Privacy policy

1. Who we are and our role

Taxley is operated by Taxley UK LLP ("we"), a limited liability partnership registered in England and Wales, LLP no. OC461735, registered office 27 Old Gloucester Street, London, WC1N 3AX. Taxley UK LLP is registered with the ICO (ZC263823).

• For your account, the payments you make and our records of your filings, we are the data controller.
• For the company tax data you enter to prepare a Return, you (the company) are the controller and we act as your processor, processing it on your instruction to produce and file the Return.
• If you use a practice (accountant or agent) account, the practice is the controller of the personal data it enters about its client companies and their directors and contacts, and we act as the practice's processor, on its instructions, under our Practice terms. If you are a client of a practice, please contact the practice about your data first; we will help it respond.

We are not required to appoint a Data Protection Officer under UK GDPR and have not appointed one. Please direct any data-protection query to hello@taxley.co.uk.

2. What we collect

• Account: your name, email address, and a hashed password (or a Google sign-in identifier if you use it).
• Company identity: company name, registration number (CRN), Unique Taxpayer Reference (UTR), registered office, and director / declarant name.
• Companies House authentication code: if you choose to save it, the six-character code Companies House gives your company to authorise online filings. We store it encrypted, never show it again, and use it only to send your company's filings to Companies House when you ask us to. You can remove it at any time on your company's details page.
• Financial: the income, expenses, balance-sheet and computation figures you enter, and the CT600, accounts and computations generated from them.
• HMRC filing sign-in: the Government Gateway user ID and password you enter each time you file a Return. Taxley uses them only to send that Return and never keeps your password; the user ID is kept, encrypted, in the submission record.
• Payment: payments go to Taxley UK LLP through Stripe — we receive payment status and an identifier, never your full card number.
• Website visits: your IP address, approximate location derived locally from it or from our CDN, pages viewed, referring site, and browser/device user-agent. Page views may be associated with your account if you sign in and, for up to 24 hours before signing in, on the same connection. We do not use cookies for this visit logging.
• Google Analytics (only if you accept analytics cookies): the pages you view on our public website, how you arrived (the referring site and any campaign tags), your approximate location (such as country and city), your device and browser type, and a pseudonymous ID kept in the _ga cookies. Google Analytics does not log or store the IP addresses of UK users. It runs only on our public pages, never in your account, and we send each page's address without its query string, apart from standard campaign tags. Our lawful basis is your consent, which you can withdraw at any time with “Cookie settings” at the bottom of any page on our public website (see our Cookie notice).
• Technical audit log: an append-only audit log of key account and filing actions, with a hashed IP address (never your raw IP), and strictly necessary cookies (see our Cookie notice).
• Questions & enquiries: if you use the "Ask us anything" form or the contact form, the name, email address and message you send us, and the page you were on. These arrive in our support mailbox by email and we reply by email.
• Making Tax Digital (Income Tax): National Insurance number (encrypted at rest), HMRC OAuth tokens (encrypted at rest), business details, income and expense records you enter or import. Where you connect your HMRC account, some data — such as your registered business details, filing obligations and previously submitted figures — is retrieved directly from HMRC on your instruction, rather than typed by you.
• Marketing list: if you tick the optional opt-in on the chat widget, or when you register or buy, we add your email to our own mailing list for occasional Taxley updates — with one-click unsubscribe in every such email.
• Client approvals (practice accounts): if an accountant or agent using Taxley sends you a link to approve a return, the name and email address they entered for you and — if you respond — the name, role and any comment you type, the time and your IP address. We share your response with that practice, which is the controller of this data.

3. Why we use it, and our lawful basis

• To provide the Service and file your Return on your instruction — performance of a contract.
• To take payment — performance of a contract.
• To keep records of filings, secure the Service and prevent misuse — legitimate interests, and for tax records a legal obligation.
• To understand how the website is used, diagnose abuse and improve customer journeys using cookieless page-view logs — legitimate interests.
• To measure how our public website is used with Google Analytics — your consent, only if you accept analytics cookies.
• To send you service and filing-status messages — performance of a contract; any optional updates rely on consent, which you can withdraw.
• To answer questions and contact-form enquiries — legitimate interests. To send occasional Taxley marketing updates — your consent (the opt-in tick-box) or, for customers, the “soft opt-in”. Every marketing email carries a one-click unsubscribe, and we permanently suppress unsubscribed addresses.

Providing your account details (name, email) is necessary to register — without them we cannot create your account. Providing your company and tax data (such as CRN, UTR and your financial figures) is necessary to prepare and file your Return — without it we cannot provide that part of the Service.

4. Who we share it with

• HM Revenue & Customs — to file your CT600, accounts and computations, on your instruction.
• Companies House — to file your accounts, if you choose that option. Once filed, some of this information (such as your accounts and certain director details) becomes part of the public Companies House register and is publicly available online, under Companies House's own rules and privacy policy.
• HMRC MTD API: if you connect your HMRC account, we send quarterly income/expense totals, annual adjustments, and final declarations on your instruction; HMRC's own privacy policy then applies.
• Stripe — to process payments to Taxley UK LLP.
• Hostinger — virtual private server hosting and email delivery, with the server located in the United Kingdom (London), engaged under contract and only to run the Service.
• Google — Google Analytics, only if you accept analytics cookies. Google Ireland Limited provides it to us and processes the data as our processor under Google's data processing terms. Google may process it in the USA through Google LLC; those transfers are covered by the UK–US data bridge (Google LLC is certified under the UK Extension to the EU–US Data Privacy Framework) and by the standard contractual clauses in Google's data processing terms.
• Where required by law — e.g. to comply with a legal obligation or protect our rights.

We do not sell your data, and we do not use it for advertising or third-party marketing.

Fraud-prevention headers: HMRC requires software to send device and connection metadata with each API call (IP address, browser user agent, screen dimensions, timezone, device identifier cookie). These headers are sent only to HMRC and are subject to their privacy policy.

5. International transfers

We aim to host and process data in the UK or EEA. If any data is processed outside the UK, we use an approved transfer mechanism (the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses), with appropriate safeguards.

6. How we protect it

Personal and identity fields and your generated filings are encrypted at rest; traffic is TLS-only; access is least-privilege; and the Government Gateway password is removed before any copy of a submission is stored (the user ID stays in it, encrypted). See our Security page for more.

7. How long we keep it

• Filed Returns and tax records — generally six years from the end of the accounting period, in line with HMRC requirements.
• Government Gateway sign-in — the password is held, encrypted, only while the Return is being sent; if sending fails, the encrypted record holding it is deleted within three days. The user ID is kept, encrypted, in the submission record for the same period as your filed Returns.
• Companies House authentication code — kept until you remove it on your company's details page or close your account.
• Account data — for as long as your account is open; deleted on request after closure, subject to the statutory retention above.
• MTD data (businesses, transactions, quarterly updates, declarations) — kept while your account is active and, after closure, for the same statutory retention period as other tax records, then deleted.
• Audit-log entries — retained for security, and anonymised when an account is deleted.
• Website visit logs — raw IP addresses are deleted after 30 days; page-view and visitor records are deleted after 90 days. Backups roll off under our normal backup schedule.
• Google Analytics data — Google Analytics keeps user- and event-level data for 14 months; aggregated reports that contain no personal identifiers may be kept longer.
• Enquiry emails and earlier live-chat transcripts — kept for up to 24 months to follow up on your enquiry, then deleted. Marketing-list entries are kept until you unsubscribe.

8. Automated decisions

Taxley performs automated calculations (for example the tax computation and iXBRL tagging), but it does not make decisions producing legal or similarly significant effects without your involvement — you review the figures and you make the declaration and the decision to file.

9. Your rights

Under UK data-protection law you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, including the Article 21 right to object where we rely on legitimate interests, and to withdraw consent where we rely on it. You can export or delete your data from the in-app My data page (subject to statutory retention of filed records). To exercise any right, contact us using the details below; we will normally respond within one month.

10. Data breaches

If a personal-data breach is likely to result in a risk to your rights, we will notify the ICO within 72 hours where required, and tell affected users without undue delay where the risk is high.

11. Complaints

Please raise any concern with us first at hello@taxley.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

12. Changes

We may update this policy from time to time. We will post the updated version here and, for material changes, take reasonable steps to notify you.

13. Contact

Data-protection queries: hello@taxley.co.uk.