Parties and roles
Your practice (the customer) is the controller of the personal data it records in MTAR Compliance Register. Modern Platforms Ltd (company number 17075477, 124 City Road, London, EC1V 2NX) is its processor. Our own use of account, billing and security data as a controller is explained in our privacy notice.
Subject matter, nature and purpose
We store, organise, display, export and delete the practice’s records so that it can keep an internal governance record for HMRC’s Mandatory Tax Adviser Registration regime. This covers people and roles, relevance decisions and rationale, conditions and evidence files, change events, review tasks, correspondence logs, internal assurance and sign-off records, and audit history. We process it for as long as the practice uses the service, and then as set out under “End of service”.
Data subjects and data
The data subjects are the practice’s officers, staff, reviewers and business correspondents. The personal data is names, work roles, officer status, the practice’s rationale and decisions, review attribution and dates, and redacted business evidence. The practice must not record Government Gateway or other credentials, personal tax affairs, special category data, or criminal or no-conviction status.
Our commitments
- Instructions. We process the data only on the practice’s documented instructions. Using the service as designed, and the practice’s settings and actions in it, are those instructions. If the law requires other processing, we will tell the practice first unless the law forbids it. We will tell the practice if we believe an instruction breaks data protection law.
- Confidentiality. Anyone we allow to process the data is bound by confidentiality.
- Security. We maintain appropriate technical and organisational measures. These include encryption in transit, per-practice separation of records and files enforced on every request, private evidence storage with integrity checks, role-based permissions, password confirmation for sensitive actions, optional two-factor authentication and restricted production access.
- Sub-processors. The practice gives general authorisation for the sub-processors listed in our privacy notice: Hetzner Online GmbH (hosting, Finland), Amazon Web Services (email, London region) and Stripe (billing). We will email the practice’s owners at least 30 days before adding or replacing a sub-processor that handles register data. If the practice objects on reasonable data protection grounds and we cannot resolve the objection, it may end its subscription and we will refund any prepaid unused period. We impose equivalent data protection obligations on sub-processors and remain responsible for them.
- Transfers. We transfer data outside the UK only with appropriate safeguards, as described in the privacy notice.
- Assistance. We help the practice respond to people exercising their rights; the service’s export and deletion features handle most requests directly. We also help with security, personal data breaches, data protection impact assessments and consultation with the ICO, taking into account the nature of the processing and the information available to us.
- Breaches. We will notify the practice’s owners without undue delay after becoming aware of a personal data breach affecting its data. We will share what we know and keep them updated as we investigate.
- Audit. We will make available the information needed to demonstrate compliance with these terms and allow for, and contribute to, reasonable audits by the practice or an auditor it appoints, on reasonable notice and subject to confidentiality.
Retention and end of service
The practice controls its active records and can export or delete them at any time. Our retention schedule, published in the privacy notice, also applies:
- Archived records, departed people, replaced or discarded evidence versions, resolved items, and signed assurance cycles other than the most recent are deleted 6 years after that happened.
- When the practice closes its account, or no longer has an active trial or subscription, all of its register data is deleted 90 days later, after we have emailed its owners. This is how we return or delete the data at the end of the service. The practice can download a complete export from Settings at any time before then.
We keep data longer only where UK law requires it, or while a legal hold is in place for a dispute or legal claim. In either case access is restricted to that purpose.
General
If these terms conflict with our other service terms on data protection, these terms prevail. They are governed by the law of England and Wales.