How it worksFeaturesPricingFree toolsFAQLog in

Legal

Privacy policy

Last updated September 2026.

Who we are

MALDEN LTD, trading as Quarterwise, is the data controller for the personal data you provide, and we are responsible for keeping it safe. We are a company registered in England and Wales (company number 11672272), with our registered office at 20–22 Wenlock Road, London, England, N1 7GU. Your data is hosted on servers in the UK (London). Malden Ltd is registered with the Information Commissioner's Office (ICO) under registration reference ZC165459.

What we collect

  • Account details: your name and email address.
  • Tax records: properties, rental income, expenses, receipts and documents you enter.
  • Identifiers needed to file with HMRC, such as your National Insurance number, handled securely and encrypted at rest.
  • Technical data needed for HMRC's fraud-prevention requirements when you submit.

How we use it

To run your account, prepare and submit your MTD updates and tax return to HMRC, send service emails and deadline reminders, and provide support. We do not sell or share your data for marketing.

We use AI to suggest an expense category from the description you enter for a transaction. You review and confirm these suggestions before anything is filed; they are not automated decisions that produce legal or similarly significant effects.

Analytics

We measure how our website is used with our own privacy-friendly, server-side analytics. It sets no cookies and stores no personal data: we don't store your IP address — it's used only momentarily to generate a daily, anonymous visitor count that can't be linked back to you or across days. Because it's anonymous, it doesn't require consent. If you accept analytics cookies, we additionally use Google Analytics; you can decline that at any time from our cookie settings.

Who we share data with

We do not sell your data. We share it only with trusted service providers who help us run Quarterwise — for hosting and storage, billing, email, AI categorisation and security — under contracts that require them to protect it and use it only on our instructions.

Your core tax records are stored in the UK. Some of these providers may process limited data outside the UK; where that happens we rely on appropriate safeguards, such as UK adequacy regulations or the UK International Data Transfer Agreement. We also transmit the figures you approve, together with HMRC's required fraud-prevention data, to HMRC when you submit.

If you invite an accountant or adviser to your account, we show them the records you choose to share: your properties, entries, receipts, documents and filing status. You decide whether they can only view or also add entries, and you can remove their access at any time from your account settings. Advisers never see your National Insurance number in full and cannot connect to HMRC or submit on your behalf.

Our lawful basis for processing

Under the UK GDPR we rely on the following lawful bases:

  • Performance of a contract — to provide the service you sign up for: running your account, keeping your property bookkeeping, and preparing and submitting your figures to HMRC at your request.
  • Legal obligation — to collect and send the fraud-prevention data that HMRC's Making Tax Digital service legally requires on every submission, and to keep records for as long as tax law requires.
  • Legitimate interests — to secure the service, prevent fraud and abuse, send essential service messages, and provide support. We balance these against your rights.
  • Consent — for any optional marketing communications, which you can withdraw at any time. We do not currently use your data for marketing.

How long we keep it

We keep your data for as long as your account is active. When you ask us to delete your account it is locked at once and permanently deleted fourteen days later; the fourteen days exist so a mistaken request can be reversed by contacting support, and nothing in the account can be seen or changed during them. After deletion we retain only the records of submissions made to HMRC on your behalf, together with the minimum metadata needed to identify them (your name, email address, encrypted National Insurance number and the dates your account was opened and closed), for as long as tax law requires, after which they are deleted.

Security

Data is encrypted in transit (TLS) and at rest. Your National Insurance number and your HMRC access tokens are encrypted with AES-256-GCM. Access is restricted and logged. If a personal-data breach occurs, we will notify the ICO and affected customers without undue delay (within 72 hours where required), and HMRC as our API provider.

Your rights

You can access, correct, export or delete your data at any time. From your account you can export everything we hold as a file and delete your account (locked at once, permanently deleted after fourteen days). We also close accounts nobody has signed in to for twelve months that hold no property and no entries: we email you first, lock the account, and delete it fourteen days later unless you ask us to keep it. You can also email support@quarterwise.co.uk, and you have the right to complain to the ICO.