Privacy Policy

At Tax2Cargo, we are committed to protecting your privacy and ensuring the security of your personal and business information. Tax2Cargo is our customs declaration product available through cds.vouchcom.com. This policy explains how we collect, use, store, share, and protect your data when you use our Customs Declaration Service (CDS) and Entry Summary Declaration (ENS) submission platform.

1. Who We Are

Tax2Cargo is a software-as-a-service (SaaS) platform and our customs declaration product, available through cds.vouchcom.com. It is operated by:

Vouchcom Ltd acts as the Data Controller for user account and billing data, and as the Data Processor for customs declaration data submitted to HMRC on your behalf.

2. Information We Collect

We collect and process the following categories of information when you use our Service:

a. Identity and Contact Information

• Full name
• Email address
• Phone number
• Company name and address

b. Business and Transaction Data

• EORI number
• Customs declaration details, including shipment references, commodity codes, declaration type, and supporting documents (e.g., invoices or transport documents)

c. Technical Information

• IP address, browser type, and operating system
• Device identifiers and usage logs
• Session and performance analytics to improve the platform

d. Payment and Subscription Information

• Billing details and transaction records managed by Paddle, our authorised payment processor
• Paddle's privacy policy applies to all payment processing: https://www.paddle.com/legal/privacy

3. Purpose and Legal Basis for Processing

We process your personal data only when we have a lawful basis under UK GDPR, including:

4. How We Share Data

We only share data where it is necessary, proportionate, and lawful. This includes sharing:

• With HMRC — for submission of customs and ENS declarations via secure APIs.
• With Paddle — for payment processing, billing, and fraud prevention.
• With our service providers — including hosting, analytics, and security providers (all compliant with UK GDPR).
• With law enforcement or regulators — if legally required or in response to valid legal requests.

We do not sell or rent personal data to any third parties.

5. International Data Transfers

Where service providers operate outside the UK or European Economic Area (EEA), we ensure that appropriate safeguards are in place (such as UK-approved Standard Contractual Clauses) to protect your personal data in line with UK GDPR standards.

6. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

• Account data: retained for as long as your subscription is active and for up to 6 years after closure (for legal and accounting purposes).
• Customs declaration data: retained for 5 years in line with HMRC recordkeeping requirements.
• Technical logs: retained for up to 12 months for system performance and audit purposes.

After these periods, data is securely deleted or anonymised.

7. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption in transit (TLS 1.2+) and at rest
• Role-based access controls
• Regular vulnerability assessments and backups
• Secure hosting within the UK or EEA

Despite our efforts, no online service can guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials.

8. Your Rights

Under the UK GDPR, you have the following rights:

• Access – to request a copy of the personal data we hold about you.
• Rectification – to request correction of inaccurate or incomplete data.
• Erasure – to request deletion of your personal data where no longer necessary.
• Restriction – to request limited processing under certain circumstances.
• Portability – to receive your data in a structured, machine-readable format.
• Objection – to object to certain processing activities (e.g., marketing).

You can exercise your rights by contacting kd@vouchcom.com. We will respond within one month as required by law.

9. Cookies and Tracking

Tax2Cargo uses cookies and similar technologies to:

• Maintain session authentication
• Monitor platform usage and improve performance
• Remember user preferences

You can manage or disable cookies through your browser settings. For more details, refer to our Cookie Policy.

10. Data Processors and Third Parties

We rely on trusted third-party processors to deliver the Service securely and efficiently:

• HMRC (Customs Declaration Service & ENS) – for customs submissions
• Paddle – for billing and payment processing
• Microsoft Azure – for cloud hosting and infrastructure
• Zendesk (or similar) – for support ticketing and communications

Each processor operates under a data processing agreement ensuring GDPR compliance.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be notified via email or prominently displayed on our website. The "Last updated" date at the top indicates the effective version.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact:

If you believe your data has been mishandled, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/

Last Updated: 7 December 2025