Privacy Notice

MANAGETAX LIMITED, trading as ManageTax is the controller of the personal data described in this notice. That means we decide what is collected and why, and we are the people you hold to account for it.

Address: 83 CASTLECURRAGH HEATH, MULHUDDART, DUBLIN, DUBLIN 15, D15 T3P6, IRELAND. Email: office@managetax.ie. Telephone: 0832000575. Registration: CRO 755323.

No data protection officer has been appointed. Nothing in this service meets the criteria in Article 37 that would require one, and you should write to the address above.

Your email address and a hash of your password. The password itself is never stored and cannot be recovered from the hash — if you forget it, it is gone and you set a new one.

If you give them when you register: the name you want to be called and what describes you (an employee, a sole trader, a landlord, and so on). Neither decides anything the product does. We also record when you confirmed you had read the terms and this notice, and which versions they were, and your answer to whether you want occasional product news by email.

The financial records you keep here: transactions, invoices, bank lines, the books they make up, and the tax computations built from them. Where you upload a document as evidence, we hold the document and a record of every time it was read or changed, including by us.

Your tax reference and the figures on your return, where you enter them. These are special in practice rather than in law: they are not an Article 9 special category, but they are the data a person is least willing to see mishandled, and they are treated accordingly.

If you fill in Your details: your name, date of birth, address and phone number, and those of your spouse or civil partner and any children you list, where you choose to give them. This includes your Personal Public Service Number (PPSN), and your spouse's or civil partner's where you give it. We store a PPSN encrypted, so that the Revenue filings and payslips prepared here (Form 11, payroll submissions) can carry it without you typing it each time. On screen it is shown only masked, with its last four characters. It is written out in full only where a filing needs it: into the Form 11 file you download to upload to ROS, and, if you add yourself as an employee on a payroll here, onto that payroll's employee record, where it is kept and shown as every employee's PPSN is. You can remove it from Your details at any time; otherwise it is kept, like the rest of your account details, under the retention rules below.

If you buy a subscription: what you bought, the subscription's status and dates, and Stripe's references for you and for the subscription, so that a payment can be matched to your account. Your card details are not among them — they stay with Stripe.

If you contact us, what you wrote and our reply.

Records about other people, which you enter: employees (name, address, PPSN, bank details, pay), the customers and suppliers on your invoices and bills, and, if you are a practice, your clients and the people in their anti-money-laundering files. They are not our customers, and you decide what is kept about them: see the section on people whose details you keep here.

The records you keep here name other people: your employees, with their PPSN, bank details and pay; your customers and suppliers, with the addresses and bank details on their invoices; and, for a practice, its clients and the people in their anti-money-laundering files. We did not collect those details from those people, and we hold them only to run the service for you.

For that data you decide why it is held and for how long, and you are the one who owes those people the information the law requires (Articles 13 and 14). We act on your instructions, keep it apart from every other account, and do not use it for our own purposes. We do not yet offer a separate data-processing agreement; if you need one, ask us at the address above.

An employee's PPSN is held in plain form on the payroll record, because payslips and the payroll submission need it (your own and your spouse's PPSN in Your details are stored encrypted). Anyone you give access to your record — a practice you grant, for example — can see these details until you withdraw the access.

To provide the service you asked for — keeping your books, producing your return, storing your evidence. That is performance of our contract with you, Article 6(1)(b), and it covers almost everything here.

To meet our own legal obligations, Article 6(1)(c) — chiefly keeping proper records of what we sold you and to whom.

To email you product news, only if you said yes: that is your consent, Article 6(1)(a). The box is unticked unless you tick it, we keep the time and the wording you agreed to, and you can withdraw it at any time on the Security page, which stops it from then on.

To show what you said about us on this site, only if you agreed to be quoted: that is your consent too, Articles 6(1)(a) and 7. We publish your words as you approved them, with your name and only the details you chose to add — your role, your business, your county — and, next to them, anything you were given for it or any connection you have with us beyond being a customer. We record who took your consent, when and how, and publish nothing without it. You can withdraw it at any time, without giving a reason, by writing to us at office@managetax.ie: the quote comes off the site within two working days and the record of it is deleted.

To keep the service secure and to investigate misuse, which is our legitimate interest under Article 6(1)(f). The access log kept against every document exists for this and is the reason we can tell you who opened what.

We do not sell your data, we do not profile you, and no automated process makes a decision about you that produces legal effects. Where the software proposes a figure — from a scanned invoice, say — it is a proposal a person confirms, never an answer.

The table lists the services that process your data for us. Each does one job, under contract, and none of them may use your data for their own purposes. Revenue and a practice you grant access to are described in the next section.

Revenue Commissioners: where you send a payroll submission from here, the submission — your employees' PPSNs, their pay and the tax on it — goes to Revenue Online Service with your own digital certificate. The certificate is held sealed in your browser; for that one request it passes through our server and is not stored there. Revenue sends back what it holds about your employees (revenue payroll notifications), and we keep those with the payroll record. Nothing else is sent to Revenue from here: the returns you file, you file yourself on ROS.

A practice you grant access to sees your record, and can work on it within the role you gave it, until you withdraw the access. A practice is the controller of what it does for you under its own engagement with you.

The records are held in the European Union where the deployment is configured for it, and the table above says what is known about each recipient.

Some recipients are in, or reach servers in, the United States, and not only the payment one: Stripe (card details are given to it on its own pages and never pass through this application — there is no card field in it), the email provider that sends our messages where one is configured, Vercel, which hosts the application, and Firebase Authentication, which signs in our administrators. Where data goes to the United States it goes under the recipient's own transfer arrangements (the EU–US Data Privacy Framework or standard contractual clauses); the table above says what is known about each.

Tax records are kept for six years after the transactions they relate to are completed, because that is how long Irish law requires you to be able to produce them — s.886(4)(a)(i) Taxes Consolidation Act 1997.

There is a second rule that catches people out and we will not apply the first one blindly. Where a return for a year has never been delivered, s.886(4)(a)(ii) runs the six years from the end of the year in which a return is eventually filed. So the clock on an unfiled year has not started. If you are working through old years — which is a large part of what this product is for — nothing is deleted on the assumption that it is stale, because the records of an unfiled year are precisely the ones you will be asked to produce.

Your account details are kept while the account exists and for six years afterwards, for the same reason. Records of what we sold you are kept for six years. Anything else — a support email, a document you deleted — goes when it is no longer needed.

Ask us to delete your account — from the Security page, or by writing to us — and we will, subject to the retention above, and we will tell you plainly what has to stay and why. We keep the request itself, with your email address and what we did about it, as the record that we dealt with it.

Two things about how deletion works. Deletion is carried out by us, by hand, after we have checked who is asking; it is not instant. And a weekly archive of the database is kept for six years: what was deleted stays in those archive copies, unused and out of reach of the product, until each copy expires. Stripe also keeps the customer record and the payments for its own legal retention.

A copy of what we hold (Article 15). Correction of anything wrong (Article 16). Deletion, where we are not required to keep it (Article 17). Restriction of processing while a dispute is worked out (Article 18). A machine-readable copy to take elsewhere (Article 20). And an objection to processing carried out under legitimate interest (Article 21).

There is also a right you have that has nothing to do with data protection and is easy to miss: if you cancel a paid contract, s.117(8) and (9) of the Consumer Rights Act 2022 entitle you to get back the content you created in the software — your books, not just your personal data — free of charge and in a commonly used, machine-readable format. That is wider than Article 20. Today we meet both the same way: the exports already built into the product cover most of what you have created, and where they do not yet reach — your originals, a record this product has not built an export for yet — we put the rest together by hand, at no charge, when you ask under either right.

Write to office@managetax.ie and we will answer within one month.

If we get it wrong, complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland — https://www.dataprotection.ie. You do not need our permission and you do not have to come to us first.

The cookies that keep you signed in are strictly necessary and need no consent: Regulation 5(5) of S.I. 336/2011 exempts storage that is strictly necessary to provide a service you explicitly asked for.

One thing is optional and is off until you say yes. On the public pages of this site (the home page, pricing, blog, help and similar pages) a banner asks whether we may use Google Analytics 4 to count which pages are read. Nothing is loaded from Google, and no cookie is set, unless you click Accept. Google Ireland Limited provides the service and is our processor. It sets two cookies, _ga and _ga_<id>, which last up to 13 months. Google Analytics 4 does not store IP addresses, and Google signals and advertising personalisation are switched off.

Analytics never runs inside your account, the practice console or the admin area, and nothing from those screens is reported.

Saying no is one click and costs you nothing. You can change your mind at any time with "Cookie settings" in the footer of any public page: choosing No thanks stops measurement and deletes the analytics cookies. Your choice is remembered for 12 months in your browser's own storage (key mtax-analytics-consent), then we ask again.

The complete list follows. It is checked against the code, so if it is ever wrong the build fails before you see it.

Three things are kept in your browser's own storage rather than in a cookie. Two are strictly necessary: the draft answers of the tax projection (key managetax.projection.v1), and, if you use payroll filing, your ROS digital certificate sealed under a passphrase only you know (key managetax.ros-credential.v1). The certificate's key is per browser, not per account; signing out does not remove it. The third is your cookie choice above. Clear your browser's site data to remove all three.

Write to us at 83 CASTLECURRAGH HEATH, MULHUDDART, DUBLIN, DUBLIN 15, D15 T3P6, IRELAND, or office@managetax.ie. We acknowledge within five working days and answer within twenty.

If you are not satisfied you can bring the matter to the Competition and Consumer Protection Commission, or to the Data Protection Commission where it concerns your data.