Privacy policy
Last updated 8 October 2026
Who we are
MTD Match is a trading name of Highfold Group Ltd (company number 17521208, registered in England and Wales). Registered office: Office 21848, 182-184 High Street North, East Ham, London, E6 2JA. The "controller" of the personal data described here ("we", "us") is Highfold Group Ltd.
Questions about your data? Email hello@mtdmatch.co.uk. We read every message and we'll get back to you as soon as we can.
What we collect
- Details you give us - your answers to the MTD checker (income source, income bands and circumstances), anonymous unless you also give us your email; your email address and reminder preferences if you ask for deadline reminders, plus a record of the consent you gave and when; if you ask to be matched with an accountant: your name, email, phone number (optional), postcode, business type, income band, the help you want, your preferred contact method and any message, plus the exact consent wording you agreed to and when; if you buy the spreadsheet kit: your name, email address and order details; for accountants: practice and contact details, membership and anti-money-laundering supervisor details, postcode districts, logo, billing status and the status updates you record against enquiries; for accountancy firms we invite: firm name, address, website, phone, a business email address from the firm's own website, company details from Companies House and our emails to the firm.
- Payment details - handled entirely by Stripe. We never see or store your full card number.
- Messages - what you send us by email or through our contact forms.
- Basic usage data - we count page views without cookies. To count unique visitors we use a one-way, daily-changing hash of your IP address and browser; we can't use it to identify you and it resets every day. For each visit we keep the pages viewed, the kind of device, the country (worked out from your IP address, which isn't stored) and whether the visit ended in a purchase, chat or message, for 90 days, without cookies.
- Security logs - like most websites, our web server and mail server keep logs of each request: your IP address, the date and time, the page or service requested and your browser details (and, for emails, the sender and recipient addresses). We use them only to keep our services secure and working.
- Live chat - the messages you type into our chat assistant and any details you choose to send through it (see Live chat below).
Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Providing what you've ordered or signed up for, and talking to you about it | Contract |
| Replying to your messages and enquiries | Legitimate interests (or steps you ask us to take before a contract) |
| Taking payment, keeping accounts and tax records | Legal obligation |
| Keeping our services secure and preventing fraud and abuse | Legitimate interests |
| Improving our website using cookieless statistics | Legitimate interests |
Who we share it with
We never sell your data. We share it only with the suppliers below, who help us run MTD Match. Suppliers that act for us may use it only on our instructions, under contracts that require them to protect it. Where a supplier also uses data for its own purposes (as the table says), its own privacy policy covers that use.
| Supplier | What for |
|---|---|
| Contabo GmbH (servers in United Kingdom) | hosting: the server that runs this website and stores its database and files, and our own mail server on it, which sends and receives our emails |
| Stripe Payments UK Ltd | card payments and billing (Stripe is also an independent controller for fraud prevention and its own legal obligations) |
| Microsoft | an encrypted off-site copy of our backups (weekly and monthly copies are kept, so deleted data can stay there for up to about 3 months) |
| postcodes.io (Ideal Postcodes Ltd) | checking that postcode districts exist (we send the postcode or district only, never your name or contact details) |
| DataForSEO (Dataforseo OU, Estonia) | searching public map listings for accountancy firms near a postcode district (we send a location and the word 'accountants', never anyone's details) |
| Abacus.AI, Inc. (USA) | AI processing of live chat messages to write the assistant's replies |
Some of these suppliers may process data outside the UK (for example in the USA). Where they do, the transfer is protected by UK adequacy regulations (including the UK–US data bridge), or the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
How long we keep it
- Accountants' accounts and billing records: while you're a customer, then 6 years (UK tax and limitation rules). Firms we invite but who don't join: 12 months after our last email; stop requests permanently. Checker answers, reminders, introductions and kit orders: see MTD Match in detail below.
- Enquiries that don't lead anywhere: 2 years.
- Emails to and from our hello@mtdmatch.co.uk mailbox: deleted from our mail server 2 years after they arrive.
- Our log of the emails we send you (address, subject and whether it was delivered): 1 year.
- Security logs on our servers: 14 days.
- Cookieless page-view and visitor counts: about 13 months (400 days).
- Backups: anything we delete can stay in our backups (nightly copies, plus weekly and monthly encrypted off-site copies) for up to about 3 months, then it's gone.
- Live chat conversations: 180 days after the last message; details you send through the chat, with the recent part of the conversation, are kept like other enquiries.
Live chat
Our website has a chat assistant. It is an automated AI assistant, not a person: it answers questions using MTD Match's own web pages and information we've written for it, and it can make mistakes. If it can't help, it can take your details so our team can reply to you by email.
- What we keep - the messages you type, the assistant's replies, the page you started the chat on, when it happened, and a one-way hash of your IP address that changes every day (only to stop one connection using up the assistant - we don't use it to identify you). Please don't type card details or sensitive personal information into the chat; card numbers are removed automatically, from the chat and from details you send.
- AI processing - to write its replies, your messages and the relevant parts of our website are sent to Abacus.AI, Inc. in the United States, which acts as our processor under a contract that requires it to protect your data. The transfer is protected by UK adequacy regulations (including the UK–US data bridge), or the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
- Details you send us - if you choose to leave your details (for example your name, email address and phone number) they reach the MTD Match team in the same way as a message through our contact form, together with the recent part of your conversation (so the team has the context), we email you to confirm we've got them, and we reply by email. Nobody from the team joins the chat itself.
- Why (lawful basis) - legitimate interests (answering questions about our products), and steps you ask us to take before entering into a contract when you ask us to get back to you.
- How long - chat conversations are deleted 180 days after the last message. If you send your details, they and the recent part of the conversation that goes with them are kept like other enquiries (2 years).
- On your device - once you start a chat, your browser keeps the conversation (in local storage, not a cookie) so it stays open as you move between pages. It's cleared the next time you visit after 24 hours without using it, or straight away when you choose "Start a new chat" or clear this site's data. Once you've sent your details, your browser no longer keeps them.
MTD Match in detail
| What | Lawful basis | How long we keep it |
|---|---|---|
| The MTD checker - your answers (income source, income bands, circumstances), stored without your name or email under a random link so you can come back to your result. | Legitimate interests (giving you your result) | 2 years, then deleted (kept while they're linked to reminders you still receive) |
| Deadline reminders - your email, name if you give it, MTD start year, quarter type, and the exact consent wording with the date you agreed. | Consent - or, for the 12 months of reminders included with Kit + Walkthrough, our contract with you | Until you stop them (one click in any reminder email); the Kit + Walkthrough reminders end by themselves after 12 months. We keep the record that they stopped for 2 years, then delete it. |
| Accountant introductions - the details on the form, plus the exact wording you agreed to and when. | To provide the introduction you ask for (UK GDPR Article 6(1)(b)); you can withdraw at any time | If a practice took your request: personal details erased after 2 years, or straight away if you withdraw. If no practice ever got your details: erased 90 days after the request closed. We keep anonymous totals (postcode district, business type) to plan coverage. |
| Kit purchases - your name, email, order details, and when you asked for immediate access to the download. | Contract; legal obligation (tax records) | 6 years, then your name and email are removed from the order. Checkouts that were never paid are deleted after 30 days. |
How introductions work
- We share your details with one accountancy practice only, because you asked us to and ticked a box saying we can. That practice becomes a separate controller of your details, and we email you who it is.
- First we offer your request to MTD Match member practices that cover your postcode district. If none has space, we may tell up to 5 accountancy firms near you about it: your postcode district, whether you're a sole trader or landlord, your income band, the help you want and how you'd like to be contacted. Never your name, contact details or message. The first practice to take it gets your details; before it sees them it creates an account, names its professional body and agrees our practice terms.
- Firms we find nearby come from public listings (Google Maps, through our supplier DataForSEO) and Companies House. They haven't joined MTD Match before and we haven't checked their work, so ask about their professional body and fees before you agree anything.
- If nobody takes your request within 30 days, we close it and tell you. Nobody sees your details while you wait.
- If the practice tells us it couldn't reach you, or closes its MTD Match account before getting in touch, we email you. We only introduce you to a different practice if you ask us to, and we record your agreement again when you do.
- You can withdraw at any time from the link in our emails: we erase your details and ask every practice that received them to delete its copy.
- To check postcodes we send the postcode or postcode district (never your name or contact details) to postcodes.io.
Accountancy firms we contact about local requests
When someone asks for an accountant and no MTD Match member practice covers their area, we look for accountancy firms nearby and email up to 5 of them about the request (never the person's name or contact details).
- What we use: the firm's name, address, website and phone number, a business email address published on the firm's own website (sometimes it names a person, such as a partner or director), the company number and type shown on its website and checked at Companies House, and a record of the emails we've sent and any reply or stop request.
- Where it comes from: public map listings (Google Maps, through our supplier DataForSEO, to whom we send only a location and the word "accountants"), the firm's own website (we respect its robots.txt and any request not to be sent marketing) and Companies House's public company data.
- Why, and our lawful basis: to offer the firm the request. Our legitimate interest is matching people who ask for help with a local accountant. We only contact limited companies and LLPs, at an address on their own website, at most once a fortnight and 3 times in all unless the firm takes a request. We've weighed this against the interests of people named in business email addresses; our legitimate interests assessment is available on request.
- How long: up to 12 months after our last email, then deleted. If a firm takes a request, it becomes a practice customer and the customer periods above apply. A stop request is kept for good (only the email address, website domain or company number, and the date) so we never email the firm again.
- Your right to object: you can stop our emails at any time with the link in any email, by replying STOP or by writing to hello@mtdmatch.co.uk. We stop straight away and for good. You also have the other rights set out below.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. You can withdraw consent at any time. If you have an account you can delete it yourself from your account page. Email hello@mtdmatch.co.uk for anything else - we'll respond within one month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.
Changes
If we make important changes we'll update the date above and, where appropriate, tell you by email.