Privacy Policy

1. Who is the data controller?

The data controller for the personal data processed via this website is MANI B.V., a private limited company registered in the Netherlands, Chamber of Commerce (KvK) number 93986858. Contact: [CONTACT EMAIL — to be confirmed].

For UK customers, we process personal data in accordance with the UK GDPR and the Data Protection Act 2018, and (where applicable) the EU GDPR.

2. The personal data we process

To prepare and post your Marriage Allowance application we collect:

• Your identity and contact details: full name, date of birth, postal address, e-mail and phone number.
• Your National Insurance number (sensitive personal identifier).
• Your handwritten signature, captured electronically and stored as an image.
• Your partner's full name, date of birth and National Insurance number.
• Marriage / civil partnership date and the tax years you want to claim.
• Eligibility answers, payment status and a service reference number.
• Technical data: IP address, browser user-agent and basic traffic source (UTM) information, for fraud prevention and service operation.

Your and your partner's National Insurance numbers and your signature are sensitive personal identifiers. We protect them with encryption in transit and at rest, restricted access, and audit logging.

3. Purposes and legal bases

• Preparing and posting your HMRC MATCF form — legal basis: performance of the contract between you and us (UK GDPR Art. 6(1)(b)).
• Processing payment of our service fee — performance of the contract (Art. 6(1)(b)).
• Customer support and service e-mails — performance of the contract (Art. 6(1)(b)).
• Bookkeeping, accounting and tax records — legal obligation (Art. 6(1)(c)).
• Fraud prevention and security logging — our legitimate interest in operating a secure service (Art. 6(1)(f)).

We do not use your data for marketing or profiling.

4. Who we share your data with

We send your completed MATCF form, by post, to HMRC (HM Revenue and Customs, Pay As You Earn and Self Assessment, BX9 1AS).

We use the following processors to operate the service:

• Supabase — application hosting, database and file storage (EU region).
• Pingen — physical letter dispatch to HMRC.
• Resend — transactional service e-mails (order confirmation, status updates).
• [Payment provider — to be confirmed] — processing of your service fee.
• Our e-mail and IT providers, where necessary to operate the business.

Each processor is bound by a data-processing agreement and processes data only on our documented instructions. We do not sell your personal data.

5. International transfers

MANI B.V. is established in the Netherlands (EU). Personal data is primarily processed within the EEA. Where a processor transfers data outside the UK or EEA, the transfer is protected by an adequacy decision and/or the UK International Data Transfer Addendum or EU Standard Contractual Clauses.

6. How long we keep your data

• Abandoned drafts (you started but did not pay): up to 7 days, then deleted.
• Submitted claim records (including signature and NINOs): for the duration of the HMRC process, then no longer than is needed to handle complaints and queries, and in any event in line with statutory retention.
• Invoices and accounting records: 7 years (Dutch tax law for MANI B.V.).
• Security logs: up to 90 days.

7. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure ("right to be forgotten"), subject to our legal retention obligations;
• restrict or object to certain processing;
• request portability of data you provided to us;
• withdraw any consent at any time (where consent is the legal basis).

To exercise any of these rights, contact us at [CONTACT EMAIL — to be confirmed].

You also have the right to lodge a complaint with a supervisory authority. For UK residents this is the Information Commissioner's Office (ICO). For EU residents, you may also contact the Dutch Autoriteit Persoonsgegevens.

8. Security

We use TLS encryption in transit, encryption at rest, role-based access controls and audit logging. Sensitive identifiers (NINOs, signatures) are accessible only to authorised staff for the purpose of preparing and posting your MATCF form.

9. Cookies

We use only strictly necessary cookies required to operate the application flow (session, security). We do not use advertising or cross-site tracking cookies.

10. Changes

We may update this policy. Material changes will be notified on this page with an updated "Last updated" date.