Privacy policy

1. Who we are

Taxley is operated by Taxley Limited ("we"), [registered office address], ICO registration [ICO number — once registered]. For your account details we are the data controller. For the company tax data you enter to prepare a return, you (the company) are the controller and we act as your processor.

2. What we collect

• Account: your name, email, hashed password.
• Company identity: company name, registration number (CRN), Unique Taxpayer Reference (UTR), registered office, director / declarant name.
• Financial: the income, expenses, balance-sheet and computation figures you enter, and the CT600, accounts and computations generated from them.
• Payment: handled by Stripe — we receive payment status and an identifier, never your full card number.
• Technical: an append-only audit log of actions, with a hashed IP address (never your raw IP), and essential cookies.

3. Why, and our lawful basis

• To provide the Service and file your return on your instruction — performance of a contract.
• To keep records of filings and secure the Service — legitimate interests and, for tax records, legal obligation.
• To take payment — performance of a contract.

4. Who we share it with

• HM Revenue & Customs — to file your CT600, accounts and computations, on your instruction.
• Companies House — to file your accounts, if you choose that option.
• Stripe — to process payments.
• Hosting / infrastructure sub-processors — [list providers], under contract.

We do not sell your data or use it for advertising.

5. International transfers

If any data is processed outside the UK, we use an approved transfer mechanism (UK IDTA or the UK Addendum to the EU SCCs).

6. How we protect it

Personal and identity fields and your generated filings are encrypted at rest; traffic is TLS-only; access is least-privilege; submission credentials are redacted before any document is stored. See our Security page.

7. How long we keep it

We retain tax records in line with HMRC requirements — generally six years from the end of the accounting period. Audit-log entries are retained and anonymised when an account is deleted. Other data is deleted on request (subject to that statutory retention).

8. Your rights

You have the right to access, rectify, erase, restrict, port and object. You can export or delete your data from the in-app My data page (subject to statutory retention of filed records). You can complain to the Information Commissioner's Office (ICO), ico.org.uk.

9. Contact

Data-protection queries: hello@taxley.co.uk.