Privacy notice
This notice explains how HM Revenue & Customs (HMRC) will use your personal data in relation to the UK Integrated Online Trade Tariff (OTT) service and associated services and features. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).
You should also read the main HMRC privacy notice alongside this service-specific notice:
How we use your data
HMRC collect and use your personal data to:
- provide support to users of the 'UK Integrated Online Tariff'
- send tailored tariff update alerts to registered users of the Stop Press Tariff Update notification service
- collect and analyse web analytics data to monitor and improve our services
The data we will process
For web analytics:
- cookie identifiers
- how you got to our service
- which links you click
- time spent on the service
For support:
- your name
- email address
- telephone number (if provided)
- details of your support issue
For the Stop Press Tariff Update notification service:
- your email address (used for registration and notifications)
- your selected preferences (e.g. tariff chapters you wish to be notified about)
The legal basis for processing your data
The legal basis for processing your personal data is:
- for web analytics: your consent, provided via cookie settings
- to support HMRC’s public task under UK GDPR Article 6 (1)(e)
Who we share your data with
Your data may be shared with:
- HMRC teams for service delivery and support
- our IT suppliers, including Transform UK Consulting Ltd, who help develop and support the Online Trade Tariff and any associated services
- GOV.UK Notify to send you notifications for services that you are registered for
- AWS Cognito to verify your identity during registration for OTT services, not limited to Stop Press Tariff Updates
All third parties are bound by strict contractual agreements and process your information only on HMRC’s instruction or agreement, under strict confidentiality and data protection requirements.
Data security
We take the security of your data very seriously. Our measures include:
- data is encrypted at rest and in transit using secure protocols
- stored securely in the UK using AWS infrastructure
- access limited to authorised personnel and contractors
- regular audits, access controls, and incident response processes
- third-party providers are certified to standards including ISO27001 and Cyber Essentials
Data retention
Web analytics data is retained in line with our cookie policy and support request are retained as long as needed to provide the service. Stop Press Tariff update notification user records are retained only while your subscription is active. If you unsubscribe, your data will be deleted immediately. If you do not complete registration, your data will be deleted after three months. For further information, please refer to HMRC's records management and disposal policy.
Your rights
Under the UK GDPR, you have the right to:
- request access to the personal data we hold about you
- request that we correct or update inaccurate or incomplete data
- request deletion of your data where there is no legal justification to keep it
- object to or restrict the processing of your data in certain circumstance
- withdraw your consent for processing, where applicable (e.g. for analytics)
You can manage your Stop Press Tariff Update notification preferences or unsubscribe at any time via links included in each notification email or by logging into the secure service and via the manage preferences feature.
For more on your individual rights or how to make a subject access request, see the main HMRC privacy notice.
International transfers
- GOV.UK Notify processes email data using servers located in Ireland, which is recognised as an adequate country under UK data protection law
- where applicable, international transfers are covered by appropriate safeguards, such as Standard Contractual Clauses
Contact HMRC or make a complaint
If you have questions and concerns about how your data is handled, you can contact the Data Protection Officer or make a complaint to HMRC. For details of how to do this refer to the relevant section of the HMRC privacy notice.