HMRC Filing Terms

1. What these terms cover

These terms apply when you give OTOFILL your HMRC Government Gateway User ID and password so that we can send your PAYE Real Time Information to HMRC — Full Payment Submissions (FPS), Employer Payment Summaries (EPS) and NINO Verification Requests (NVR) — on your instruction.

2. What OTOFILL is, and what it isn’t

OTOFILL is software you use to prepare and send your own HMRC submissions. When we file, we use your own HMRC Government Gateway sign-in — the same log-in you would use on HMRC’s own website. We are not your tax agent: we do not have a separate agent relationship with HMRC (the kind set up by HMRC’s 64-8 or FBI2 forms). You remain the employer, and you remain legally responsible for every submission sent from your HMRC account.

3. What we do with your credentials

• We store your Gateway password encrypted. It is never shown back to you, and OTOFILL staff cannot read it once it is saved.
• We use your credentials only to send the submissions you have approved inside OTOFILL — FPS, EPS and NVR.
• We do not use them for anything else.

4. What we will not do

• We will not file anything without you approving it in OTOFILL first. Nothing is sent to HMRC automatically behind your back.
• We will not use these credentials to file Corporation Tax, VAT or Self Assessment returns. If OTOFILL adds those services in future, we will update these terms and ask you again.
• We will not share your credentials with anyone outside OTOFILL.

5. Your responsibilities

• Keep your HMRC credentials accurate. If you change your HMRC password, update it in OTOFILL — filing will fail until you do.
• Check every pay run before you approve it. The figures we send to HMRC are the figures you have approved.

6. Removing your credentials

You can remove your credentials at any time: go to My Business → HMRC Credentials → Remove HMRC Credentials. Once removed, OTOFILL cannot file with HMRC for you until you enter them again.

7. How we handle your data

We hold your HMRC credentials under UK GDPR. Our lawful basis is the performance of our contract with you and compliance with a legal obligation — an employer’s duty to report PAYE information to HMRC. It is not “consent” in the GDPR sense, so this is not something you withdraw; instead you remove your credentials as described in section 6.

We keep your credentials for as long as your OTOFILL subscription is active, and for 30 days after it ends, after which they are deleted.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk.