Privacy Policy

Last updated: 9th July 2026.

Speed Read

You should read this notice so you know how we handle your personal data. It explains who we are, how and why we collect personal data from you, how and why it will be processed by us, and our commitment to protecting your data.

• Who we are: Mistho Services Limited (“Mistho”, “we”, “us”, “our”). UK company number 13636487. ICO registration ZB253263.
• Two roles: We act as controller for our website, communications and security operations; and as processor (and your authorised agent) for your selected Partner during verification via a data source portal.
• Sources: in addition to logging in to a data-source portal, you can authorise untied (UT Tax Ltd) to retrieve your employment and income data from HMRC and to give consent for it to be shared. The authorisation is given directly via HMRC and is time-limited. We only receive — and transmit to your Partner — the data you consented to share, via untied’s API.
• What’s new: we retain transaction-level IP address data and related security signals at verification time to protect the service (e.g., geo-blocking, anomaly detection, credential-stuffing prevention). We don’t use this for marketing.
• Precision on scope: the verification workflow is short-lived, has no human interaction other than your own, and restricted to predefined pages of the data source portal that contain the data categories you were shown and consented to share. No human access; no stored credentials; tokens not re-usable.
• Sharing: we share data only with Partners (when acting as processor), service providers, professional advisers, authorities (where required), and in business transfers.
• Retention: we keep data only as long as needed. Security logs (incl. transaction-level IP) are typically retained up to 12 months for security, and may be kept longer for incidents or legal requirements.
• Transfers: when data leaves the UK, we use adequacy or appropriate safeguards (IDTA/SCCs + measures).
• Your rights: access, rectify, erase, restrict, object, portability; withdraw consent; complain to the ICO.

Contents

1. About Mistho
2. Role map (controller vs processor)
3. How the Mistho Service works
4. What we collect (data categories)
5. How we collect data
6. How we use data & legal bases
7. Communications
8. Disclosures
9. International transfers
10. Security
11. Retention
12. Your rights
13. UK Digital Identity & Attributes Trust Framework
14. Complaints & Incident Procedure
15. Sub-processors
16. Contact us

1) About Mistho

Mistho Services Limited is registered in England and Wales (company 13636487), registered office 27 Old Gloucester Street, London, WC1N 3AX.

Children: Our website is not intended for children and we do not knowingly collect data relating to children.

2) Role map (controller vs processor)

We operate in two roles. This table summarises purposes, typical data and legal bases.

We do not sell your personal data.

Roles & consent — how this works under UK GDPR. Mistho acts as a processor on behalf of its customers, who are the data controllers; untied is Mistho’s sub-processor under UK GDPR Article 28. Where the verification is embedded in a customer’s journey, you are first presented with that customer’s own terms and privacy notice — which link to Mistho’s terms and privacy notice (and ours, in turn, reference untied). The lawful basis and your consent sit with the customer (the controller); Mistho and untied process only the data you consent to share, on the customer’s documented instructions and on a transactional basis.

3) How the Mistho Service works

(when Mistho acts as a processor on behalf of a third‑party controller)

1. You are referred by a Partner and shown a consent screen describing the exact categories to be shared.
2. You log in to your data source portal and complete any required multi‑factor authentication yourself.
3. Our system starts a short‑lived, encrypted session with no human interaction other than your own . It isdeterministic and restricted to predefined pages that contain the consented categories.
4. No Mistho employee can view or interact with your account during the session. Credentials and session tokens are not stored or re‑usable by us.
5. The workflow terminates immediately after retrieval and transmits the data securely to your Partner for the stated purpose.

untied (HMRC) route. Where you choose the untied route, you authorise untied via HMRC (using Government Gateway or GOV.UK One Login). untied, acting as our sub-processor, retrieves the HMRC records shown on your consent screen and returns them to us via its API for transmission to your Partner. The authorisation is time-limited and is cancelled once the requested data has been retrieved.

4) What we collect (data categories)

A) When we act as  controller

B) When we act as  processor for your Partner

We collect only the categories shown on your consent screen and needed for the Partner Services. The collection involves no human interaction other than your own and is restricted to predefined pages of the data source portal.

Via the untied route: to initiate the check we collect your name, date of birth, National Insurance number and contact details, used to raise the HMRC agent authorisation. untied then retrieves your HMRC employment/income record and returns to us, per employer and tax year, the employer name, PAYE reference, employment start/end dates, gross employment income, other income, income tax paid and tax code — limited to the categories shown on your consent screen — for up to five tax years including the current year. As part of the HMRC retrieval untied may receive other data (including pension income), but this is not shared with us. No special‑category data is collected.

National Insurance number. We use your National Insurance number only to identify and match your record with HMRC through untied's agent authorisation (and, on the Passport route, to identify your HMRC record). It is minimised to that purpose, is not used as a general‑purpose identifier, and is deleted after the verification. Our lawful basis is your consent and right of access under Article 6(1)(a) UK GDPR (your selected Partner, as controller, sets its own basis). As a national identifier, your NINO is handled with the additional safeguards required by the Data Protection Act 2018; it is not special‑category data.

5) How we collect data

• Direct interactions: forms, support channels, surveys, newsletter sign‑ups.
• Automated technologies: site usage metrics; and for verification events, transaction-level IP and related security signals used for security and operations (not marketing).
• From other sources: where lawful, from Partners, analytics providers and other service providers, and — where you authorise the untied route — your HMRC employment and income data from untied (UT Tax Ltd) via its API.

Cookies: You can set your browser to refuse all or some cookies or to alert you when websites set or access cookies. See our Cookie Policy for details.

6) How we use data & legal bases

We will only use your personal data when the law allows us to. Most commonly: consent, contract, legitimate interests, and legal obligation.

Controller purposes include managing our relationship, responding to enquiries, administering our site, and ensuring network security.

Processor purposes include acting under the Partner’s instructions to provide the verification service.

We do not conduct profiling or automated decision-making that produces legal or similarly significant effects about you.

Processor purposes for Partners

We process the categories in Section 4B only under the Partner’s instructions to deliver the Mistho Service and transmit data to the Partner for the Partner Services.

7) Communications

Marketing communications: With your consent, we may send newsletters or updates. You can unsubscribe at any time using the link in any message.

Service communications: We may send essential service or policy-related messages under legitimate interests.

8) Disclosures

We share data only as needed for the purposes above.

We do not permit third‑party service providers to use your personal data for their own purposes and only allow them to process it for specified purposes under our instructions.

9) International transfers

When data leaves the UK, we ensure an essentially equivalent level of protection by using:

See Section 15 (Sub-processors) for our current sub-processors and their locations.

We also maintain an up-to-date version of this list on our Trust / Legal pages.

Personal data obtained via the untied route (HMRC employment/income data) is processed and stored in the United Kingdom. We will not transfer it outside the UK/EEA without an appropriate safeguard (adequacy, or IDTA/SCCs plus measures).

10) Security

We apply appropriate administrative, technical and organisational measures, including:

• Encryption in transit and at rest (including TLS/SSL).
• Principle of least privilege and strict access controls.
• Monitoring, logging and regular testing.
• Verification sessions are encrypted and short‑lived with no human interaction other than your own; restricted to predefined pages; credentials and session tokens are not stored or re‑usable; no staff can view or interact with your account during a session.
• Transaction‑level IP logs and related security signals are maintained to detect and prevent abuse (e.g., geo‑blocking, anomaly detection, credential‑stuffing prevention) and are not used for marketing.

We maintain procedures to handle suspected personal data breaches and will notify you and applicable regulators when legally required.

For the untied/HMRC route, authorisation takes place on HMRC’s own site, through government systems designed for this purpose. Neither we nor untied have access to your HMRC login credentials. Once you have authorised, the requested data is retrieved securely and the authorisation is then cancelled. Keep your login details private — do not share them or enter them on other websites.

11) Retention

We retain data only as long as necessary for the purposes collected or to satisfy legal/regulatory requirements. When no longer needed, we delete or anonymise; where immediate deletion is not possible (e.g., backups), we isolate until deletion.

12) Your rights

You may request access, rectification, erasure, restriction, objection, portability, and may withdraw consent where relied upon. If we act as processor, please contact the relevant Partner; we will assist them where needed.

No fee usually required. We may charge a reasonable fee or refuse to act on requests that are unfounded, repetitive or excessive.

We may need additional information to verify your identity.

We aim to respond within one month and will inform you if more time is needed for complex or multiple requests.

13) UK Digital Identity & Attributes Trust Framework

Mistho participates in the UK Digital Identity and Attributes Trust Framework and complies with its requirements as an Attribute Service Provider (see our Legal Notice).

14) Complaints & Incident Procedure

If you are dissatisfied with any aspect of our services, you may submit a complaint in accordance with our Complaints & Incident Procedure. Complaints & Incident Procedure relating to data collection, access, correction or deletion will be handled in line with UK GDPR and may require involvement of the relying party that originally collected or provided your data; we will coordinate with them to resolve your request.

15) Sub-processors

We use certain trusted third-party service providers (“sub-processors”) and affiliated group entities to host, transmit or store personal data when delivering the Mistho Service on behalf of Partners, and to operate our own business systems as a controller.

All sub-processors act only under our documented instructions, are bound by confidentiality and data-protection obligations, and are assessed for security and compliance before onboarding.

We maintain and update this list (including locations and new sub-processors) on our Trust / Legal pages. Where required by contract, we will notify Partners before onboarding a new sub-processor.

16) Contact us

Data Protection Officer (via Evalian Limited)

Email: dpo@evalian.co.uk

Post: Evalian Limited, West Lodge, Leylands Farm, 1 Nobs Crook, Colden Common, Winchester, Hampshire, SO21 1TH

You may also complain to the Information Commissioner’s Office (ICO) at http://www.ico.org.uk. We would appreciate the chance to deal with your concerns first, so please contact us initially.

Mistho Services Limited

Registered in England and Wales – 13636487