Privacy Policy

Scope and Data Protection Roles

This policy applies to the Sysware mobile application, website and associated services.

The organisation that provides your account normally decides why and how business and employee information is used and is therefore the data controller for that information.

The operator of Sysware generally acts as its data processor and follows the organisation's documented instructions.

Information We Process

Account and Identity Information

• Name
• Business email address
• Telephone number
• Role
• Login identifiers
• Account status
• Company identity and registration details
• Business address
• VAT registration number

Business and VAT Records

• Sales and purchases
• Invoices and credit notes
• Expenses and income
• Payment records
• VAT adjustments
• Customer and supplier information
• Product and stock information
• Ledger and financial-year information
• VAT return calculations and submission status
• VAT obligations, liabilities and payment information

Technical and Security Information

• IP address
• Device and browser information
• Operating system
• Timestamps
• Authentication activity
• Security logs
• Diagnostic information
• HMRC-required fraud-prevention information where applicable

We do not intentionally request special-category personal information. Users should not enter such information unless it is necessary, lawful and authorised by their organisation.

How We Use Information

• Provide, maintain and support VAT, accounting and reporting functions.
• Authenticate users and apply permissions.
• Protect accounts from misuse.
• Calculate VAT figures from records supplied by authorised users.
• Connect to HMRC services when authorised by the user.
• Diagnose faults and monitor service reliability.
• Prevent fraud and maintain audit records.
• Meet legal, regulatory, contractual and tax obligations.
• Communicate service, security and support information.
• We do not sell personal information. We do not use business VAT records for third-party advertising.

HMRC Integration

When an authorised user connects Sysware to HMRC, the user is redirected to HMRC to sign in and grant permission.

Sysware does not receive the user's HMRC password.

HMRC may provide access and refresh tokens, VAT obligations, return information, liabilities, payments and submission responses required to provide the requested functionality.

Tokens are used only to perform authorised HMRC operations and are stored with appropriate security controls.

Users or account administrators can disconnect the HMRC integration.

Lawful Bases

Depending on the circumstances, processing is based on performance of a contract, compliance with legal obligations, legitimate interests in operating and securing the service, or consent where legally required.

Organisations using Sysware are responsible for establishing their own lawful basis for information they enter into the service.

When Information Is Shared

Information may be shared with:

• HMRC, when an authorised user connects or submits VAT data.
• Infrastructure and hosting providers.
• Communications and monitoring providers.
• Professional service providers acting under appropriate obligations.
• Authorised administrators and users within your organisation.
• Regulators, courts or law enforcement where legally required.

Service providers receive only the information reasonably necessary for their function and may not use it for unrelated purposes.

Data Retention and Deletion

Information is retained for as long as the account is active and as needed to provide the service.

Business, VAT, accounting, security and audit records may be retained longer where required by UK tax law, regulatory obligations, dispute resolution, fraud prevention, backups or contractual commitments.

Account deletion requests should normally be made through the organisation that controls the account.

Security

We use proportionate technical and organisational safeguards, including access controls, authentication, encrypted network transport, permission separation, logging and operational monitoring.

No internet service can guarantee absolute security. Users must protect their credentials, use secure devices and promptly report suspected unauthorised access.

Your UK Data Protection Rights

Subject to applicable law, you may have rights to access, correct, erase or restrict personal information; object to certain processing; receive portable information; and complain to the UK Information Commissioner's Office.

Where your organisation controls the information, submit your request to that organisation first.

Mobile App and Device Access

The mobile app uses network access to communicate with Sysware and HMRC-connected services.

Depending on enabled features, the application may request access to files, images or the camera only when needed to upload business documents or capture permitted content.

Permission can be denied or withdrawn in device settings, although the related feature may then be unavailable.

The app does not use precise location, contacts, microphone or advertising identifiers unless a future feature clearly requests them and this policy is updated before use.

International Transfers

Where a service provider processes information outside the United Kingdom, appropriate safeguards will be used as required by UK data protection law.

Children

Sysware is a business service and is not directed to children. Users must be authorised by their organisation and legally capable of using the service.

Changes to This Policy

We may update this policy to reflect legal, technical or service changes. The revised version will be published here with a new "Last updated" date.

Material changes may also be communicated through the service or the account contact.

Contact

For privacy questions or requests, contact your organisation's account administrator or use the support contact supplied with your Sysware account or service agreement.

Please do not send passwords, authentication tokens or unnecessary financial records in a support request.