Last Updated: 16 October 2026
1. Who We Are
DutyDeclared Limited ("DutyDeclared", "we", "us", "our") is a UK-registered company that provides a customs declaration management platform for UK imports.
Company name | DutyDeclared Limited |
|---|---|
Companies House number | 16188124 |
Registered address | 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom |
Website | |
Platform URL | |
Data protection contact |
We are the data controller for the personal data described in this policy, meaning we determine the purposes and means of processing your personal data.
Where we process personal data contained within customs declarations on behalf of our business customers (importers, exporters, and customs agents), we may act as a data processor on their behalf. In those cases, our customers are the data controllers and are responsible for ensuring they have a lawful basis to provide that data to us.
2. What Personal Data We Collect
We collect and process the following categories of personal data.
2.1 Account Data
When you register for a DutyDeclared account, we collect:
Identity data: Full name, profile image
Contact data: Email address (used as your unique account identifier), phone number
Account data: Email verification status, onboarding completion status
Authentication data: Password (hashed and stored by our authentication provider, Supabase — we never have access to your plaintext password), session tokens
2.2 Lead and Enquiry Data
When you submit an enquiry or register interest through our website, we collect:
Identity data: First name, last name
Contact data: Email address, phone number
Business data: Company name
Technical data: Session ID (for form tracking)
You are asked to provide explicit consent when submitting the lead form by ticking a checkbox confirming: "I agree that DutyDeclared may collect and process my personal data in accordance with the Privacy Policy."
2.3 Organisation and Workspace Data
When you set up or join an organisation (workspace) on our platform, the following data is collected:
Business identity: Company name, email domain
Business contact: Address, city, country, postcode, phone number
Regulatory identifiers: EORI number
Account details: Subscription status, plan type, feature flags
Some of this data may include personal data where the organisation is a sole trader or the details relate to an identifiable individual.
2.4 Customs Declaration Data
When you create customs declarations on our platform, the following data is collected:
Exporter details: Name, EORI number, tax ID, full address
Importer details: Name, EORI number, tax ID, full address
Goods information: Product descriptions, HS codes, values, quantities, origins, weights
Transport details: Mode of transport, transport identifiers
Payment configuration: Duty payment method preferences
Supporting documents: Commercial invoices, packing lists (stored in Google Cloud Storage)
Collaboration messages: Team messages within the declaration workspace
2.5 Payment Data
We use Stripe to process subscription payments. We store:
Stripe identifiers: Stripe customer ID, subscription ID, price ID, subscription status
We do not store your credit card numbers, bank account details, or other sensitive payment information. All payment data is processed by Stripe in accordance with PCI DSS.
2.6 AI Chat Data (HSGenie)
Chat messages: Questions about commodity codes and AI responses
Session data: Anonymous session ID or workspace user ID
Classification data: Commodity codes discussed
Feedback data: Optional feedback ratings on AI responses
2.7 Technical and Usage Data
Server-side product event data (no consent required): When you take actions on our platform, our servers log structured product events (user ID, workspace ID, action type). Sent directly to Amplitude, does not involve placing anything on your device. Collected on the basis of legitimate interests.
Platform client-side interaction data (analytics consent required): If you accept analytics cookies, we collect richer behavioural data through Amplitude (page views, UI patterns). If declined, none of this is collected.
Log data: Server logs and error reports generated for security monitoring. May incidentally contain IP addresses.
Optional website analytics (PostHog)
On dutydeclared.com, we use PostHog to count visits, understand how visitors reach the website, see which public pages are useful, and understand whether visitors select our Get started or Create your account buttons. We send these website analytics events only after you accept optional analytics. If you have not chosen or reject analytics, we do not send them.
When enabled, we send the page address without query parameters or fragments, visit time, random browser and session identifiers, a broad arrival category and recognised provider where available, the session entry page and time, and limited measurement diagnostics. Only after consent, your browser reads referring-page and campaign information to choose these fixed categories. We do not send or store the raw referring address, campaign values or search terms through this collector. We do not send your name, email, account details, form contents or referring-page address through this website collector. We do not connect these identifiers to your DutyDeclared account, create an identified profile or record your screen. PostHog receives the connection information needed to receive requests; our project is configured to discard IP addresses and the collector disables location enrichment. We also measure selections of the Get started and Create your account buttons. We send fixed identifiers for the button, its placement and destination category, the time of selection, and random event and pageview identifiers with the website session. We record broad activation and navigation categories, such as keyboard activation or opening a new tab. We do not collect button text, form entries or destination addresses through this collector. Selecting a button records intent only; it does not tell us whether an account was created.
You can turn optional website analytics off at any time using Analytics preferences. This stops new analytics requests and removes this website’s analytics identifiers from this browser. Information sent before you turn analytics off may still reach PostHog; turning it off does not delete information already received. For requests about data already collected, contact privacy@dutydeclared.com. These website choices do not change your analytics choices in the DutyDeclared portal.
3. How We Use Your Personal Data
We only process your personal data where we have a lawful basis to do so under UK GDPR.
3.1 Processing Activities and Lawful Bases
Processing Activity | Categories of Data | Lawful Basis | Details |
|---|---|---|---|
Creating and managing your account | Account, identity, contact | Contract | Necessary to provide you with access to our service. |
Submitting declarations to HMRC | Declaration, goods, documents | Legal Obligation Contract | Required by UK customs law; necessary to deliver core service. |
Subscription payments | Payment, contact | Contract | Necessary to process subscription and collect payment. |
Server-side product event logging | User ID, workspace ID, actions | Legitimate Interest | Understanding platform usage to operate and improve it. Server-to-server. |
Client-side product analytics | Page views, UI interactions | Consent | Activated only after accepting cookies. |
Optional public-website analytics | Page address without query parameters or fragments, visit time, random browser/session identifiers, broad arrival category and recognised provider, session entry page/time, registered acquisition-button selections, fixed button/placement/destination identifiers, activation/navigation categories and limited measurement diagnostics | Consent | PostHog; enabled only after accepting optional website analytics. Withdraw through Analytics preferences. |
3.2 Automated Decision-Making
Our AI-powered features use automated processing to suggest data values. These suggestions are not binding decisions — they are presented as recommendations that you review and confirm. No solely automated decisions with legal or significant effects are made about you.
6. How We Keep Your Data Secure
Technical Measures
Encryption in transit: HTTPS/TLS for all data.
Encryption at rest: Database and Cloud Storage encryption.
Token encryption: OAuth tokens encrypted via Google Cloud KMS with HSM.
Input validation: Strict schemas (Zod) at API boundaries.
Organisational Measures
RBAC: 8 distinct workspace roles to ensure appropriate access.
Data isolation: Strict multi-tenant isolation.
Audit trail: Immutable records of declaration submissions.
Secure development: TypeScript strict mode, linting, reviews.
7. How Long We Keep Your Data
Data Category | Retention Period |
|---|---|
Account data | Duration of account + 12 months after closure |
Customs declaration data | At least 4 years from declaration date (HMRC requirement) |
Payment records | 7 years for tax and accounting |
Server logs | 90 days |
Public-website analytics events in PostHog | Available in our PostHog reports for one year under our current plan. This reporting window does not guarantee deletion of the underlying events; contact privacy@dutydeclared.com for a deletion request. |
Website analytics browser identifier | Used for up to 30 days from creation. Expired stored identifiers are replaced or removed on the next visit; turning analytics off removes them from this browser sooner. |
Website analytics session identifier | Used until 30 minutes without a tracked page visit or 24 hours from session start, whichever comes first. An expired stored session is replaced on the next tracked page visit; turning analytics off removes it sooner. |
Website analytics preference | Honoured for up to 180 days from your choice. We ask again after expiry; changing your choice replaces it, and clearing browser storage removes it sooner. |
8. Your Rights Under UK GDPR
Right of access (Art. 15)
You can view much of your data directly in the portal. For a full SAR, email privacy@dutydeclared.com
Right to erasure (Art. 17)
Email privacy@dutydeclared.com. Note: we may need to retain certain data for legal reasons (e.g., submitted declarations).
Right to object & withdraw consent
You can object to processing based on legitimate interests or withdraw consent via platform controls or email.
Right to Lodge a Complaint
If unhappy, you can contact the Information Commissioner's Office (ICO):
Web: https://ico.org.uk
Helpline: 0303 123 1113
9. Cookies
The public website uses local browser storage for optional analytics and to remember your choice. This storage belongs to dutydeclared.com and is not shared with the DutyDeclared portal. The website analytics identifiers and session arrival categories are created only after you accept. Arrival categories are stored with the session and expire with it. You can reopen Analytics preferences at any time.
Category | Purpose | Consent |
|---|---|---|
Strictly necessary | Required for platform function (authentication, security via Supabase). | No |
Analytics | Help us understand interactions to improve the platform (Amplitude). | Yes |
Website analytics identifiers | Count permitted public-website visits, broad arrival categories and selected acquisition-button interactions with PostHog using random browser/session identifiers | Yes |
Website analytics preference | Remember your accept/reject choice; no analytics event is sent for the choice itself | Required to remember your choice |
12. How to Contact Us
Data Protection, DutyDeclared Limited
167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom