Onzli privacy policy

This policy explains what personal data Onzli collects, why we use it, who we share it with, how long we keep it and what rights you have. It applies to the Onzli service and its websites.

1. Who we are

Onzli is provided by Xalterra Ltd, a company registered in England and Wales under company number 11128001, whose registered office is at Unit 29 Highcroft Industrial Estate Enterprise Road, Horndean, Waterlooville, Hampshire, PO8 0BT. VAT number GB471179089. We are registered with the Information Commissioner's Office under registration number Z6646887.

In this policy "we" and "us" mean Xalterra Ltd, trading as Onzli. For anything about your personal data, contact privacy@onzli.com.

2. Our roles

We are the controller of:

the personal data of everyone who signs in to Onzli (account, sign-in and security data);
billing and payment records;
the fraud-prevention data we send to HMRC and keep with each submission;
all personal data in an individual account, meaning an account a person opens for their own tax as a sole trader or landlord.

We are a processor for the accounting and tax data that a business or organisation account puts into Onzli, including data read from accounting software it connects. That business is the controller of its data and we act on its instructions under our data processing terms. If your details appear in a business's accounting records (for example as one of its customers or suppliers), please contact that business first.

3. What personal data we hold

Account and sign-in data

Your name and email address.
A secure hash of your password. We never store your password itself.
Your authenticator app secret, stored encrypted, and your recovery codes, stored as hashes.
A session cookie that keeps you signed in, and the devices you have signed in from.
Your roles in each account you belong to.

Account details

For an organisation: its name, registered address, company number and VAT number.
For an individual account: your name, any trading name, your address and, if you are VAT-registered, your VAT number.

Tax and accounting data

Records you import from spreadsheets or read from connected accounting software, and how each one was categorised.
VAT returns, Income Tax quarterly updates and tax returns, approvals, HMRC's responses, receipts and calculations.
For Income Tax, your National Insurance number, stored encrypted and shown only partly hidden, and details of your income sources held by HMRC.
Access tokens for HMRC and for any accounting software you connect, encrypted with a key unique to your account.
When you upload a spreadsheet of totals, we read it and keep the figures and a fingerprint of the file, not the file itself.

Billing data

Payment references from Stripe, the last four digits and brand of your card, receipts and credit notes. Stripe holds your full card details; we never see them.

Security and audit data

An audit trail of actions taken in the service, which cannot be altered.
Service logs, which may include IP addresses and request identifiers. Passwords and tokens are never logged.

4. Where the data comes from

From you, when you sign up, sign in and use the service.
From the account you belong to, when another member invites you or enters data.
From your browser and device, for security and for the fraud-prevention data HMRC requires (section 6).
From HMRC, when we retrieve your obligations, income sources, calculations and receipts on your instruction.
From accounting software you choose to connect, such as Xero or ERPNext. We only ever read from it; we never create, change or delete anything in it. Some providers only let apps ask for full access when you connect; we still only read, and you can disconnect at any time, in Onzli or in that software.
From Stripe, about your payments.
From Cloudflare Turnstile, which tells us whether a sign-up or password reset looks automated.

5. Why we use it and our lawful basis

Purpose	Lawful basis
Creating and running your account and signing you in	Contract
Preparing, checking and submitting your VAT returns, Income Tax updates and tax returns	Contract
Sending fraud-prevention data to HMRC with every request	Legal obligation, and our legitimate interest in preventing fraud
Keeping a record of what was sent to HMRC, including the fraud-prevention data	Legal obligation, and our legitimate interest in being able to show what was submitted
Keeping the service secure, preventing misuse and investigating incidents	Legitimate interests
Keeping the audit trail	Legitimate interests
Taking payment and keeping receipts and credit notes	Contract and legal obligation
Service emails such as sign-in links, password resets, filing results and security notices	Contract

We do not send marketing emails. If we ever do, we will ask for your consent first and every email will let you unsubscribe.

6. HMRC fraud-prevention data

HMRC requires Making Tax Digital software to send fraud-prevention data with every request to its systems, so that HMRC can detect and prevent fraud against the tax system. We cannot submit anything for you without it. With each request we send:

your public IP address and port;
a random device identifier stored in your browser, which contains no personal details;
your browser type and operating system;
your screen and browser window sizes;
your timezone;
an identifier for your user account;
the times of your recent sign-in verification.

We keep the exact data sent with each submission alongside the submission record. We use it only to meet HMRC's requirements and to show what was sent if needed, never for marketing or profiling.

7. Who we share data with

We do not sell personal data. We share it only with:

HMRC, which receives your returns, updates and fraud-prevention data as a public authority;
IONOS, which hosts the service and stores our databases in Spain (EU);
SMTP2GO, which delivers service emails from its European servers;
our backup storage provider in the UK, which keeps encrypted backups;
Stripe, which processes payments;
Cloudflare, which delivers and protects our websites and app: all traffic between your browser and Onzli passes through Cloudflare's network, which also provides our domain name service and the Turnstile bot check on sign-up and password reset pages.

Accounting software you connect, such as Xero, is your own provider under your own contract; we read from it on your instruction. We may also disclose data where the law requires it, for example to a court, regulator or law enforcement body.

8. International transfers

Our hosting is in Spain and our email delivery uses SMTP2GO's European servers. UK adequacy regulations cover the EU, so no additional safeguards are needed for them. Our backups are kept in the UK.

Stripe and Cloudflare may process data in the United States, and Cloudflare's network handles traffic in data centres around the world. For them we rely on the UK Extension to the EU-US Data Privacy Framework. Where any provider processes data outside the UK or EU and is not covered by adequacy regulations or that framework, we use the UK International Data Transfer Addendum.

9. How long we keep data

Data	How long
Unfinished sign-ups	30 days
Sign-in and password reset links	Until they are used or expire
Account and sign-in data	While your account is open, then 30 days after it closes
Imported records and connected-software data	While your account is open, then 30 days after it closes, so you can download them
Returns, updates, HMRC receipts and the fraud-prevention data sent with them	6 years from the submission
Receipts and credit notes we issue to you	6 years
Audit trail	6 years
Service logs	90 days
Encrypted backups	Overwritten on a rolling cycle of up to 35 days

When an account is closed, its encryption keys are destroyed at the end of the 30 days, after which the data protected by them can no longer be read. Remember that you must keep your own tax records for as long as HMRC requires; download them before closing your account.

10. How we protect data

All connections are encrypted with TLS.
Each account has its own encryption keys, and secrets such as HMRC tokens are encrypted with AES-256-GCM.
Every sign-in needs a code from an authenticator app, and sending anything to HMRC needs a fresh code.
By default a second person approves a VAT return before it is sent; an account can instead choose single-person approval, which adds extra safeguards.
Each account's data is kept separate in the database, and our staff cannot see it.
Our staff use individual logins with two-step verification, access is limited to what their work needs, and any direct access to databases is logged with a reason.
Backups are encrypted.

No system is completely secure. If a breach puts you at high risk, we will tell you without undue delay.

11. Cookies and browser storage

We use one cookie, the session cookie that keeps you signed in. It is strictly necessary, so we do not ask for consent.

We also store in your browser the device identifier sent to HMRC, which notifications you have read, and your choice of light or dark display. Cloudflare Turnstile runs on the sign-up and password reset pages to protect them from automated abuse; it is necessary for security.

We do not use advertising or analytics cookies, or any third-party tracking.

12. Your rights

You have the right to access your personal data, to have it corrected, to have it erased where we do not need to keep it by law, to restrict or object to how we use it, and to receive it in a reusable format. An account admin can download all of an account's data from Settings > Download my data.

To use any of these rights, email privacy@onzli.com. We will reply within one month, or tell you if we need up to two more months for a complex request. We may need to confirm your identity first. If your request is about data a business holds in its own account, we will pass it to that business.

13. Complaints

Please contact us first so we can try to put things right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

14. Changes to this policy

We will update this policy when how we use personal data changes, and tell account holders about significant changes by email or in the service.

15. Contact

Privacy: privacy@onzli.com
Security: security@onzli.com
Support: support@onzli.com
Post: Xalterra Ltd, Unit 29 Highcroft Industrial Estate Enterprise Road, Horndean, Waterlooville, Hampshire, PO8 0BT