HydraTaxHydraTax

Legal

Data Processing Agreement

Last updated: 8 August 2026

Hydra Consultancy Services Ltd trading as HydraTax
Company number: 14633422
Registered office: 34 Fanshawe Avenue, Barking, England, IG11 8RG

1. About this agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("you", "Controller") and Hydra Consultancy Services Ltd trading as HydraTax ("we", "Processor") and applies to our processing of Personal Data on your behalf when you use the HydraTax service ("Service").

It applies automatically when you accept the Terms of Service. No counter-signature is required. It is governed by the same law and jurisdiction as the Terms of Service (England and Wales).

Capitalised terms not defined here have the meanings given in the UK GDPR and the Data Protection Act 2018.

2. Roles, scope and duration

You are the Controller of the Personal Data you submit to the Service. We are the Processor and process the Personal Data only on your documented instructions, as set out in the Terms of Service, this DPA, and the configuration choices you make within the Service.

Subject matterProvision of the HydraTax Service: preparation and submission of UK tax and Companies House filings (including VAT, Corporation Tax / CT600, Self Assessment, PAYE/RTI, confirmation statements and annual accounts).
DurationFor as long as you have an account with us, plus the post-termination retention periods set out in §11 below.
Nature and purposeStorage, retrieval, transformation, generation of statutory documents, transmission to HMRC and Companies House on your instruction, customer support, and operational analytics.
Types of Personal DataIdentification and contact data; company-officer data; financial or payroll data attached to a named individual where applicable; account credentials and authentication data; support correspondence; submission credentials.
Categories of Data SubjectsYou; colleagues authorised to use the account; directors, secretaries, employees and members of the companies you file for; individuals named in support correspondence.

3. Your obligations as Controller

  • You confirm that your collection and provision of Personal Data to the Service complies with applicable data protection law and that you have the legal basis to instruct us to process it.
  • You are responsible for the lawfulness, accuracy and completeness of the Personal Data you submit and for responding to Data Subjects, with the assistance described in §8.
  • You retain control over your account configuration, the data you upload, and the timing and content of any submission to HMRC or Companies House.

4. Our obligations as Processor

We will:

  • Process Personal Data only on your documented instructions, including in respect of transfers outside the United Kingdom, except where required by law (in which case we will inform you unless prohibited).
  • Ensure that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations.
  • Implement and maintain appropriate technical and organisational measures designed to protect Personal Data (§6).
  • Engage sub-processors only in accordance with §7.
  • Assist you with your obligations under §8 and §9 of this DPA.
  • Make available information necessary to demonstrate compliance, principally through this DPA and our Sub-processor List.
  • At your choice, delete or return Personal Data at the end of the agreement (§11).

5. Confidentiality

We will treat all Personal Data as confidential and will limit access to those of our personnel and sub-processor personnel who need access to perform the Service. Each such person is bound by a written confidentiality obligation of no less protection than this DPA imposes on us.

6. Security measures

We implement appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include encryption in transit, restricted production access, monitored hosting, regular backups and time-bound retention of authentication credentials.

We may update these measures from time to time provided that the level of protection is not materially decreased.

7. Sub-processors

You provide general authorisation for us to engage the sub-processors listed at /legal/sub-processors to process Personal Data in connection with the Service.

We will give you at least 14 days' advance notice of any intended addition or replacement of a sub-processor by updating the published list. If you object on legitimate data-protection grounds within 14 days, and the affected service cannot reasonably be provided without the new sub-processor, you may terminate the affected portion of the Service and receive a refund for any unused prepaid period.

Each sub-processor is bound by a written agreement that imposes data protection obligations equivalent in substance to those in this DPA. We remain responsible to you for the performance of each sub-processor's obligations.

8. Assistance with data subject rights

Taking into account the nature of the processing, we will assist you with appropriate technical and organisational measures, insofar as possible, to fulfil your obligation to respond to requests from Data Subjects exercising their rights under the UK GDPR. For data export, rectification or other rights requests, contact support@hydratax.co.uk.

9. Assistance with breach notification, DPIA and prior consultation

We will notify you without undue delay, and in any event within 72 hours of becoming aware, of any Personal Data Breach affecting your data, and provide information reasonably required for you to comply with Articles 33 and 34 of the UK GDPR.

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with any DPIA and any prior consultation with the ICO that you are required to carry out in respect of the Service.

10. Audit

You may verify our compliance with this DPA by reviewing this DPA, the Sub-processor List, and any answers we provide to specific written questions sent to support@hydratax.co.uk. As a self-serve subscription product we do not accommodate on-site audits or third-party audit firms at the standard subscription tier.

11. End of agreement

On termination, you may request an export of your data by emailing support@hydratax.co.uk before instructing deletion. Within 30 days of the later of (a) your written instruction to delete and (b) account termination, we will delete or anonymise Personal Data held in active production systems. Backups containing Personal Data are deleted on the next backup-cycle rotation following the active deletion.

We will retain the minimum Personal Data required by law (typically filing records for the periods set out in Privacy Policy §2.4) and confirm completion in writing.

12. International transfers

Where we transfer Personal Data outside the United Kingdom, we rely on the UK adequacy regulations (for transfers to EEA countries) or on the UK International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses (for transfers to other third countries). Current destinations and mechanisms are listed at /legal/sub-processors.

13. Liability

Our liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service §5, except to the extent that such limitation is prohibited by applicable law.

14. Changes to this DPA

We may update this DPA from time to time. Where a change materially affects your rights, we will notify you in advance and you may terminate the Service for that reason within 30 days of the notice. Continued use of the Service after the effective date constitutes acceptance.

15. Contact

For questions about this DPA, our processing of your data, or to make a request under any of the sections above, contact support@hydratax.co.uk.

Hydra Consultancy Services Ltd
Trading as HydraTax
Company number: 14633422
Registered office: 34 Fanshawe Avenue, Barking, England, IG11 8RG

Related