Legal

Privacy policy

What personal data Sciforn holds, why we hold it, how long we keep it, who we share it with and the rights you have. Last updated 1 October 2026.

Who we are

Sciforn Ltd is a company registered in England and Wales, company number 13653930, with its registered office at 21 High Street, Harrow on the Hill, HA1 3HT. Our VAT registration number is GB 467 5393 50. We are registered with the Information Commissioner's Office as a data controller, reference ZB306398. In this policy "Sciforn", "we" and "us" mean Sciforn Ltd.

You can contact us about anything in this policy at info@sciforn.com or by post at the address above.

What this policy covers

This policy covers two things:

  • This website (sciforn.com) and the messages you send us. For these we decide how your data is used, so we are the controller.
  • Our software, including Helios, Athena, Selene, Atlas and Juno, used by businesses that have an agreement with us. The data a business puts into our software belongs to that business, which is the controller. We process it on the business's instructions under our agreement with it. If you are an employee, customer or supplier of one of those businesses, please contact the business first about your data.

This website

The website does not use cookies, analytics or advertising trackers, and it does not load anything from other websites. Our hosting provider, Microsoft Azure, keeps standard technical logs of requests to the site (such as the IP address, the page asked for and the time) to run and protect the service.

When you email us, for example to ask for a demo or to apply for a job, we receive your name, email address and whatever else you choose to tell us. We use it to reply, to arrange what you asked for and, if you apply for a job, to consider your application. Our lawful basis is our legitimate interest in answering enquiries, or the steps you ask us to take before entering into a contract.

We keep enquiries for up to two years after our last contact, unless you become a customer, in which case the records of our relationship are kept for as long as the agreement lasts and for six years after it ends. Unsuccessful job applications are deleted after twelve months unless you ask us to keep them longer.

Helios and Making Tax Digital for VAT

Helios can file a business's VAT returns with HM Revenue and Customs (HMRC) through HMRC's Making Tax Digital service. This only happens when the business connects Helios to HMRC and a person the business has authorised chooses to submit a return.

When a business uses this, Helios:

  • stores the access permission (tokens) HMRC gives when the business signs in with its Government Gateway account. The tokens are encrypted, are never shown on screen, and are deleted when the business disconnects Helios from HMRC;
  • sends HMRC the VAT registration number and the figures of the return the business has prepared, reviewed and locked, and keeps HMRC's receipt for it;
  • reads from HMRC the business's VAT obligations, the returns it has filed, and its liabilities and payments;
  • sends HMRC, with every request, the fraud prevention information HMRC requires by law of all Making Tax Digital software. This describes the connection and the device the request comes from: for example the public IP address and port, the time of the request, the browser's user agent, screen size, window size and time zone, a random device identifier kept in the browser, whether the person signed in with a second factor, and the Helios user account making the request.

This information is used only to file and view the business's VAT returns with HMRC. It is not used for marketing and is never sold. Once HMRC receives it, HMRC's own privacy notice applies to what HMRC holds.

The business decides how long its VAT records are kept, within the six years UK tax law generally requires. A record of each submission (the return, HMRC's receipt, who submitted it and when) is kept with the business's accounts so it can show what was filed.

Who we share data with

  • Microsoft, which hosts our website and our software on Microsoft Azure.
  • HMRC, when a business files or views its VAT returns through Helios as described above.
  • Other services a business chooses to connect to our software (for example its bank, payment provider or online shop), on that business's instructions.
  • Anyone we are required to share it with by law, for example a court order.

We do not sell personal data, and we do not share it for other companies' marketing.

Where data is kept

Data is kept in Microsoft Azure data centres. For our software, the region is set out in the agreement with each business. If personal data is ever transferred outside the UK, we make sure it is protected by the safeguards UK data protection law requires, such as an adequacy decision or the UK International Data Transfer Agreement.

How we protect it

Data is encrypted when it travels over the internet and when it is stored. Access to our systems is limited to the people who need it, uses multi-factor sign-in, and is logged. Our software keeps a tamper-evident audit trail of changes.

Your rights

Under UK data protection law you have the right to:

  • ask for a copy of the personal data we hold about you;
  • ask us to correct data that is wrong or incomplete;
  • ask us to delete your data, or to stop or limit how we use it;
  • object to us using your data on the basis of our legitimate interests;
  • ask for your data in a form you can take to another provider.

Email info@sciforn.com to use any of these rights. We will reply within one month. Some rights have limits, for example where the law requires us to keep a record.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Changes to this policy

If we change this policy we will publish the new version here with a new date. If a change affects how we use data we already hold, we will tell the people affected.