Privacy Policy

MerxTax is operated by Merx Digital Solutions Ltd, a company registered in England and Wales. We are committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights in relation to it.

1. Who We Are

• Data Controller: Merx Digital Solutions Ltd
• Website: www.merxtax.co.uk
• Contact: privacy@merxtax.co.uk
• ICO Registration Number: ZC096083

2. Data We Collect

We collect the following categories of personal data when you use MerxTax:

• Account data: Name, email address, password (hashed), language preference
• Tax data: Income records, expense records, receipts, invoices, and any data you submit to HMRC through our platform
• HMRC authorisation data: OAuth tokens used to connect your HMRC account to MerxTax (stored securely, never shared)
• Bank data: Transaction data retrieved via Open Banking (Yapily). We receive read-only access; we cannot initiate payments
• Usage data: Pages visited, features used, device type, IP address, browser type
• Communications: Any emails or messages you send us

3. How We Use Your Data

• To provide the MerxTax service — income tracking, expense management, and MTD submissions to HMRC
• To communicate with you about your account, submissions, and deadlines
• To improve our platform and AI assistant (LUMEN) — anonymised and aggregated only
• To comply with our legal obligations, including HMRC's Making Tax Digital requirements
• To send service-related notifications (deadline reminders, submission confirmations)

We do not sell your data to third parties. We do not use your data for advertising.

4. Legal Basis for Processing

• Contract: Processing necessary to provide the MerxTax service you've subscribed to
• Legal obligation: Compliance with UK tax law and HMRC's Making Tax Digital requirements
• Legitimate interests: Improving platform security, fraud prevention, and service quality
• Consent: Marketing emails (you can withdraw consent at any time)

5. Data Sharing

We share your data only with trusted third parties necessary to operate MerxTax:

• HMRC — to submit your quarterly updates as authorised by you
• Yapily — Open Banking infrastructure for bank feed connectivity (EU/UK regulated)
• Supabase — Secure cloud database hosting (EU data residency)
• Stripe — Payment processing for subscriptions (PCI-DSS compliant)
• Anthropic — AI processing for LUMEN assistant (data is not used to train AI models)
• Vercel — Web hosting (EU data residency available)

6. Data Retention

We retain your personal data for as long as your account is active. Tax records and HMRC submission data are retained for a minimum of 6 years in accordance with HMRC requirements. You may request deletion of non-tax data at any time.

7. Your Rights (UK GDPR)

You have the following rights regarding your personal data:

• Right of access — Request a copy of the data we hold about you
• Right to rectification — Correct inaccurate data
• Right to erasure — Request deletion of your data (subject to legal retention obligations)
• Right to restriction — Limit how we process your data
• Right to data portability — Receive your data in a machine-readable format
• Right to object — Object to processing based on legitimate interests

To exercise any of these rights, contact us at privacy@merxtax.co.uk. We will respond within 30 days.

8. Cookies

MerxTax uses essential cookies for authentication and session management. We use analytics cookies (anonymised) to understand how users interact with our platform. You can manage cookie preferences in your browser settings.

9. Security

We use industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest, secure OAuth 2.0 for HMRC connections, and regular security audits. All staff with access to personal data are subject to confidentiality obligations.

10. International Transfers

Your data is processed within the UK and EU. Where data is transferred outside these regions (for example, to Anthropic's servers in the USA), we ensure adequate safeguards are in place in accordance with UK GDPR Article 46.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or prominent notice on the platform. Continued use of MerxTax after changes constitutes acceptance of the updated policy.

12. Contact & Complaints

For privacy enquiries, contact our Data Protection Officer at privacy@merxtax.co.uk.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — ico.org.uk · 0303 123 1113. Our ICO registration number is ZC096083.