Fylix Privacy Policy

Skyie Global InfoTech Ltd, registered in England and Wales, company number 17294509. Registered office: Unit 37B, Alpha House, 100 Borough High Street, London, SE1 1LB, United Kingdom.

We are the controller for information we use to manage Fylix accounts, provide support, administer our relationship with customers and protect the service. Contact [email protected], or write to our registered office, for privacy enquiries.

If an accountant or another organisation gives you access to Fylix or manages your records, that organisation may be the controller for the client information it places in the service. We process that information on its instructions under the applicable service and data-processing agreement. Its privacy notice also explains how it uses your information. HMRC is responsible for information it receives and uses for its own statutory functions.

We receive information from you, from people you authorise to work on your account, and from HMRC where a connection is available and authorised. The information depends on the features you use.

• Account and contact information: name, email address, account role, organisation and client details, and correspondence with support.
• Tax and financial records: taxpayer references, National Insurance numbers, business and property details, income, expenses, transactions, supporting documents, calculations and submission receipts.
• Connection and security information: HMRC authorisation tokens, account and session identifiers, passkey public credentials or password hashes where applicable, verification events, IP addresses, browser information and audit records.
• Billing and correspondence information: the contact, subscription, invoice and payment-status details needed to administer your service.

Passkey biometric verification takes place on your device; Fylix does not receive your fingerprint or face image. Do not upload unrelated sensitive information or another person's records unless you have authority to do so.

We use account, contact and record information to provide the service you request, maintain your records, support exports and answer enquiries. Where you contract with us as an individual, this processing is necessary to perform our contract or take steps at your request before entering it. For business contacts, our legitimate interest is administering and supporting the organisation's service.

We use security and audit information for our legitimate interests in preventing misuse, controlling access, investigating incidents and maintaining a reliable service. We consider the effect on your rights when relying on legitimate interests.

We process information where necessary to meet legal obligations, including applicable fraud-prevention requirements, tax and accounting duties, and valid legal requests. We use consent where required for optional marketing or non-essential tracking; you can withdraw that consent without affecting earlier lawful processing. HMRC connection permission controls access to HMRC services and is separate from consent for marketing.

When we process client records for an accountant or other business, that controller determines the purposes and lawful basis. Information needed for sign-in, security or an authorised HMRC transaction is necessary for that feature; without it we may be unable to provide the feature.

Connecting Fylix to HMRC uses HMRC's authorisation process. We hold the resulting tokens to carry out the permitted requests; you should enter HMRC sign-in details only on HMRC's own service. An agent also needs the appropriate authority to act for a client. You can revoke software permission through HMRC and disconnect the integration in Fylix.

HMRC requires fraud-prevention header data with Making Tax Digital Income Tax and VAT API calls. For our browser-based service this includes your public IP address and connection port, browser user-agent, device identifier, screen and window dimensions, time zone, account identifiers, verification-method information and timestamps, and relevant software, licence and server-connection details. Fylix collects this information from the browser, authenticated session and service infrastructure and sends the required values to HMRC with the request. It does not send your password, one-time authenticator code or biometric image as fraud-prevention data.

This information is used for fraud prevention and the protection of tax information, not as optional advertising tracking. HMRC explains its requirements at https://developer.service.hmrc.gov.uk/guides/fraud-prevention/.

Sandbox testing uses synthetic test accounts and is separate from live tax filing. Live submission is available only for functionality for which production access has been granted and enabled, and after the relevant customer or agent authorisation.

Access within our organisation is limited to people who need it to operate, support or secure the service. We do not sell customer records.

• HMRC receives authorised tax requests and submissions, together with required fraud-prevention information.
• Infrastructure services support hosting, network security and document storage. Our application uses Contabo-hosted infrastructure and Skyie Vault storage services; Cloudflare supports delivery and protection of our public web services.
• Our transactional email service and mailbox providers handle account messages, support correspondence and delivery information. Skyie email services and Microsoft-hosted organisation mailboxes are used for these communications.
• A payment provider may process a payment when you choose an available paid service; the payment flow identifies the provider and its privacy information.
• Professional advisers, regulators and other authorities may receive information where necessary for a legal obligation, a dispute or the protection of legal rights.

An integration only receives information relevant to the function you use. Where a provider processes information on our behalf, the applicable data-processing terms govern that use. Ask us for details of the providers involved in your service.

Fylix uses access controls, encrypted HTTPS connections, protected authentication tokens, verification for sensitive actions and audit records. These controls reduce risk; no online service can guarantee that an incident will never occur. Protect your sign-in credentials and contact us promptly if you suspect unauthorised access.

Information is held in our application databases, document storage, operational records and service correspondence. Infrastructure and communications providers may process information in more than one country, including through network delivery, support or administration. We do not promise that every processing activity stays in the UK.

Where a restricted transfer outside the UK is involved, it must be covered by an applicable UK adequacy regulation or another lawful safeguard, such as an International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as appropriate. Contact us for the processing locations and safeguards relevant to your data, and how to obtain a copy of the applicable safeguards.

Retention depends on the information's purpose, the service agreement, applicable tax and accounting record-keeping requirements, and any need to investigate an incident or establish or defend a legal claim. There is no single HMRC retention period applying to every item of personal data.

Account and service information is needed while the service is used and for the period necessary to close the account, resolve outstanding matters and meet applicable obligations. Security logs are retained according to their investigation and audit purpose. Client tax records processed for a business are subject to that controller's instructions and applicable legal requirements. Backups and correspondence may have different retention arrangements from the live application.

An erasure request is reviewed; submitting it does not instantly delete all records. We explain what can be removed, what must be retained, and the reason and applicable period or criteria. Where no purpose or obligation justifies keeping personal information, it should be deleted or anonymised. Contact us for the retention position for a particular record or account.

Depending on the circumstances, you can request access to your personal information, correction, erasure, restriction of processing and portability, and object to processing based on legitimate interests. You may withdraw consent where we rely on it. These rights have legal limits; for example, an erasure request does not override a requirement to retain a particular record.

Email [email protected] or write to our registered office. We may need information to verify your identity. We respond without undue delay and normally within one month; if a lawful extension is needed, we explain it within that period. If we hold client data on another controller's instructions, we will direct your request to that controller or assist it as appropriate.

You can also complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. You do not have to raise a complaint with us first.

Fylix uses browser storage and cookies for functions such as sign-in, security and preferences. The Fylix Cookie Policy at https://fylix.co.uk/legal/cookie-policy provides further information. Optional non-essential tracking requires the appropriate information and choice before it is used.

Software can calculate, organise and validate figures, but Fylix does not make a solely automated decision with a legal or similarly significant effect about you. A calculation is not a tax assessment or professional advice. Review records and declarations before submitting them.

The service is intended for users aged 18 or over. An authorised professional may handle records relating to another person where there is a lawful reason, but children should not create their own Fylix accounts.

We update this policy when the service or relevant practices change and identify the revision date above. Material changes will be brought to customers' attention through the service or an appropriate communication. Publication of a privacy notice does not by itself create consent for a new use of personal information.

Fylix | Skyie Global is a product of Skyie Global InfoTech Ltd, registered in England and Wales, company number 17294509. Registered office: Unit 37B, Alpha House, 100 Borough High Street, London, SE1 1LB, United Kingdom.

Privacy and service enquiries: [email protected]. Organisation website: https://skyieglobal.co.uk. Product website: https://fylix.co.uk.