Skip to Content

Privacy Policy — Pro Technologies MTD VAT for Odoo

Last updated: 3 October 2026

Status: the software is in development and is being tested in HMRC’s sandbox. It is not yet available for live VAT returns.

This policy explains how Pro Technologies Limited (company no. 08184949, registered in England and Wales; “we”, “us”) handles personal data when you use Pro Technologies MTD VAT for Odoo (“the software”) to send VAT returns to HM Revenue & Customs (HMRC) under Making Tax Digital.

1. What the software does

The software is a module installed in your own Odoo database. It calculates your VAT return (Boxes 1–9, including the Flat Rate Scheme) from your accounting entries, and — when you choose to submit — sends it to HMRC through HMRC’s VAT (MTD) API. It also reads your VAT obligations, liabilities and payments from HMRC.

2. Who is responsible for which data

  • Your business is the controller of the accounting and VAT data in your Odoo database.
  • If we host or support your Odoo database, we process that data on your behalf as a processor, under our service agreement with you.
  • We are the controller of the limited technical data handled by our sign-in service (section 4).

3. Data the software processes in your Odoo database

  • Your VAT registration number, VAT return figures, obligations, liabilities, payments and HMRC submission receipts.
  • HMRC access tokens, obtained when you connect to HMRC. They are encrypted in your database with a key held outside the database. We never ask for, see or store your HMRC (Government Gateway) user ID or password: you sign in directly on HMRC’s website.
  • Fraud prevention data that HMRC requires with every request (connection method, a device identifier stored in your browser, browser user agent, screen and window size, time zone, public IP address and port, your Odoo login name, whether two-factor authentication is used, our software version and a hashed licence identifier). This data is sent only to HMRC and only when you make an HMRC request.

4. Our sign-in service (mtd.pro-technologies.co.uk)

To keep HMRC application credentials out of customer databases, the HMRC sign-in and token renewal pass through our server in London, UK. It handles your database identifier, the HMRC authorisation code and tokens in transit only (they are not stored or logged), and a log line with the time, database name, type of request and HMRC’s response code. VAT return figures never pass through this service — they go directly from your Odoo to HMRC.

5. Why we process the data (lawful basis)

  • To provide the software and services you have contracted for (contract).
  • To meet HMRC’s legal and technical requirements for MTD software, including fraud prevention data (legal obligation of the taxpayer; our legitimate interest in operating compliant software).
  • To keep the service secure and investigate faults (legitimate interests).

We do not use this data for marketing and do not sell or share it with third parties, other than HMRC and our hosting provider.

6. Where data is stored and who processes it for us

  • Our sign-in service and our managed Odoo hosting run in UK data centres operated by IONOS (hosting provider).
  • If you host Odoo yourself, your data stays on your own servers.
  • No data is transferred outside the UK by the software.

7. How long we keep it

  • Data in your Odoo database: for as long as you keep it; you can export or delete it at any time. VAT records should normally be kept for at least 6 years to meet HMRC record-keeping rules.
  • Sign-in service logs: up to 90 days.
  • HMRC tokens: until you disconnect or they expire (refresh tokens expire after 18 months if unused).

8. Security

Encryption in transit (HTTPS) and of stored HMRC tokens; access to HMRC functions limited to accounting managers; two-factor authentication required for HMRC actions; each customer’s data in a separate database; servers with key-only administrator access and a firewall. See also our security page: https://www.pro-technologies.co.uk/security

9. Your rights

You can ask for access to, correction, export or deletion of your personal data, or object to processing, by writing to privacy@pro-technologies.co.uk. You can complain to the Information Commissioner’s Office (ico.org.uk).

10. Contact

Pro Technologies Limited, 35 Wild Rose House, 3 Firwood Lane, Romford RM3 0FQ, United Kingdom (company no. 08184949) · privacy@pro-technologies.co.uk · +44 20 3695 2175