Transaction monitoring privacy notice

The WRA processes your data for transaction monitoring purposes to:

• keep your data safe, private and secure
• protect your data from people looking to use it for fraudulent and criminal purposes
• prevent fraud
• prevent, detect, investigate and prosecute civil and criminal activity

Transaction monitoring records information about you when you’re signed into our services.

We collect personal data about:

• the computers, phones or devices you use
• the internet connections you use
• what you do when you are on our services
• what you tell us

Transaction monitoring may collect your data even if you do not directly use our systems. For example, when an authorised tax agent or representative contacts us on your behalf.

When you sign in to one of our services, we create unique identifiers in the browser, application or device you’re using. We also give you a transaction monitoring cookie which we use to help recognise you and link you to your account.

The information we collect includes:

• unique identifiers
• browser type and settings
• device type
• operating system
• application version number

We also collect information about the interaction of your apps, software, browsers and devices with our services. This includes:

• your IP address
• date and time
• referrer URL of your request

We collect information about what you do in our services, such as:

• pages you access
• information you give us

We may also collect data about you from trusted security partners who provide us with information to protect against abuse.

We use this information to help improve the safety and security of our services. This includes detecting, preventing and responding to:

• fraud,
• abuse
• security risks
• technical issues that could harm the WRA or our customers

We collect and process your data as needed to carry out our official function as a government department. Also, to do so in the public interest, such as to prevent and detect crime and fraud.

As the WRA is permitted to carry out transaction monitoring without your consent under UK General Data Protection Regulation (GDPR) Article 6(1)(e), you cannot withdraw your consent.

We will, in some circumstances and where the law allows, share your personal information with third parties.

When we detect crime, we may share information with:

• other law enforcement agencies
• government departments
• credit reference agencies
• anti-fraud groups

We keep transaction monitoring records for 7 years, in line with our Retention and Disposal Schedule.

Where you've held an account longer than the standard retention period, we may hold some account information which is older but still up to date.

UK GDPR lists certain rights that apply to you when your personal data is stored and used as described. These rights relate to the legal basis for processing the data and the purposes to which the data are put.

For this purpose, your rights are limited to the right to be informed, which this notice covers. Other rights may apply in some circumstances.

For any questions about this notice or your rights, please contact our Data Protection Officer.

Send complaints to this contact in the first instance. You can also complain directly to the Information Commissioner’s Office (ICO). The ICO is the UK supervisory authority for data protection issues

Any changes to this privacy notice will be updated on this page, for example, any new uses of personal data.

From time to time, we may also contact you through other means about the processing of your personal data.