Privacy Policy

1. Introduction & Data Controller

Unforgettable Management Ltd ("we", "us", "our") is committed to protecting and respecting your personal privacy. This Privacy Policy explains how we collect, process, store, and protect your personal and financial information when you use 123accounts.co.uk.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), the Data Controller responsible for your personal data is Unforgettable Management Ltd.

2. The Information We Collect

We process the following categories of data:

3. Lawful Basis for Processing

Under UK GDPR Article 6, we rely on the following lawful bases:

• Performance of a Contract: Providing you with the bookkeeping service, calculating your tax pot, generating SA103 reports, and executing your user registration.
• Legal Obligation: Complying with UK statutory requirements, HMRC digital transmission audit standards, and record retention directives.
• Legitimate Interests: Protecting the security of our platform against unauthorised access, diagnosing technical defects, and improving rule learning performance.
• Consent: Explicitly obtained before initiating OAuth2 linking with HMRC Making Tax Digital servers or sending direct marketing.

4. How We Use & Protect Your Financial Data

• Strict Confidentiality: We never sell, rent, monetize, or share your financial data or transaction history with advertisers, third-party brokers, or predatory lenders.
• HMRC Submissions: Financial data is only transmitted to HMRC when you explicitly initiate a submission action in the MTD Hub.
• Encryption & Security: All traffic is transmitted using TLS 1.3 encryption. Passwords are never stored in plain text and are hashed using bcrypt. Sensitive HMRC tokens are securely managed.
• Data Hosting: All customer data is hosted in secure, isolated European/UK server infrastructure complying with ISO/IEC 27001 standards.

5. Data Retention

HMRC requires UK sole traders to keep business records for at least 5 years after the 31 January submission deadline of the relevant tax year. Accordingly, we retain your bookkeeping and transaction records for as long as your account remains active. If you delete your account, you can download a full backup export, after which your account data will be permanently wiped from our active databases within 30 days.

6. Your Rights Under UK GDPR

Under UK data protection laws, you possess the following statutory rights:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can update or amend inaccurate details directly in your Settings tab.
• Right to Erasure (Right to be Forgotten): You can request the deletion of your account and records.
• Right to Data Portability: You can export all your transactions and reports in machine-readable CSV format at any time.
• Right to Restrict or Object: You may object to certain forms of data processing.

To exercise any of these rights, please contact our Data Protection Officer at [email protected].

7. Cookies Policy

123accounts uses only essential, strictly necessary HTTP-only session cookies (123accounts_session) to maintain secure user login states and CSRF defenses. We do not use third-party invasive cross-site tracking cookies or advertising pixels.

8. Supervisory Authority & Complaints

If you have concerns about our information rights practices, you have the right to lodge a complaint with the UK data protection supervisory authority: