NoticeDeskBuilt for UK VAT · Notice 700 checks · exports to your accounts package
NoticeDesk
See pricing Open NoticeDesk
Legal

Privacy Notice

Written in plain English on purpose. This notice explains what personal data NoticeDesk collects, why, who we share it with, and the rights you have under UK data protection law.

Last updated: 28 September 2026

Who we are

NoticeDesk is operated by NoticeDesk Ltd, a company incorporated in England & Wales (company number 17383909; registered office 64 Liberty Lane, West Bromwich, England, B70 0FL) ("NoticeDesk", "we", "us"). We are the data controller for the personal data described in this notice. For any privacy question or to exercise your rights, contact [email protected].

What we process

We keep data collection to the minimum needed to run the service:

  • Account data: your email address, workspace name, role, and sign-in events.
  • The invoices you upload (PDFs and images) and the structured data we extract from them. Invoices may contain business contact details of your suppliers (company name, address, and occasionally a contact name). We process these only because they appear in the documents you choose to upload.
  • Compliance results: the checks we run on each invoice and their outcomes.
  • Security & audit data: IP address, user agent, and a log of actions taken in your account, for security and fraud prevention.
  • Usage analytics: how the product is used (pages viewed, features used) and how the site performs (page-load timings), collected in a privacy-preserving, cookieless way to improve the service. The Cookies & tracking section below says exactly what each of our two analytics tools does and does not collect.

We do not process special-category data, and we do not knowingly collect children's data: NoticeDesk is a business product. We do not run advertising trackers, and we never sell or share your data for marketing.

Payment data

We never see your full card number and we do not store your card details. Payments are processed by Paddle (Paddle.com Market Ltd), who handle our billing and act as an independent controller for the payment data you give them. See Paddle's Buyer Terms and privacy notice. We receive from Paddle only what we need to run your account (your subscription status, plan, and transaction records), never your full card number. Paddle's payment notifications to us can also carry a card's type, its last four digits, its expiry date and the name on it, a PayPal email address and billing agreement reference, or a South Korean local card's type and last four digits and which Korean card or wallet paid: we remove those before we store a notification, and we never use them.

Why we process it, and our lawful basis

  • To provide the service (your account, extractions, history, VAT-period rollups): performance of a contract (UK GDPR Art. 6(1)(b)).
  • Supplier details inside your invoices: legitimate interests (Art. 6(1)(f)): business contact data processed to deliver the service you asked for.
  • Security, fraud prevention and audit logging: legitimate interests, and legal obligation where applicable.
  • Product analytics and website traffic/performance analytics: legitimate interests in understanding and improving the service, using privacy-preserving (cookieless) analytics.
  • Service and billing emails: contract / legitimate interests.

How extraction works

  • Uploaded files are sent to a third-party AI provider (Google Gemini, paid tier) for extraction. Under Google's terms for this paid tier, your content is not used to train Google's models, and we do not permit our AI provider to use your documents to train models.
  • Uploaded files are deleted from our servers after successful processing. If an extraction fails, the file is kept so the failure can be diagnosed, then removed under our retention schedule (currently up to 90 days).
  • Extracted data and compliance results are stored in your workspace so your history, edits and VAT-period rollups work.
  • Supplier VAT numbers on your invoices are checked against the register that owns them as part of the compliance checks: EU numbers against the European Commission's (VIES) public VAT registration service, GB numbers against HMRC's Check-a-UK-VAT-number service. A lookup that cannot be completed is recorded as unverified.

Where your data lives & international transfers

The application is hosted in London and the database is hosted within the EU (Frankfurt). Our AI extraction provider (Google) currently processes invoice content in the United States; that transfer relies on Google's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. We plan to move extraction processing to an EU region. All traffic is encrypted in transit and access to production systems is restricted.

How long we keep it

  • Account & extraction data: for as long as your account is active. You can remove any extraction from your history at any time; a removed item is excluded from your views and rollups straight away, and its extracted contents (the supplier, amounts, VAT number and line items we read from the document, and the name of the file) are removed from our database within 90 days of deletion. A record that the extraction existed is kept for the audit trail, without those contents. On request we will delete your account and its associated data.
  • Security & audit logs: retained for up to 7 years, for security and because they support our customers' HMRC record-keeping, then deleted.
  • Backups: cycled and deleted on a rolling schedule, so a deletion may persist in a backup for a short period before the backup is overwritten.
  • Uploaded files: deleted after successful processing (kept on failure for diagnosis, up to 90 days).

Your rights (UK GDPR)

You have the right to access, correct, delete, restrict, or object to our processing of your personal data, and the right to data portability. To exercise any of these, email [email protected] and we will respond within one month. On request we will delete your account and its associated data (subject to any records we must keep by law, such as the audit-log period above). For billing or account questions, contact [email protected].

If you're unhappy with how we've handled your personal data, you can complain to us at the same address. We'll acknowledge your complaint within 30 days and respond without undue delay. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to put things right first.

Changes to this notice

If we make a material change, we'll update the date above and, where appropriate, tell you in the app or by email.