Privacy Notice

1. Who provides this Service

Noviqent Ltd provides Noviqent Accounting. For the financial data a Customer enters about its own business (or, for an accountancy practice, its clients' businesses), the Customer is normally the data controller and Noviqent acts as its data processor, operating the Service on the Customer's instructions.

For account administration, billing, service security and the operation of the Noviqent Accounting website itself, Noviqent acts as an independent controller.

2. Information processed

• Account details: name, email address, hashed password (or Google sign-in identifier).
• Organisation details: business name, VAT registration number, Companies House number, VAT scheme.
• Ledger data entered by the Customer: chart of accounts, journal entries, contacts, invoices, bills, credit notes.
• Bank data: statement lines imported by CSV/OFX upload, or, where connected, via a bank feed integration using the Customer's own bank credentials.
• Billing data: GoCardless customer and mandate references (Noviqent does not store bank account numbers directly — these are held by GoCardless).
• Usage and security information: login timestamps, IP address, and API request logs.

3. How the information is used

To provide the ledger, reporting and reconciliation functionality of the Service, including calculating VAT, Self Assessment and CIS figures from data the Customer enters.

To operate billing, including the 30-day free trial and recurring Direct Debit collection via GoCardless.

To maintain security, including detecting fraud, abuse or unauthorised access.

To communicate service updates — including when direct HMRC submission becomes available for a tax scheme the Customer uses.

4. HMRC submission and this Notice

For VAT and Income Tax Self Assessment (ITSA), the Service can submit returns and related data directly to HMRC under Making Tax Digital, once the Customer has connected their organisation to HMRC. This connection uses HMRC's own Government Gateway OAuth authorisation, granted directly by the Customer (or, where the Customer is a practice acting under a client authorisation, by the Agent Services Account) to HMRC — Noviqent never holds or sees the Customer's HMRC sign-in credentials, only a token HMRC issues that can be revoked by the Customer at any time, either in the Service or directly with HMRC. Where this connection is active, VAT returns, VAT obligations, ITSA business income/expense periods, and related figures are transmitted to HMRC when the Customer submits them through the Service.

For Corporation Tax (CT600), Construction Industry Scheme (CIS) and PAYE/RTI, the Service does not transmit anything to HMRC — it produces figures and reports for the Customer (or their accountant) to review and submit through HMRC's own services or software.

Fraud-prevention data required by HMRC for any live HMRC submission (browser and device information, IP address, and similar technical signals) is sent alongside each submission, in the format HMRC's own Fraud Prevention Headers specification requires.

5. Legal basis

Where Noviqent is the controller, the relevant lawful bases are performance of a contract (operating the Customer's account and billing), and legitimate interests (service security and fraud prevention). Where Noviqent is a processor for the Customer's own ledger data, the Customer determines its own lawful basis for that processing.

6. Sharing and sub-processors

• GoCardless — billing and Direct Debit collection.
• Cloud hosting infrastructure used to run the Service.
• Transactional email provider — sent only account, billing and notification messages, not ledger or financial data.
• Bank feed providers (once enabled), used only to retrieve statement data the Customer has authorised.

7. Retention

Ledger and financial data is retained for as long as the account remains active, and for a reasonable period afterwards to allow export, consistent with UK statutory record-keeping requirements for accounting records (generally at least 6 years). Account and billing records are retained in line with applicable tax and accounting law.

8. Your rights

Where you are the account holder, you can access, correct, export or request deletion of your data through the Service or by contacting Noviqent directly. Where your data appears in someone else's ledger (for example, as a contact on an invoice), requests should ordinarily be directed to that organisation as the data controller in the first instance.

9. Contact and complaints

Contact Noviqent at hello@noviqent.co.uk with any privacy question or request. You may also complain to the Information Commissioner's Office (ico.org.uk) if you believe your data has been mishandled.