1. Who we are
Self Assessment Software is a service of Swift Catalyst Ltd (Company No. 17130521, VAT No. 517276581), a company registered in England and Wales. For UK GDPR purposes, Swift Catalyst Ltd is the data controller for personal data processed through this website and the Self Assessment Software product.
This notice covers the public website, account registration, the subscriber workspace (including taxpayer Self Assessment data), contact messages, and related support.
2. Personal data we process
Depending on how you use the service, we may process:
- Account and organisation data — name, email, password (stored hashed), organisation name, organisation type (practice or individual), and related settings.
- Taxpayer and return data — names, addresses, dates of birth, National Insurance numbers and Unique Taxpayer References (encrypted at rest where stored as sensitive identifiers), employment and income figures, Self Assessment form boxes, calculation snapshots, reports and filing status.
- Practice workspace data — client records within an organisation, staff logins linked to that organisation, and filing-credit usage for client tax years.
- Contact and support data — messages sent via the contact form, and emails you send us.
- Technical data — IP address, browser type, device information, and basic server logs needed to operate and secure the service.
- Billing-related data — when payment is taken for filing a tax year or buying credits: invoice details, amounts, and payment status (card details are handled by the payment provider, not stored in full on our servers).
3. Why we process data (purposes and lawful bases)
We process personal data to:
- Provide the Self Assessment Software service (contract — Art. 6(1)(b) UK GDPR): create accounts, store returns, calculate tax, produce reports, and submit or queue filings.
- Meet legal obligations (Art. 6(1)(c)): keep records needed for tax, accounting and regulatory requirements that apply to us as a UK company.
- Operate, secure and improve the platform (legitimate interests — Art. 6(1)(f)): prevent abuse, debug faults, protect against unauthorised access, and understand how the product is used at an aggregate level.
- Respond to enquiries (legitimate interests or contract): answer contact-form and support messages.
Where we process special-category data, we do so only as needed to provide Self Assessment filing (for example health-related information if you enter it on a return). You should only enter data that is required for the return.
4. Who we share data with
We do not sell taxpayer lists or marketing lists of your clients.
We may share personal data with:
- HMRC — when a return is filed (or prepared for filing) through the product, return data is sent under HMRC’s APIs and terms.
- Service providers — hosting, email delivery, and payment processors who process data on our instructions to run the service.
- Professional advisers or authorities — where required by law, or to establish, exercise or defend legal claims.
- Your organisation’s users — people you invite into the same organisation can see that organisation’s workspace data according to their permissions.
Super-admin staff may access a subscriber organisation when investigating platform issues (impersonation). That access is logged in the product workflow and does not replace your passwords.
5. How long we keep data
We keep account and Self Assessment workspace data for as long as your organisation needs the service and for a reasonable period afterwards so you can retrieve historic returns, meet HMRC record-keeping expectations, and resolve disputes.
Contact-form messages are kept for support and audit purposes and then deleted or anonymised when no longer needed.
Server logs are retained for a limited period for security and operations, then rotated.
If you ask us to delete an account, we will erase or anonymise personal data unless we must retain it for legal, tax, security or dispute purposes.
6. Security
We use technical and organisational measures appropriate to the risk, including organisation-scoped access (tenant isolation), hashed passwords, encryption of sensitive identifiers such as NINO and UTR at rest, and keeping HMRC software credentials in server configuration rather than in the browser.
No method of transmission or storage is perfectly secure. Please use a strong unique password and protect access to your organisation’s logins. More detail is on our Security page.
7. International transfers
We aim to host and process service data in the United Kingdom or otherwise in ways that meet UK data-protection requirements. If a supplier processes data outside the UK, we use appropriate safeguards (such as UK International Data Transfer Agreements or equivalent approved mechanisms) where required.
8. Your rights
Under UK GDPR you may have the right to access, rectify, erase, restrict or object to certain processing, and to data portability, depending on the lawful basis. You also have the right to complain to the Information Commissioner’s Office (ICO).
To exercise your rights, email info@selfassessmentsoftware.co.uk with enough detail for us to verify your identity and locate the data. If you are a client of an accountant using our product, please contact that practice first — they control the client records in their organisation.
9. Cookies and similar technologies
We use cookies and similar technologies that are necessary to run the site and keep you signed in (for example session cookies). We do not use the public site to load taxpayer data into marketing trackers.
You can control cookies through your browser settings. Blocking necessary cookies may prevent sign-in or form submission from working.
10. Children
Self Assessment Software is aimed at adults and UK tax organisations. We do not knowingly offer accounts to children under 16.
11. Contact
Privacy requests: info@selfassessmentsoftware.co.uk
Postal enquiries can be sent to Swift Catalyst Ltd using the registered company details on Companies House.
ICO: https://ico.org.uk/
We may update this notice when the product or the law changes. The “Last updated” date at the top will change when we do. Continued use of the service after an update means you should read the revised notice.