WHO WE ARE
FastMTD is a trading name of &DEV Limited, a company registered in England and Wales, company number 11895018, registered office Milton Hall, Milton, Cambridge CB24 6WZ. &DEV Limited is the data controller for the personal data described here. Our ICO registration number is ZA934205. You can reach us about anything in this policy at privacy@fastmtd.app.
This covers the FastMTD mobile app for sole traders, and FastMTD Practice, the web application used by accountants a trader has chosen to work with. Where a point applies to one and not the other, it says so.
01What we collect, and why
If you are a sole trader using the FastMTD app
- Sign-in identity
The account identifier Google or Apple issue for you, the email address they pass to us at first sign-in, and the name you give - so we know it is you each time.
- National Insurance number
HMRC’s Income Tax APIs are addressed by it; without it nothing can be read from or sent to HMRC. You type it in.
- HMRC connection tokens
To read your obligations and send your quarterly updates, with your permission, to HMRC. We never see your Government Gateway password.
- Business records
Receipt photographs and the text read from them, invoices, mileage trips, jobs, money set aside, and answers you give about them. This is the product: keeping the digital records Making Tax Digital requires and building quarterly figures from them.
- Messages
Between you and your accountant, if you link one, so you both have the conversation.
- Device and connection details
Your device’s model, operating system, screen and timezone, its network addresses, the address and port your connection arrives from, a per-install identifier, the app version, and whether a biometric check was passed. HMRC require this by law on every call software makes to their Income Tax APIs, as fraud prevention data. We send it to HMRC and use it for nothing else. The full list is on the security page.
- Biometric attestation key
If you turn on Face ID or fingerprint in FastMTD, your handset creates a key and we keep the public half, so we can tell HMRC a second factor was used. Your biometric data never leaves the handset.
- Push notification token
To tell you when your accountant has a question.
- Technical logs
Which endpoint was called, when, with what result, from what address and app version - to run the service and investigate faults.
We do not collect your location, your contacts or your bank data, and there is no advertising or analytics tracking in the app.
If you are an accountant using FastMTD Practice
Your name, work email address and the identifier your organisation’s Microsoft Entra directory issues for you; the practice you belong to; the decisions, comments and messages you record about a client’s records; and technical logs as above.
02How we use it, and the lawful basis
Performance of a contract with you
Legal obligation
Performance of a contract
Performance of a contract, and your own action in entering their code
Consent, withdrawable in your handset
Legitimate interests, balanced against yours
Legal obligation
We do not make decisions about you by automated means that have legal or similarly significant effects. The figures the software prepares are shown to you and go to HMRC only when you choose to send them.
03Who receives it
HM Revenue & Customs: your quarterly update figures and the fraud prevention data they require, under the permission you grant at Government Gateway. HMRC are a separate controller for what they receive.
Your accountant, if and only if you link one, until either of you ends the engagement. They are their own controller for their professional records about you.
Our processors, who host, store or process data on our instructions and may not use it for their own purposes. Today these are Microsoft (hosting, storage and the AI model, in the United Kingdom), Apple and Google (sign-in, notification delivery, and the speech recognition built into your handset), and Cloudflare (serving this website, which is static, sets no cookies and loads nothing from anyone else). The current list, what each does and where, is on the security page, and we update it before adding a processor.
Nobody else. We do not sell personal data and we do not share it with advertisers.
Where Apple or Google process data outside the UK, the transfer relies on the UK’s adequacy decisions or the UK International Data Transfer Addendum.
04How long we keep it
Business records (receipts, invoices, trips, figures and submissions): HMRC require the self-employed to keep records for at least five years after the 31 January following the tax year they relate to. We keep your records for that period so that you can meet it, unless you export and delete them sooner, which you may.
HMRC connection tokens: until you disconnect HMRC or your account is deleted.
Sign-in sessions: revoked when you sign out and expired automatically otherwise.
Push tokens: until you sign out, disable notifications, or the token is reported invalid.
Fraud prevention data: sent to HMRC per call; we keep it only in technical logs.
Messages with your accountant: for the life of the engagement plus the record-keeping period above, because they explain decisions made about your records.
Technical logs and backups: for a limited period after which they expire automatically. The current periods are on the security page. A deletion request removes your data from the live service; copies in backups expire on that schedule and are not restored.
05Your rights
Under UK GDPR you can ask for a copy of your personal data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable form. You can withdraw consent to notifications in your handset’s settings. Email privacy@fastmtd.app from the address you signed up with. We answer within one month.
DELETING YOUR ACCOUNT
You can delete your account in the app, or by emailing privacy@fastmtd.app from the address you signed up with. The moment you ask, we sign you out everywhere, delete your HMRC connection and your sign-in, and stop sending notifications. Your records are deleted 30 days later; the gap exists so that an accountant you had linked can export what their own professional records require. Deleting your FastMTD records does not delete what has already been submitted to HMRC, and does not relieve you of HMRC’s record-keeping duty, so export your records first if you need them.
WHAT WE KEEP AFTER DELETION, AND WHY
For each quarterly update sent to HMRC through FastMTD we keep a sealed record: the figures sent, the period and tax year, when it was sent and on whose instruction, HMRC’s reference and their response. We keep it for six years after the end of the tax year it relates to, so that we can answer you or HMRC about what our software submitted if that is ever disputed, which is a legitimate interest of ours and, if a claim were made, our defence of it. The record is encrypted, it is not linked to your name, email or sign-in, and it holds a one-way hash of your National Insurance number rather than the number itself, so that a query naming you can be matched to it without the record identifying you on its own. We also keep the record that you asked us to delete your account and when we did. Nothing else about you survives deletion.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.
06How we protect it
Every trader’s records are isolated from every other’s in the database. Your HMRC tokens and our backups are encrypted with keys we hold separately from the data. Everything travels encrypted. Access to production systems is restricted to named people and logged. The detail, including how to report a security problem, is on the security page; the short version is security@fastmtd.app, and we acknowledge within two working days.
07Cookies
The FastMTD mobile app uses no cookies. FastMTD Practice sets two first-party cookies that hold your
session and its refresh token, marked HttpOnly, Secure and SameSite. There are no tracking,
advertising or third-party cookies. This website sets no cookies at all.
08Children
FastMTD is for people running a business and is not intended for anyone under 18.
09Changes
We will post changes here with a new effective date, and tell you in the app before any change that materially affects how your data is used takes effect. If FastMTD is transferred to another company, that company becomes the data controller in place of &DEV Limited; we will tell you before that happens, and it will be bound by this policy.