Review status
This is a review draft. The Terms and registration interface link to this page, and the registration flow is designed to record the displayed policy version with customer acceptance. Registration is currently disabled while the policy review is open, so this draft is not yet effective. It has not been approved against the live provider and security configuration and does not authorise customer onboarding or live HMRC filings. A final version must be published and accepted before the related processing starts.
1. Parties and roles
- Legal name
- Iter Automation Consulting LTD
- Address
- 75 Avondale Road, CR2 6JF, United Kingdom
- Contact
- support@vatrail.uk
- Registration number
- 17541073
- Registered in
- England and Wales
This agreement is between Iter Automation Consulting Ltd, trading as VatRail (Provider), and the organisation that accepts VatRail's Terms (Customer). For personal data in accounting records processed on the Customer's documented instructions to provide VAT features, the Customer is controller and the Provider is processor. The Provider separately acts as controller for its own account administration, security, support, billing and legal-compliance information. Roles for any other data flow must be assessed before enabling it.
2. Instructions and confidentiality
The Provider will process Customer Personal Data only on documented instructions in the Terms, Customer configuration and use of the service, and specific support instructions. It will tell the Customer if it believes an instruction infringes data-protection law, unless law prohibits notice. People authorised to process the data will be subject to confidentiality duties and role-limited access.
3. Security
The Provider will maintain technical and organisational measures appropriate to the risk. Product design includes authentication, tenant separation, encrypted connections and protected provider credentials. Production configuration, access reviews, key management, logging, backup, incident response and independent assurance have not all been verified. A final accepted agreement must include a dated security schedule describing the controls actually operating.
4. Subprocessors
Only subprocessors in a final dated Schedule 2 may be authorised. The proposed process is at least 30 days' advance notice by email to the Customer's workspace owner, with 15 days to object on reasonable data-protection grounds. The parties will try to resolve an objection; if unresolved, the Customer may stop the affected feature or terminate the affected service without a termination fee, with a pro-rata refund for prepaid affected service. The Provider will impose equivalent protections on each approved subprocessor and remains responsible for its performance. These proposed periods and remedies are not yet an agreed customer promise.
5. Assistance and personal-data breaches
Taking account of the processing and information available, the Provider will reasonably assist with data-subject requests, security duties, impact assessments and regulator consultation. It will notify the Customer's registered workspace owner without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, share material facts as they become available, and cooperate with investigation and remediation. The Customer remains responsible for controller notifications required by law. The proposed contact route is support@vatrail.uk; the operational incident process still requires verification.
6. International transfers
The Provider will not make a restricted transfer unless instructed by the Customer and a valid adequacy regulation, appropriate safeguard or lawful exception applies. Where required, the parties will use the UK IDTA or UK Addendum and complete the applicable transfer risk assessment. Actual processing and support locations and safeguards must be verified and listed before the transfer begins.
7. AI-assisted review
The Provider will not use Customer Personal Data to train a general-purpose AI model. An AI-assisted review may process limited data only when requested for the Customer's VAT workflow, and only after the model provider, account settings, contract, locations, retention and transfer safeguards are verified. The production model gateway blocks requests while the legal/provider approval flag is false. AI output is advisory and requires human review.
8. Return and deletion
On termination, the Customer may export available data using the product export. The target is to return or delete processor-held Customer Personal Data within 90 days of a documented request, except for a legal retention duty or documented, proportionate legal-claims or security hold. Retained copies must be access-restricted and deleted when the reason ends. This is a target, not an implemented guarantee: the application currently retains VAT transactions, returns, submissions and an audit record after account deletion, and provider-copy and backup expiry have not been verified. The final agreement must state the implemented schedule.
9. Evidence and audits
The Provider will make information reasonably necessary to demonstrate compliance available and contribute to proportionate audits or inspections. The parties will agree confidentiality, scope, frequency, security and reasonable costs without obstructing a legally required audit.
Schedule 1 — processing
- Subject and duration: VAT service and related support for the term of the Customer's service, followed by the verified export, deletion, backup-expiry and lawful-retention periods.
- Nature and purpose: receive authorised accounting or imported data; organise records; calculate VAT working papers; support review, export and requested assistance; optionally perform scoped AI review if enabled. The initial HMRC integration is documented as sandbox-only.
- Data subjects: Customer users and people named in invoices, transactions, supplier/customer records or evidence imported by the Customer.
- Data types: names and business contact details; account, organisation and VAT identifiers; invoice/transaction references; financial and tax amounts; VAT treatment; connection identifiers; support/evidence content and audit events. Imported free text may incidentally contain other personal data. Special-category data is not requested.
- Customer obligations: establish a lawful basis and give required notices; limit imports to necessary information; configure authorised users; provide lawful instructions; respond to data-subject requests; and review calculations and decide whether to approve actions.
Schedule 2 — provider candidates, not approved
The project identifies AWS Lightsail, Cloudflare, Neon, Upstash, Resend, Microsoft 365, Anthropic, Stripe, Xero, Intuit QuickBooks, Sage and HMRC in code or deployment records. This is an investigation list, not proof that a provider is active or authorised. Resend Support confirmed on 10 November 2026 that its pre-signed GDPR Article 28 DPA applies to the VATrail Resend account from signup. Resend says the account itself is the customer and does not identify a company in the agreement; the account's governing copy is in Settings → Documents. This confirmation does not resolve whether Iter Automation Consulting Ltd is the contracting customer or whether the account is configured for live delivery. For Microsoft 365, the tenant's Data Location card states that certain Microsoft 365 Core Online Services Customer Data at rest is in the United Kingdom (“your Committed Geography”); this statement does not establish other Microsoft services or support access. Before customer data is processed, the final schedule must identify each active service and contracting entity, purpose/data, enabled status, processing and support locations, applicable contract/DPA, transfer mechanism, retention and change-notice route. See the Privacy Notice and provider review before relying on a provider list.
Completion conditions
This draft becomes effective only after final factual review, publication as part of the customer contract and recorded acceptance by an authorised customer before processing begins. Do not rely on it until the live provider register, transfer safeguards, security schedule, incident procedure, retention controls and export/deletion behavior are verified.