Privacy Policy

Who We Are

Tax Optimiser Ltd. ("us", "we", or "our"), a company registered in England and Wales under company number 11137513, with our registered office at 86-90 Paul Street, London, England, EC2A 4NE, operates the https://www.taxoptimiser.co.uk website and software (the "Service"). We are registered with the Information Commissioner's Office (ICO) under registration number ZA473706.

This policy explains what personal data we collect when you use the Service, how we use and share it, how long we keep it and the rights you have over it. Terms not defined here have the same meaning as in our Terms of Service.

Our Role

We are the data controller for personal data about our own customers and users: people who sign up for an account, visit our website, contact us or buy from us.

Where an accountancy firm, bookkeeper or other business uses the Service to hold data about its own clients (for example, a company's directors, shareholders or an individual's tax affairs), that business is the data controller and we act as its data processor, handling the data only on its instructions (see clause 11 of our Terms of Service). If your accountant uses Tax Optimiser for you, please contact them first about how your data is used; we will help them respond to your request.

Personal Data We Collect

Depending on which parts of the Service you use, we may collect:

• Account and contact data: your name, email address, telephone number, postal address, job title and login details, and the same for colleagues you invite.
• Identity data: date of birth and, where needed for a return, National Insurance number and Unique Taxpayer Reference (UTR).
• Company data: details of company directors, secretaries, trustees, shareholders and persons with significant control, directors' loan accounts and other information included in statutory accounts and Corporation Tax returns. Some of this is also taken from the public Companies House register.
• Financial and tax data: income, expenses, trial balances, bank transactions, VAT figures, capital gains, tax reliefs and anything else needed to prepare and submit Self Assessment, Making Tax Digital, VAT or Corporation Tax returns and statutory accounts.
• Bank details: account name, sort code and account number where you ask HMRC to make a tax repayment. These are stored encrypted.
• HMRC and Companies House credentials: such as a Government Gateway user ID and password for Corporation Tax filing, or a Companies House presenter ID. These are stored encrypted and used only to make filings you ask us to make.
• Documents you upload: spreadsheets, trial balances, PDFs and other files.
• Data from services you connect: if you link an accounting or banking system (such as Xero, Sage, QuickBooks or Starling Bank), we receive the data you authorise from that service.
• Billing data: subscription and payment history. Card details are handled by Stripe and are never stored by us.
• Support data: messages you send us by email or through our website chat.
• Usage and device data: IP address, browser type and version, device identifiers, pages visited, times and dates, and diagnostic and error logs.

We do not ask for special category data (such as health, religious beliefs or ethnicity). Please do not include it in documents or notes unless it is genuinely needed for a tax return.

HMRC Fraud Prevention Data

When you use the Service to connect to HMRC's Making Tax Digital services (VAT and Income Tax Self Assessment), HMRC requires us by law to send fraud prevention information with each request. This includes your public IP address and port, device identifier, browser and operating system details, screen and window size, time zone, and details of how you logged in (such as whether multi-factor authentication was used). We collect this data only to send it to HMRC and to keep a record of what was sent.

How We Use Your Data and Our Legal Basis

Under the UK GDPR we must have a legal basis for each way we use personal data:

• To provide the Service (performance of a contract, Article 6(1)(b)): creating and running your account, preparing returns and accounts, submitting them to HMRC and Companies House at your request, connecting to services you choose, billing and customer support.
• To meet legal obligations (Article 6(1)(c)): sending HMRC fraud prevention data, keeping financial and tax records for the periods required by law, and responding to lawful requests from authorities.
• For our legitimate interests (Article 6(1)(f)): keeping the Service secure, preventing fraud and abuse (including spam protection on our forms), fixing faults, understanding how the Service is used so we can improve it, and sending existing customers information about similar products and features. We only rely on this where your interests and rights do not override ours.
• With your consent (Article 6(1)(a)): sending marketing emails if you are not an existing customer, and setting non-essential cookies. You can withdraw consent at any time.

Marketing: if you are a customer, we may email you about similar products and services we offer, as allowed by the Privacy and Electronic Communications Regulations. Otherwise we will only send marketing with your consent. You can opt out at any time using the unsubscribe link in any email or by contacting us. We will still send essential service emails such as filing confirmations and deadline reminders.

AI features: some features, such as reading an uploaded trial balance or VAT workbook and suggesting account categories, send the relevant document content to our AI provider to generate suggestions. You review and confirm the results before they are used. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

Cookies

Cookies are small files stored on your device. We use:

• Essential cookies to sign you in, keep your session secure, protect our sign-up and contact forms from spam and abuse, and remember your cookie choice. The Service cannot work without these, so they do not need your consent.
• Optional cookies set by our website live chat provider. These are only set if you click "Accept optional" on our cookie banner.

We do not use advertising or tracking cookies. You can change your choice at any time using the "Cookie settings" link at the bottom of our website pages; rejecting optional cookies removes the live chat cookies. You can also block or delete cookies in your browser settings, but parts of the Service may not work without essential cookies.

Who We Share Data With

We do not sell your personal data. We share it only as described below.

Recipients at your request

• HM Revenue & Customs (HMRC): returns, submissions and fraud prevention data you ask us to send.
• Companies House: accounts and other filings you ask us to make. Filed accounts become part of the public register.
• Services you connect: such as Xero, Sage, QuickBooks, Starling Bank, Karbon or Sodium, where you choose to link them.
• Your accountant or firm: where your account is managed by or linked to an accountancy firm, that firm can see the data held in it.

Service providers (data processors)

These providers act on our instructions and may only use your data to provide their service to us. Our Sub-processors page has the full, current list, including where each provider processes data and how we notify customers of changes.

• Microsoft Azure (Microsoft Ireland Operations Ltd): hosting, databases, file storage and application monitoring. Our primary data is hosted in the UK South region.
• Anthropic (Anthropic, PBC): AI processing for document reading and categorisation suggestions. Data sent through the API is not used to train its models.
• Postmark (ActiveCampaign, LLC): delivery of service and transactional emails. Privacy policy
• Stripe (Stripe Payments UK Ltd and affiliates): payment processing. Privacy policy
• Google (Google Ireland Ltd): reCAPTCHA spam and abuse protection on sign-up and contact forms. Privacy policy
• Tawk.to (tawk.to inc.): website live chat, loaded only if you accept optional cookies. Privacy policy

Other disclosures

We may disclose personal data where required by law or a valid request from a court, regulator or other public authority; to protect the rights, property or safety of Tax Optimiser, our users or others; or to a buyer or successor if our business is sold or merged, in which case we will tell you before your data becomes subject to a different privacy policy.

International Transfers

Our main systems are hosted in the UK. Some service providers (including Anthropic, Postmark, Stripe, Google and Tawk.to) may process data in other countries, including the United States. Where personal data is transferred outside the UK, we make sure it is protected by an approved safeguard, such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses. Contact us if you would like more information about these safeguards.

How Long We Keep Your Data

• Tax and filing records: kept for as long as they may be needed to support a return or answer an HMRC enquiry, normally at least 6 years after the end of the company accounting period, or at least 5 years after the 31 January filing deadline for Self Assessment, and longer where a return is late, amended or under enquiry.
• Our own billing and accounting records: 6 years from the end of the financial year they relate to.
• Account data: kept while your account is active. When you close your account, we delete or anonymise it, except for records we must keep by law.
• Data we process for an accountancy firm: kept and deleted in line with that firm's instructions and our Terms of Service.
• Usage, security and diagnostic logs: kept for a shorter period unless needed to investigate a security issue or fault.

Security Of Data

We protect your data with encryption in transit (HTTPS) and at rest. HMRC credentials you give us, such as the Government Gateway user ID and password used to file Corporation Tax returns, are additionally encrypted before being stored, are never displayed once saved, and are used only to make submissions to HMRC on your behalf. Connections to HMRC for VAT and Making Tax Digital use HMRC's own authorisation, so we do not receive your password for those services.

Access to the Service is protected by passwords and multi-factor authentication, and access to customer data by our staff is limited to what is needed to provide and support the Service.

No method of transmitting or storing data is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to put your rights at risk, we will tell you and the ICO as required by law.

Your Rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectification of data that is inaccurate or incomplete.
• Erasure of your data, except where we must keep it by law (for example, tax records).
• Restrict how we use your data in certain circumstances.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Data portability: receive data you gave us in a commonly used electronic format.
• Withdraw consent at any time where we rely on consent. This does not affect processing already carried out.

You can update most account details yourself in your account settings. To exercise any other right, email privacy@taxoptimiser.co.uk. We may ask you to verify your identity. There is normally no charge, and we will respond within one month (extendable by two further months for complex requests, in which case we will tell you why).

Right to Lodge a Complaint

You have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator. We would appreciate the chance to deal with your concerns first, but you can contact the ICO at any time at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113.

Links To Other Sites

The Service may link to websites we do not operate, such as HMRC and Companies House. We are not responsible for their content or privacy practices, so please review their privacy policies.

Children's Privacy

The Service is not intended for anyone under 18, and you must be 18 or older to open an account. We do not knowingly collect personal data from children through account sign-up. If you believe a child has given us personal data, please contact us and we will delete it. This does not apply to data an adult user enters about a child where needed for a tax return.

Changes To This Privacy Policy

We may update this policy from time to time and will change the effective date at the top when we do. If we make a significant change, we will tell you by email or through a notice in the Service before it takes effect.

Contact Us

If you have any questions about this policy or how we handle your data, or want to exercise your rights, please contact us:

• Company: Tax Optimiser Ltd.
• Privacy queries: privacy@taxoptimiser.co.uk
• General queries: support@taxoptimiser.co.uk
• By post: Data Protection, Tax Optimiser Ltd, 86-90 Paul Street, London, England, EC2A 4NE