Your information.
Handled carefully.

1. Who is responsible for your information?

SMRC PAY LTD, company number 17499973, is registered in England and Wales and operates smrc-pay.com and SMRC Pay software. In this policy, “SMRC”, “we”, “us” and “our” mean SMRC PAY LTD.

We are normally the data controller for information used to run this website, administer licences, process orders, provide support and manage our business. An employer, payroll bureau, accountant or agent is normally the controller of employee and payroll information entered into SMRC Pay. If we handle that information only on the customer’s documented instructions, we act as a data processor.

2. What this policy covers

This policy applies to visitors, prospective customers, licence holders, authorised users, business contacts and people who contact support. It covers the website, desktop software, activation, updates, ordering, support and any online service we clearly identify as an SMRC service.

It does not replace the privacy information an employer, bureau or agent must give to employees, workers, pension members, contractors or other individuals whose data they process.

3. Information we collect

Customer and business information

• Name, business name, role and contact details.
• Licence edition, activation reference, order, invoice and payment-status information.
• Support requests, correspondence, feedback and records of how an issue was resolved.
• Product version, operating system, device identifiers and diagnostic information needed to activate, secure or support the software.
• Website information such as IP address, browser type, requested pages, dates, times and security events.
• Communication choices, including whether you asked to receive or stop receiving product news.

Payroll information held by customers

Depending on how a customer uses the software, a local payroll file may contain names, addresses, dates of birth, National Insurance numbers, tax codes, PAYE references, earnings, deductions, pensions, benefits, statutory payments, bank details, CIS records, payslips, P45s, P60s, reports and audit history. SMRC does not routinely receive that local database.

Information we do not want by ordinary email

Do not email payroll databases, employee identity documents, card details, passwords, OAuth tokens, Government Gateway credentials or unredacted high-risk records. If an investigation genuinely requires a file, we will agree a suitable transfer method and the minimum information needed.

4. Local payroll files and optional online activity

Information leaves the local environment only where the user takes a clear action, for example activating a licence, checking for an update, sending an authorised submission, using a future online feature or supplying information for support. The relevant screen should identify the purpose before data is sent.

5. Where information comes from

We receive information directly from you, from an organisation that authorises you to use the software, from website and software security logs, from payment and email providers, and from public sources where needed to verify a business or meet a legal duty. A customer may also provide limited information about another person when asking for support; the customer must have authority to do so.

6. Why we use information and our lawful bases

Where we rely on legitimate interests, those interests include operating a secure software business, preventing misuse, supporting customers, improving reliability and keeping appropriate business records. We consider the likely effect on the people concerned before relying on this basis.

7. Sensitive payroll information

A payroll file may indirectly reveal health, maternity, family leave, bereavement, trade-union or other special-category information. The customer, as controller, is responsible for identifying an Article 6 lawful basis and any required Article 9 condition under the UK GDPR. SMRC will not use customer payroll content for advertising or unrelated profiling.

8. HMRC and fraud-prevention information

HMRC may require software making certain API requests to send fraud-prevention headers. For an applicable production connection, SMRC will send only the values required for the request and will document them on the HMRC Data page. These may include limited device, network, operating-system, product-version and user-context information. Passwords, access tokens and raw activation keys are not part of those headers.

Live HMRC filing will remain unavailable until the relevant connection, testing, authorisation and fraud-prevention requirements are complete.

9. Payments

Card payments will be handled through a payment provider when checkout becomes available. SMRC will receive transaction status and reference information needed to fulfil and reconcile the order, but will not ask for card details by email or store the full card number or security code in the website application.

10. Who we share information with

We disclose information only where there is a business or legal reason. Recipients may include hosting, email, payment, licensing, security, backup and customer-support providers; HMRC or another authority where the customer authorises a submission or the law requires disclosure; professional advisers, insurers, auditors, courts and law-enforcement bodies; and a genuine buyer or successor if the business is reorganised or sold.

Providers acting for us are expected to use information only for the agreed service, protect it appropriately and delete or return it when their work ends. We do not sell or rent personal information.

11. International transfers

If a supplier processes personal information outside the UK, we will check the destination and use an available lawful safeguard. Depending on the circumstances, this may be UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to approved standard contractual clauses. You may ask us for information about the safeguard used for your data.

12. How long we keep information

These periods may be shortened where the information is no longer needed or extended where law, litigation, fraud prevention or a regulator requires it. Customers decide how long locally held payroll files are retained and must apply their own employment, tax and data-protection obligations.

13. Security

We use measures proportionate to the information and risk, including access controls, least-privilege permissions, encryption in transit for approved online services, secure development and update practices, logging, backups, vulnerability management and incident procedures. No system can be guaranteed completely secure, so customers must also protect their Windows accounts, devices, exports and backups and install trusted updates.

14. Your data-protection rights

Depending on the lawful basis and circumstances, you may have rights to be informed; obtain a copy of your information; correct inaccurate information; ask for erasure or restriction; receive certain information in a portable format; withdraw consent; and challenge qualifying solely automated decisions.

To make a request, email admin@smrcpay.co.uk. We may need reasonable proof of identity and authority. We normally respond within one month. If the information sits only in an employer’s or bureau’s local payroll file, contact that organisation first because it is normally the controller.

15. Automated decisions

The public website does not make decisions about people based solely on automated processing that produce legal or similarly significant effects. Payroll calculations follow data, settings and rules selected by the customer; the customer remains responsible for checking and approving the result.

16. Marketing and cookies

Service messages about an order, licence, security issue or material product change are not marketing. Optional marketing can be stopped using the method provided in the message or by emailing us. We may keep a minimal suppression record so the request is respected.

The website may use cookies or similar storage that are strictly necessary for security and core operation. Non-essential analytics or advertising technologies will not be used before any consent required by law, and it will be as easy to reject them as to accept them.

17. Children

SMRC products and this website are intended for businesses and adult users. We do not knowingly market to children or ask children to create accounts. Employee data relating to a young worker may be held in a customer-controlled payroll file where the employer has a lawful reason to process it.

18. Data incidents

We investigate suspected loss, unauthorised access or disclosure and take steps to contain the issue. Where we act as processor, we will notify the relevant customer without undue delay. Where we act as controller, we will notify the ICO and affected individuals when the law requires it.

19. Questions and complaints

Please contact us first so we can investigate. You also have the right to complain to the Information Commissioner’s Office. Details are available through the ICO’s data-protection complaints service.

20. Contact and policy changes

We will update this policy when our products, suppliers or legal obligations change. The effective date and version at the top show when the current policy took effect. If a change materially affects how we use existing information, we will provide an appropriate notice before the change applies.