Who we are
1.1The website at usemannerist.com and the Mannerist service are run by W. Prendergast, Owner and Founder, a sole trader trading as Mannerist ("we", "us" or "our"). We are the controller of your personal information under UK data protection law. That law is the UK GDPR and the Data Protection Act 2018.
1.2You can contact us by email at [email protected]. The address is at the bottom of every page of the Website. Our business address is Mannerist, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA. We are in the process of registering with the Information Commissioner's Office (the "ICO") and will show our registration number here once we have it. The Data Protection (Charges and Information) Regulations 2018 require most organisations that handle personal information to pay the ICO a fee and be on its public register.
1.3Words used in this policy, such as "Service" and "Website", have the same meaning as in our Terms and Conditions.
What information we collect
2.1Account information. Your name, email address, a password (which we store only in a protected, scrambled form) and the type of business you run.
2.2Your records. The documents you upload, such as PDF files, CSV files, bank statements, receipts and invoices, and the figures we read from them, including income, expenses and transactions. These may contain details of other people, such as your customers, suppliers or tenants, and your own bank details.
2.3Tax information. The categories you confirm, the calculations the Service produces, and, when the HMRC features are available, identifiers that HMRC needs, such as your Unique Taxpayer Reference or National Insurance number. We ask only for what we need.
2.4Payment information. Card payments are taken by our payment provider, Stripe. We do not see or store your full card number. We receive limited details, such as the type of card, the last four digits and whether a payment succeeded.
2.5Technical information. Your IP address, the type of device and browser you use, your time zone, screen details, when you log in and how you use the Service. Section 4 explains why HMRC requires some of this.
2.6Messages. Anything you send us by email, including your name, your email address (so that we can reply) and your message.
Why we use your information
The law requires us to have a lawful basis for using your personal information. The table sets out ours.
| What we do | Lawful basis |
|---|---|
| Create and run your account, read your uploads, sort your figures and calculate your tax | Contract: it is needed to provide the Service you signed up for (Article 6(1)(b) UK GDPR) |
| Take payments and keep our own accounting and tax records | Contract, and legal obligation (Article 6(1)(b) and Article 6(1)(c) UK GDPR) |
| Send information to HMRC when you ask us to, once that feature is available | Contract (Article 6(1)(b) UK GDPR) |
| Keep the Service secure, prevent misuse and meet HMRC's conditions for approved software, including the device information in section 4 | Legitimate interests: running a secure service that HMRC will allow to connect (Article 6(1)(f) UK GDPR) |
| Answer your questions and fix problems | Contract, and legitimate interests (Article 6(1)(b) and Article 6(1)(f) UK GDPR) |
| Send you service messages, such as billing and security notices | Contract (Article 6(1)(b) UK GDPR) |
| Improve and fix the Service | Legitimate interests (Article 6(1)(f) UK GDPR) |
| Send you marketing emails | Consent only. We do not send marketing unless you have opted in, and you can withdraw consent at any time (Article 6(1)(a) UK GDPR. Email marketing is also covered by the Privacy and Electronic Communications Regulations 2003) |
HMRC and device information
4.1When the HMRC features are available and you ask us to send information to HMRC, we send the figures and identifiers that HMRC needs through its secure systems. HMRC then uses that information under its own privacy notice, which is published on GOV.UK.
4.2When you give us permission to act for you, HMRC gives us an access token. We store it in an encrypted form, use it only to act for you within the permission you gave, and delete it when you withdraw that permission or close your account. We never see or store your HMRC password.
4.3When you connect Mannerist to HMRC, HMRC requires us by law to send it fraud prevention information with every request we make to HMRC for you, not only when we send a submission. This information is: your IP address, the time we sent it, your browser and device details, your time zone, your screen and window sizes, a random device ID, and your Mannerist email address and account number. HMRC uses it to prevent fraud and to protect taxpayers' accounts.
Who we share your information with
5.1We share your information only with the following, and only as far as is needed:
- HMRC, when you ask us to send information, as described in section 4.
- Service providers that help us run the Service, who act only on our instructions and under a written contract. These are: Cloudflare, for hosting and file storage; Stripe, for taking payments; our email provider, for sending emails; and our document-reading service.
- Professional advisers, such as our accountants, lawyers and insurers, who are bound by confidentiality.
- Courts, regulators and law enforcement, where the law requires us to.
- A person or business that takes over the Service, in which case your information will remain protected by this policy.
5.2We do not sell your personal information to anyone.
5.3Messages from other companies and websites. We do not share your information with advertisers or other companies, so unwanted messages about Mannerist from other businesses, social media sites or other websites do not come from us, and we cannot control them. Social media and other websites collect information under their own rules, which you agree with them directly. If you see an advert for Mannerist on a social media site, it is the site that decides who sees it. If you choose to ask us for updates, for example by registering your interest, we will send them to you, and you can unsubscribe at any time.
5.4Emails we send you. We email you about your account and subscription: for example, a renewal that is coming up, a payment that has failed or been missed, a service that will be suspended until it is paid, and important changes to your terms or this policy. We do not send marketing emails unless you have asked for them, and you can unsubscribe from any marketing email at any time.
Transfers outside the UK
6.1Some of our service providers may handle information outside the UK, including in the United States. Where they do, we make sure it is protected by an appropriate safeguard, such as a UK adequacy decision, the UK International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses. These rules are in Chapter V of the UK GDPR.
How long we keep your information
7.1We keep your account information and records for as long as your account is open.
7.2After your account closes, you can export your records for 30 days. We delete your uploaded documents and records within 90 days of closure.
7.3We keep billing and accounting records, such as invoices and payment confirmations, for six years, because tax law and the time limits for legal claims require it. Tax records are kept because of the Taxes Management Act 1970, and six years is the usual time limit for a legal claim under the Limitation Act 1980.
7.4We delete HMRC access tokens when you withdraw permission or close your account. We keep security and technical logs for up to 12 months, and support messages for up to two years after we last deal with your query.
7.5You are responsible for keeping your own copies of the records that the law requires you to keep, for the period HMRC requires.
Keeping your information secure
8.1We protect your information with measures that include encryption when it is sent to and from the Website and when it is stored (your files are stored with Cloudflare), protected storage of passwords and access tokens, and limits on who can reach the information.
8.2No system is completely secure. If a breach puts your rights at risk, we will tell you and, where the law requires, the ICO, without undue delay. This is required by Articles 33 and 34 of the UK GDPR, which say we must tell the ICO within 72 hours of becoming aware of a breach that puts people's rights at risk.
Your rights
9.1Under UK data protection law you have the right to the following. These rights come from Articles 15 to 21 of the UK GDPR.
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information, in some circumstances;
- ask us to restrict how we use your information, in some circumstances;
- receive the information you gave us in a portable format;
- object to us using your information where we rely on legitimate interests;
- withdraw your consent at any time, where we rely on consent.
9.2We do not make decisions about you using solely automated means that have a legal or similarly significant effect on you. This is the rule in Article 22 of the UK GDPR.
9.3To use any of these rights, please email us at [email protected]. We may need to check your identity first. We will normally reply within one month and we do not usually charge a fee. The one-month time limit is in Article 12 of the UK GDPR.
Cookies
10.1Cookies are small files that a website stores on your device. We use only essential cookies and similar technology, such as those that keep you signed in and keep your session secure. The Service cannot work without them. The rules on cookies are in the Privacy and Electronic Communications Regulations 2003 (PECR). They allow cookies that are strictly necessary for a service you asked for without asking for your consent. We also store a random device ID in your browser's local storage. It is used only to send to HMRC, as HMRC requires, and not for tracking or advertising. It stays on your device until you clear your browser data.
10.2We do not use advertising or tracking cookies. Because the cookies we use are essential, we do not ask for your consent to them. You can block cookies in your browser settings, but if you do the Service will not work properly.
Changes to this policy and complaints
11.1We may update this policy from time to time. We will tell you by email about any change that matters to you, and the current version is always on the Website.
11.2If you are unhappy with how we have handled your information, please contact us first by email at [email protected] so that we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
The laws mentioned in this policy
12.1We have named the laws behind this policy so you can see what protects you and what we are required to do. You can read any of them for free at legislation.gov.uk. This list is a plain-English guide and is not legal advice.
12.2UK GDPR: the main UK data protection law. It sets out the lawful bases for using personal information, your rights, security, breaches and transfers abroad.
12.3Data Protection Act 2018: works alongside the UK GDPR and sets out the ICO's powers and how the UK GDPR applies in this country.
12.4Privacy and Electronic Communications Regulations 2003 (PECR): the rules on marketing emails and on cookies.
12.5Data Protection (Charges and Information) Regulations 2018: the rules on registering with the ICO and paying its fee.
12.6Taxes Management Act 1970: requires tax records to be kept, which is one reason we keep billing and accounting records.
12.7Limitation Act 1980: sets the time limits for bringing legal claims, which is one reason we keep some records for six years.
12.8Laws can change. If a change affects this policy, we will update it as described in section 11.
This policy was last updated on 4 November 2026. Questions about your data? Email [email protected]. See also our Terms and Conditions and Cookie policy.