.
The early-access form collects your name, phone number, email address, and your choice to be contacted about access. It sends these details to Static Forms for processing and delivery to ReturnMate. The dashboard illustrations use demonstration data. Do not submit client tax records, HMRC passwords, or bank statements through this form.
Information you send us separately
If you contact the ReturnMate team through an existing correspondence channel, the information needed to handle your enquiry may include your name, contact details, organisation, and the contents of your message. Send only information relevant to the enquiry. The privacy arrangements of the communication service also apply.
Purposes and lawful bases
Where ReturnMate handles an enquiry, the purpose is to respond and manage the relationship. The relevant basis is taking steps at your request before entering a contract where applicable, or legitimate interests in responding to business communications. Records required by law are handled on the legal-obligation basis. Optional marketing requiring consent must be a separate, withdrawable choice.
Service providers and disclosure
Information may be handled by the hosting, access, and communication providers necessary to deliver the website or respond to an enquiry. Information may also need to be disclosed where required by law or to address a security incident. We do not use the website to sell personal information or collect it for unrelated advertising.
Where information is processed
The location of website hosting and account-provider processing is separate from the planned hosting of the tax application. We do not make a UK-only processing claim for this website. Any restricted transfer for which ReturnMate is responsible must have the appropriate legal arrangements.
Retention
Early-access submissions are processed through Static Forms and may be stored in its dashboard and delivered to ReturnMate’s configured email inbox. Our retention policy is to remove inactive early-access enquiries from the systems we control after 12 months without meaningful engagement, unless you withdraw your request earlier or a continuing relationship or documented legal requirement justifies retention. Provider operational logs follow its separate retention arrangements.
Your rights
Depending on the circumstances, you may request access to, correction of, or deletion of your information, restrict or object to processing, or request portability. You may withdraw consent where processing relies on consent, without affecting earlier lawful processing. Rights are subject to their applicable legal conditions.
For information handled by ReturnMate, use the contact method in your existing ReturnMate correspondence and clearly describe your request. For information controlled by the hosting or account provider, use its privacy request process. Requests normally require a response within one month, subject to applicable identity, clarification, and extension rules.
Concerns and complaints
You can raise a privacy concern through your existing ReturnMate correspondence channel. Our policy is to acknowledge privacy complaints within 30 days, investigate appropriately, keep you informed, and communicate the outcome. You may also raise a complaint with the ICO.
Tax services and AI
This website does not connect to HMRC or send customer tax records to an AI service. Any service that processes client records requires its own accurate notice and applicable data-processing agreement. Product illustrations do not establish that those features are currently available.
Information used for tax and accounting services
Where a customer activates the relevant service, processing can include account and contact details, tax identifiers, identity and financial records, returns, accounts, documents, authorisation tokens, submission receipts, and security activity. Information may be provided by the customer, an authorised practice, or an authorised HMRC connection. Collect only information relevant to the service and ensure you have authority to supply information about other people.
Necessary service processing for a sole practitioner contracting with us uses the contract basis. Business-contact administration and proportionate security use legitimate interests where appropriate; legally required records use the legal-obligation basis. When acting as a processor, ReturnMate follows the customer-controller’s lawful documented instructions. Special-category or criminal-offence information requires the additional applicable legal conditions before processing.
HMRC authorisation and fraud prevention
For supported connections, customers authorise access through HMRC and authenticate with HMRC directly. ReturnMate’s policy is not to collect or store HMRC passwords. Authorisation tokens are protected and used only for the connected service. Where the applicable API requires it, device, network, user-identifier, and related fraud-prevention information is sent to HMRC. The enabled integration’s notice explains the fields and any identifier storage before collection begins.
Customer records and hosting
Our production hosting policy requires core customer database records, uploaded documents, operational logs, and backups to be configured in AWS London before the tax application accepts client records. Website hosting is separate. This policy does not imply that every supplier’s account, support, or security processing takes place in the UK.
Customer records are shared with HMRC when authorised and with providers needed to deliver the contracted service. Separate overseas organisations may access personal information only with appropriate processing and transfer arrangements. Applicable service documentation identifies the providers involved. Customer tax records must not be sent to external AI services under our launch data-handling policy.
Service retention, export, and deletion
Customer tax records follow the controller’s documented retention instructions during the subscription, with export and deletion arrangements in the service agreement. Our standard exit policy allows a 30-day export period after closure, deletion from active systems within a further 30 days, and backup expiry within 35 days of active deletion. Earlier return or deletion instructions and documented legal holds are handled under the Data Processing Agreement. Customers remain responsible for preserving records they are legally required to keep.
Our retention policy sets routine request logs at 30 days, security audit events at 12 months, and support correspondence at 24 months after case closure, subject to documented necessity and legal holds. Operator accounting records follow applicable law; UK company records generally require six years after the relevant financial year, sometimes longer. These periods do not create a single retention rule for every kind of customer tax record.
Requests about practice-client records
If your accountant or practice controls the information concerned, direct your request to that practice. ReturnMate assists it under the Data Processing Agreement. The applicable service agreement and privacy information identify the relevant operator and contact routes. We do not make solely automated decisions with legal or similarly significant effects under the launch service policy.