Privacy policy

1. Who we are and our role

Taxley is operated by Taxley Limited ("we"), registered office 27 Old Gloucester Street, London, WC1N 3AX, ICO registration ZC182652.

• For your account information, we are the data controller.
• For the company tax data you enter to prepare a Return, you (the company) are the controller and we act as your processor, processing it on your instruction to produce and file the Return.

We are not required to appoint a Data Protection Officer under UK GDPR and have not appointed one. Please direct any data-protection query to hello@taxley.co.uk.

2. What we collect

• Account: your name, email address, and a hashed password (or a Google sign-in identifier if you use it).
• Company identity: company name, registration number (CRN), Unique Taxpayer Reference (UTR), registered office, and director / declarant name.
• Financial: the income, expenses, balance-sheet and computation figures you enter, and the CT600, accounts and computations generated from them.
• Payment: handled by Stripe — we receive payment status and an identifier, never your full card number.
• Technical: an append-only audit log of key actions, with a hashed IP address (never your raw IP), and strictly necessary cookies (see our Cookie notice).
• Live chat & enquiries: if you use the chat widget or contact form, the name, email address and messages you send us, and the page you were on when you started.
• Making Tax Digital (Income Tax): National Insurance number (encrypted at rest), HMRC OAuth tokens (encrypted at rest), business details, income and expense records you enter or import. Where you connect your HMRC account, some data — such as your registered business details, filing obligations and previously submitted figures — is retrieved directly from HMRC on your instruction, rather than typed by you.
• Marketing list: if you tick the optional opt-in on the chat widget, or when you register or buy, we add your email to our own mailing list for occasional Taxley updates — with one-click unsubscribe in every such email.

3. Why we use it, and our lawful basis

• To provide the Service and file your Return on your instruction — performance of a contract.
• To take payment — performance of a contract.
• To keep records of filings, secure the Service and prevent misuse — legitimate interests, and for tax records a legal obligation.
• To send you service and filing-status messages — performance of a contract; any optional updates rely on consent, which you can withdraw.
• To answer chat and contact-form enquiries — legitimate interests. To send occasional Taxley marketing updates — your consent (the opt-in tick-box) or, for customers, the “soft opt-in”. Every marketing email carries a one-click unsubscribe, and we permanently suppress unsubscribed addresses.

Providing your account details (name, email) is necessary to register — without them we cannot create your account. Providing your company and tax data (such as CRN, UTR and your financial figures) is necessary to prepare and file your Return — without it we cannot provide that part of the Service.

4. Who we share it with

• HM Revenue & Customs — to file your CT600, accounts and computations, on your instruction.
• Companies House — to file your accounts, if you choose that option. Once filed, some of this information (such as your accounts and certain director details) becomes part of the public Companies House register and is publicly available online, under Companies House's own rules and privacy policy.
• HMRC MTD API: if you connect your HMRC account, we send quarterly income/expense totals, annual adjustments, and final declarations on your instruction; HMRC's own privacy policy then applies.
• Stripe — to process payments.
• Hostinger — virtual private server hosting and email delivery, with the server located in the United Kingdom (London), engaged under contract and only to run the Service.
• Where required by law — e.g. to comply with a legal obligation or protect our rights.

We do not sell your data, and we do not use it for advertising or third-party marketing.

Fraud-prevention headers: HMRC requires software to send device and connection metadata with each API call (IP address, browser user agent, screen dimensions, timezone, device identifier cookie). These headers are sent only to HMRC and are subject to their privacy policy.

5. International transfers

We aim to host and process data in the UK or EEA. If any data is processed outside the UK, we use an approved transfer mechanism (the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses), with appropriate safeguards.

6. How we protect it

Personal and identity fields and your generated filings are encrypted at rest; traffic is TLS-only; access is least-privilege; and submission credentials are redacted before any document is stored. See our Security page for more.

7. How long we keep it

• Filed Returns and tax records — generally six years from the end of the accounting period, in line with HMRC requirements.
• Account data — for as long as your account is open; deleted on request after closure, subject to the statutory retention above.
• MTD data (businesses, transactions, quarterly updates, declarations) — kept while your account is active and, after closure, for the same statutory retention period as other tax records, then deleted.
• Audit-log entries — retained for security, and anonymised when an account is deleted.
• Live-chat transcripts — kept for up to 24 months to follow up on your enquiry, then deleted. Marketing-list entries are kept until you unsubscribe.

8. Automated decisions

Taxley performs automated calculations (for example the tax computation and iXBRL tagging), but it does not make decisions producing legal or similarly significant effects without your involvement — you review the figures and you make the declaration and the decision to file.

9. Your rights

Under UK data-protection law you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw consent where we rely on it. You can export or delete your data from the in-app My data page (subject to statutory retention of filed records). To exercise any right, contact us using the details below; we will normally respond within one month.

10. Data breaches

If a personal-data breach is likely to result in a risk to your rights, we will notify the ICO within 72 hours where required, and tell affected users without undue delay where the risk is high.

11. Complaints

Please raise any concern with us first at hello@taxley.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

12. Changes

We may update this policy from time to time. We will post the updated version here and, for material changes, take reasonable steps to notify you.

13. Contact

Data-protection queries: hello@taxley.co.uk.