Privacy policy

Who we are

Sichys Ventures Ltd provides cloud software for preparing, reviewing and submitting Making Tax Digital VAT information. In this policy, “TaxQuay”, “we” and “us” refer to Sichys Ventures Ltd, registration number 15372522, with its registered address at 146, Third Avenue, Dagenham RM10 9BB.

Information we collect

Depending on how you use TaxQuay, we may process:

• Account details, including your email address, password hash, verification status and two-factor authentication settings.
• Organisation and team information, including organisation names, membership roles and invitations.
• VAT and ledger information supplied by you, including VAT registration numbers, obligation periods, return figures, transaction records, evidence references and submission receipts.
• HMRC authorisation information, including encrypted OAuth access and refresh tokens. We do not ask for or store your Government Gateway password.
• Technical and security information needed to operate the service, prevent fraud and meet HMRC Fraud Prevention Header requirements, including IP address, device identifier, browser information, screen details and timestamps.
• Service communications and activity records, such as account emails and important actions taken in an organisation.

How we use information

We use personal information to provide and secure the service, authenticate users, maintain digital links, communicate account information, submit authorised requests to HMRC, prevent fraud, investigate incidents, meet legal obligations and improve reliability.

Our legal bases may include performing a contract, complying with legal obligations, and our legitimate interests in operating and protecting TaxQuay. Where another basis is required, we will explain it at the relevant time.

Who receives information

We share information only where needed to provide the service or comply with law. Recipients may include HMRC for authorised VAT API requests, infrastructure and email providers acting on our instructions, professional advisers, regulators and law-enforcement bodies where legally required. We do not sell customer tax data.

Security and international processing

TaxQuay uses HTTPS in transit, server-side access controls, encrypted HMRC tokens, password hashing, organisation roles and activity logging. Information may be processed by infrastructure providers in the locations described in our service documentation. Primary server location: Manchester. Our supplier list and processing locations will be maintained as the service develops.

How long information is kept

We retain information only for as long as needed for the service, legal obligations, security, dispute resolution and legitimate record-keeping. VAT records may need to be retained for statutory periods. Account and service data is deleted or anonymised when it is no longer required, subject to lawful retention and backup schedules.

Your rights

Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to processing, and to receive a portable copy of your information. You may also complain to the UK Information Commissioner’s Office. Requests can be made using the contact details below; we may need to verify your identity.

Cookies

TaxQuay uses essential cookies for sign-in, session security and OAuth state. We will ask for consent before using non-essential analytics or marketing cookies.

Contact us

For privacy questions or rights requests, email admin@taxquay.com. Please do not send Government Gateway passwords, OAuth tokens or full tax records by email.