Privacy Policy

1. Who we are

Obentric is a product of Tech Premier Limited, a company registered in England and Wales (Company No. 14515262), headquartered in Leeds, UK. We are the data controller for information collected through obentric.com and the Obentric platform. If you have questions about this policy, contact us at privacy@obentric.com.

2. What we collect

We collect information you provide when registering (name, email, company details) and information you enter while using the platform (business transactions, employee records, payroll data, VAT returns). We also collect:

• Usage data (pages visited, features used, session duration)
• Technical data (IP address, browser type, device identifiers) for security and performance
• Device and connection information submitted to HMRC as fraud prevention headers, as required by UK law (Making Tax Digital)

3. How we use your data

Your data is used to:

• Provide and operate the Obentric platform
• Process payments via Stripe
• Submit VAT returns and other required data to HMRC via Making Tax Digital on your behalf, when you authorise us
• Send service communications (invoices, security alerts, product updates)
• Comply with UK legal obligations including HMRC reporting requirements
• Improve platform features through anonymised usage analysis

4. HMRC data sharing

When you connect your HMRC account via Making Tax Digital, Obentric will transmit your VAT return data, fraud prevention headers (including device and IP information), and account identifiers to HMRC on your behalf. This transmission is required by law and cannot be disabled. The data is sent directly to HMRC's API and is governed by HMRC's own privacy notice. Obentric servers are located in the United Kingdom.

5. Data retention

We retain your data for as long as your account is active and for 7 years thereafter to comply with UK accounting and tax regulations (Companies Act 2006 and HMRC requirements). You may request early deletion of non-statutory data at any time.

6. Your rights under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data where legally permissible
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, at any time

To exercise any of these rights, email privacy@obentric.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Third-party processors

We do not sell your data to third parties.

8. Cookies

We use essential session cookies to operate the platform and optional analytics cookies to understand usage. We do not use advertising cookies or share data with advertising networks. You can manage cookie preferences in your account settings.

9. Security

All data is transmitted over HTTPS. Passwords are hashed using bcrypt. Access to production systems is restricted to authorised personnel. We conduct regular security reviews and promptly address vulnerabilities. In the event of a data breach affecting your rights, we will notify you and the ICO within 72 hours as required by UK GDPR.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app banner. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.