Privacy policy
The short version: you don't need an account, we don't keep the numbers you check, and we don't use cookies.
1. Who we are
Do the Sums is run by Kuda Mativenga, an individual based in the United Kingdom. For this website, Kuda Mativenga is the "controller" of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Contact: kuda@kudamativenga.com
2. What our tools do
Do the Sums offers free calculators and checkers for UK money questions, such as tax, pay, VAT and business figures. The site is being built: until a tool is live, this policy describes how it will work when it launches.
Our calculators work out the answer in your own web browser. The figures you type into a calculator stay on your device and are not sent to us.
3. The VAT number checker
The VAT number checker (coming soon) tells you whether a VAT registration number is valid and who it belongs to. To do that, it has to ask the official registers:
- UK numbers (starting GB, or XI for Northern Ireland): the number you enter is sent from our server to HM Revenue & Customs (HMRC) through its "Check a UK VAT number" service.
- EU numbers: the number you enter is sent to the European Commission's VAT Information Exchange System (VIES).
For a normal check, we send only the VAT number you want to check. HMRC or VIES tells us whether it is valid and, where available, the registered business name and address. We show you that result on screen.
If you ask for proof of a check (UK numbers), we also send your own VAT number to HMRC along with the number you are checking. HMRC then returns a reference number for the check, which you can keep as evidence that you checked the number. We show you this reference number on screen and do not keep it, or your VAT number.
If the business is a sole trader, the name and address returned may be personal data about that person. It comes from the official public register. We use it only to show you the result of your check.
HMRC and the European Commission are responsible for their own records and their handling of the request. See HMRC's personal information charter and the VIES website.
Why we can do this (lawful basis): legitimate interests. You asked us to check a number, or to get proof of a check, and we need to send the number or numbers to the register to answer.
4. What we keep, and what we don't
- No account is needed. We don't ask for your name, email or any login to use the tools.
- We don't keep the numbers you check, your own VAT number if you ask for proof of a check, or the results and reference numbers. The check is passed to HMRC or VIES and the answer is shown to you; we do not store any of it in a database or in our own logs.
- We don't sell or share your data for marketing.
5. Hosting and Cloudflare's logs
The site is hosted on Cloudflare Pages, run by Cloudflare, Inc. Like any website host, Cloudflare processes technical information about each visit so that it can deliver the pages and protect the site from attacks. This includes your IP address, the page requested, the time, and your browser type. Cloudflare acts as our "processor" for this information.
On how long this is kept, Cloudflare states that it processes this log data "on behalf of our customers in our data centers in the U.S. and Europe for a limited period of time" (Cloudflare GDPR FAQ). Its privacy policy (effective 4 November 2025) does not give a fixed number of days. It says data is deleted when its retention period ends, and that the period depends on the purpose and on legal obligations.
On the free plan we use, we can see only totals, such as the number of page views. We cannot see or download individual visitors' IP addresses. Because Cloudflare may process data in the United States, it relies on the international transfer safeguards described in its privacy policy.
6. Cookies and analytics
We don't use cookies today. We don't set any cookies, and we don't use similar technologies such as local storage to track you.
To count visits we use Cloudflare Web Analytics, which is cookie-free. According to Cloudflare, it "does not use any client-side state, such as cookies or localStorage". It does not track individual visitors over time by IP address or "fingerprinting". It shows us totals such as page views, the pages people visit, the referring site, and page loading speed.
7. Advertising in future
We may show adverts from Google AdSense in future to keep the tools free. Google AdSense can use cookies. Before any adverts appear, we will update this policy and add a consent banner, so that you can choose whether to allow advertising cookies.
8. If you email us
If you email us, we use your email address and message only to reply. Our lawful basis is legitimate interests. We keep the email only as long as we need to deal with your question, and normally delete it within 12 months.
9. Your rights and how to complain
Under the UK GDPR you have the right to:
- ask for a copy of the personal data we hold about you (right of access)
- ask us to correct it (rectification) or delete it (erasure)
- ask us to limit how we use it (restriction), or object to our use of it
- receive it in a portable format, where that applies
Because we don't keep the numbers you check and have no accounts, we usually hold no personal data about visitors beyond any emails you send us. To use any of these rights, email kuda@kudamativenga.com. We will reply within one month.
If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.
10. Security
The site is served only over an encrypted connection (HTTPS). Any keys we use to connect to HMRC are kept on our server and are never sent to your browser.
To report a security problem or a suspected data breach, email kuda@kudamativenga.com with "Security report" in the subject. We act on reports promptly. If personal data is affected, we will tell the ICO, and HMRC where relevant, within 72 hours of becoming aware of it.
11. Changes to this policy
We will update this page when the way we handle data changes, for example when a new tool goes live or before any advertising starts. The date at the top shows the latest version.