Privacy

Last updated 23 September 2026

Dormant Return collects the minimum needed to prepare and file your company's Corporation Tax return.

Who we are

Dormant Return is operated by Dormant Return Ltd, registered in England and Wales, company number 17393077, registered office 5 Wilkinson Way, Winsford, CW7 1RF. For anything about your data, write to us at that address or email privacy@dormantreturn.co.uk.

What we collect and why

• Return details you enter: company or charity name, company number where there is one, Corporation Tax UTR, accounting period, accounts approval date, and the name and role (director, trustee or treasurer) of the person making the declaration. A charity return also takes the charity's regulator number where it has one. These are the contents of the return; without them there is nothing to file.
• Figures for the return. A dormant return can carry a small balance sheet (cash at bank, creditors such as a director's loan, share capital and reserves) and whether the company traded in the past. A return for a company that traded or earned bank interest takes the figures from the accounts it has already filed: turnover, costs, bank interest, equipment bought, the balance sheet, the number of employees, a short description of the trade, any brought-forward losses, and last year's figures if you choose to give them. A charity return takes the income, expenditure and asset figures HMRC asks for on page CT600E. These are figures about the company or charity rather than about you, but where a company has one owner they can say something about that person's affairs, so we treat them with the same care as the rest of the return.
• An accounts PDF, on a charity return only. A charity or sports club uploads the accounts it has already prepared, and we attach them to the return and send them to HMRC. We hold the file as part of what was filed. We do not read it, open it or extract anything from it, and no software of ours parses it. Note that charity accounts often name the trustees, so this is the one place the service holds information about people other than you. HMRC scans the file for viruses on receipt; we do not.
• Your email address, captured during Stripe checkout, used to send your filing receipt and notices about the progress of that one return. Those notices include a reminder if a paid return is still waiting to be filed, help after a failed HMRC sign-in, a pause notice after repeated failed sign-ins, confirmation if you ask us to hold a return for 30 days, and word that HMRC is slow to confirm the return, has rejected it, or that a paid return has not been filed and is being refunded. We do not send marketing.
• Copies of the emails we send you. Since 21 September 2026 we keep a copy of each receipt and notice we send about your return, with the address it went to and whether it was delivered or bounced. This lets us resend a receipt that never arrived and answer questions about what we sent. These copies are deleted with the return they belong to.
• Payment records: payment and refund identifiers from Stripe. Your card details go directly to Stripe and never touch our servers.
• Filing evidence: the submitted return, HMRC's responses and acceptance receipt. This is the statutory evidence of what was filed.
• Server logs: standard web server logs including IP addresses, kept for security and abuse prevention.

We never store your Government Gateway password. It is passed to HMRC's submission service to authenticate your filing and is not written to disk.

How long we keep it

• Draft returns that are never paid for are deleted 30 days after they were started.
• Paid returns that are never filed are refunded, normally after 24 hours or at the end of a 30-day hold if you asked for one, and deleted 90 days after they were started.
• Rejected or failed filings are deleted 90 days after they were started.
• Accepted filings are retained, because they are the evidence of your statutory filing and its receipt from HMRC.
• An uploaded accounts PDF follows the same schedule as the return it belongs to, because it is part of what was filed. That is also why we cannot delete it from an accepted filing on request: it is the evidence of what HMRC received.
• Copies of the emails we sent you, and the delivery records that go with them, are deleted at the same time as the return they belong to.

Backups. We back up the database every night and take a snapshot of the server every day, so that a fault cannot lose a filed return. Database backups are kept for 30 days. The backup store keeps old versions, so an expired backup can take up to a further 30 days to disappear completely. Server snapshots are kept for 7 days. Something deleted from the live service can therefore remain in a backup for up to 60 days more. Backups are used only to restore the service, and they are stored in the same AWS London region as the service itself.

Who else is involved

• HMRC: receives the return itself; that is the point of the service.
• Stripe: processes payment (see Stripe's privacy policy for how it handles card data).
• Companies House: company-name search queries are passed to the public Companies House API to autofill registered details.
• Amazon Web Services: hosts the service and sends receipt emails; data is stored in the AWS London region (eu-west-2).
• Google: receives the visit and advertising measurement data described under Cookies and analytics below (see Google's privacy policy for how it handles it).
• Trustpilot: after HMRC accepts a return, your email address and the company name are passed to Trustpilot so that it can send you a single invitation to review the service. Nothing else from the filing is shared, and you can ignore the invitation.

We do not sell your data, and we do not share it with anyone else, for any purpose.

Cookies and analytics

The filing itself needs no cookies. The site loads Google's measurement tag for Google Analytics and Google Ads, which sets cookies in your browser to count visits, see which pages and adverts bring people here, and tell us when a visit ends in a filed return. These tags collect your IP address, browser and device details and the pages you view; they never see the contents of your return, your UTR or your Government Gateway sign-in, and they do not run on the payment page, which is hosted by Stripe.

You can block or delete these cookies in your browser settings, or install Google's browser add-on to opt out of Google Analytics. Blocking them does not affect your ability to file.

Your rights

Under UK data protection law you can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it (statutory filing evidence may need to be retained despite a deletion request, and we will explain if so). You can also complain to the Information Commissioner's Office at ico.org.uk.