TaxEez is provided by the TaxEez team ("we", "us", "our", "TaxEez"). We are committed to protecting your personal data in line with the UK GDPR and the Data Protection Act 2018. This policy explains what we collect, why, how long we keep it, who we share it with, and the rights you have over it.
1. Who is responsible for your data
TaxEez is the data controller. Our responsible person for data protection can be reached at taxeez.support@gmail.com for privacy questions, rights requests, or complaints. You can also raise concerns with the ICO at ico.org.uk.
2. The personal data we collect
- Identity & account: name, email, role, trading name, and export name.
- Financial & tax: tax years, transactions, invoices, suppliers and amounts, recurring payments, and mileage logs.
- Documents: bank-statement and invoice files you upload, and the data extracted from them.
- Usage & technical: sign-in events, created/updated timestamps on your records, and device basics (browser, IP) collected by the platform hosting TaxEez.
3. Lawful basis for processing
- Contract — core tax features (extraction, classification, computation, tax pack generation) are necessary to deliver the service you signed up for.
- Consent — optional analytics, marketing communications, and optional anonymised data sharing. Off by default; withdraw any time in the Privacy & data rights page.
- Legal obligation — retaining payment records for accounting and tax compliance of TaxEez as a merchant.
- Legitimate interests — security, fraud prevention, audit logging, and service reliability.
4. How we use your data
Exclusively to run the features you signed up for — statement/invoice extraction, classification, mileage and recurring-payment tracking, tax computation, and exporting a tax pack you can submit to HMRC. We never sell your personal data.
5. Who we share your data with
- Our platform provider — database, authentication, hosting and file storage. They act as our processor.
- AI extraction providers — to read text out of the statement/invoice PDFs you upload, so we can store structured transactions and invoices.
- Our payment processor — card details are handled by its PCI-DSS gateway and never reach our servers.
- HMRC — only when you choose to submit your tax pack yourself. We do not share your data with HMRC automatically.
We do not sell your data and do not share it for advertising.
6. International transfers
Your data is stored on UK/EU-based infrastructure wherever practical. Where any component is processed outside the UK/EEA, we rely on UK International Data Transfer Agreements / Standard Contractual Clauses and the UK's data-transfer framework to keep your data protected.
7. How long we keep your data (retention)
- Tax records (transactions, invoices, mileage, recurring, tax years): until you delete them, or up to ~6 years after the relevant tax-year submission deadline where you ask us to retain for HMRC compliance.
- Uploaded documents: kept while needed to extract data; you can delete them at any time.
- Consent records & data-rights requests: retained as an audit trail in line with the accountability principle.
- Payment records: retained as long as needed for accounting, tax, and dispute resolution.
8. Security measures
We protect your data using appropriate technical and organisational measures, delivered through our platform and cloud infrastructure:
- Encryption in transit (TLS 1.3) for all connections.
- Encryption at rest (AES-256) for stored data, with managed key infrastructure.
- Role-based access controls and least-privilege staff access on a zero-trust basis.
- Audit logging of access and of consent / data-rights actions.
- UK/EU data-centre hosting aligned to ISO 27001 controls.
- Regular vulnerability scanning, with incident-response procedures for breach handling.
Note: encryption-at-rest, TLS, key management, and data-centre certification are platform-level guarantees delivered by our hosting provider. TaxEez configures and relies on these; we do not run our own key infrastructure.
9. Your rights under UK GDPR
- Access — get a copy of your data.
- Rectification — correct inaccurate data.
- Erasure — ask for your data to be deleted.
- Portability — receive your data in a structured, machine-readable form.
- Restriction / objection — limit or object to certain processing.
- Withdraw consent — at any time, for processing based on consent.
- Complain to the ICO if you are unhappy with how we handle your data.
Exercise any of these rights inside the app via Privacy & data rights, or email taxeez.support@gmail.com. We respond within one month, and complete verified deletions within 30 days.
10. Cookies & local storage
TaxEez uses only strictly-necessary browser storage — to remember your sign-in, your tax computation settings, and your chosen tax year while you move around the app. We do not use third-party tracking or advertising cookies, so no cookie consent is required. Optional analytics (off by default) would only run if you opt in.
11. Children
TaxEez is not directed at children and we do not knowingly collect data from anyone under 18.
12. Changes to this policy
We will update this policy as TaxEez evolves; the "last updated" date above shows when. Material changes that affect your rights will be highlighted in-app or by email where possible.