Privacy Policy
Last updated: 10 June 2026
1. Introduction
ComplyTrack ("we", "our", "us") is operated by Xtenalyze Ltd, a company registered in England and Wales (Company Number: 09147474). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our compliance monitoring service at complytrack.co.uk.
We are committed to protecting your privacy and handling your data in an open and transparent way. This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For the purposes of data protection law, Xtenalyze Ltd is the data controller.
2. Data We Collect
2.1 Account Information
- Name and email address
- Password (stored securely using bcrypt hashing)
- Account preferences and settings
- Subscription and billing information (processed by Stripe)
2.2 Company Data
- Companies House registration numbers
- Company names, status, type, and incorporation dates
- Filing history and deadline information
- Director and PSC (People with Significant Control) information
- SIC codes and registered office addresses
- Risk scores and compliance status
2.3 HMRC Data
- VAT registration numbers
- VAT return obligations and filing status
- Corporation Tax deadlines (calculated from accounting reference dates)
- HMRC authorization tokens (encrypted and stored securely)
2.4 Usage Data
- Pages visited and features used
- IP address and browser type
- Login times and session duration
- Alert notification history
3. How We Use Your Data
We use your data for the following purposes:
- Service delivery: To provide compliance monitoring, deadline alerts, and risk scoring
- HMRC integration: To fetch VAT obligations and verify tax filing status
- Notifications: To send email, SMS, and Slack alerts about upcoming deadlines
- Billing: To process subscriptions and manage payments via Stripe
- Support: To respond to your enquiries and provide customer support
- Security: To detect and prevent fraud, unauthorised access, and abuse
- Legal compliance: To comply with HMRC requirements and UK law
4. Legal Basis for Processing
We process your data under the following legal bases:
- Contract: Processing necessary for the performance of our service agreement with you
- Consent: Where you have given explicit consent (e.g., HMRC authorisation)
- Legitimate interests: Where processing is necessary for our legitimate business interests (e.g., security, analytics)
- Legal obligation: Where we are required to retain data by law (e.g., HMRC audit requirements)
5. Data Sharing
We share your data only with the following third parties:
- HMRC: When you authorise VAT or Corporation Tax integration, we share your VRN/UTR with HMRC to fetch obligations
- Stripe: For payment processing. Stripe processes card data and does not share it with us
- Companies House: We query public company data via their API
- Email providers: For sending compliance alerts (SendGrid or SMTP)
- Cloud hosting: Our infrastructure provider (data stored in the UK)
We do not sell, rent, or trade your personal data to third parties for marketing purposes.
6. Data Retention
We retain your data for the following periods:
- Account data: While your account is active, plus 7 years after closure (HMRC requirement)
- Company data: While you track the company, plus 7 years after removal
- HMRC tokens: Until you disconnect HMRC or delete your account
- Audit logs: 7 years from creation (HMRC requirement)
- Usage data: 2 years from collection
7. Data Security
We implement appropriate technical and organisational measures to protect your data:
- All data encrypted in transit (TLS 1.2+)
- Sensitive data encrypted at rest (AES-256)
- Passwords hashed with bcrypt
- HMRC tokens stored encrypted with unique keys
- Regular security audits and penetration testing
- Access controls and authentication for all systems
- Comprehensive audit logging of all API interactions
8. Your Rights
Under UK GDPR, you have the following rights:
- Right of access: Request a copy of the personal data we hold about you
- Right to rectification: Request correction of inaccurate or incomplete data
- Right to erasure: Request deletion of your personal data (subject to legal retention requirements)
- Right to restrict processing: Request that we limit how we use your data
- Right to data portability: Request your data in a structured, machine-readable format
- Right to object: Object to processing based on legitimate interests
- Right to withdraw consent: Withdraw consent at any time (e.g., disconnect HMRC)
To exercise any of these rights, contact us at support@complytrack.co.uk.
9. ICO Registration
Xtenalyze Ltd is registered with the Information Commissioner's Office (ICO) for data protection purposes. You can file a complaint with the ICO if you believe we have not handled your data correctly:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk
10. Cookies
We use the following cookies:
- Session cookies: Required for authentication and maintaining your login state
- Preference cookies: Remember your settings and preferences
We do not use advertising or tracking cookies. You can control cookies through your browser settings.
11. Children's Privacy
Our service is not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us immediately.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on our website. The "Last updated" date at the top of this page indicates when this policy was last revised.
13. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us:
Xtenalyze Ltd (trading as ComplyTrack)
Flat 307 Goldfinger Court, 23 Balladier Walk
London, E14 6UN
Email: support@complytrack.co.uk