Get started →

Last updated: 23 June 2026 · Version 1.0

This notice explains how Basetax Limited collects and uses your personal data when you visit our website, use our software, or engage us for accountancy and tax services, and the rights you have. We are committed to protecting your privacy and handling your data lawfully, fairly and transparently.

1. Who we are

Basetax Limited ("Basetax", "we", "us") is the data controller for the personal data described in this notice. We are registered in England and Wales (company number 09243228), with our registered office at 85 Tooting High Street, London, SW17 0SU. We are registered with the Information Commissioner's Office (ICO) under registration number ZA081604.

For any data-protection question, or to exercise your rights, contact us at kah@basetax.com, by phone on 0330 633 8888, or by post at the address above, marked "Data Protection".

2. The personal data we collect

  • Identity data — name, date of birth, National Insurance number, Unique Taxpayer Reference (UTR), and identity-verification information collected for anti-money-laundering checks.
  • Contact data — address, email address and telephone number.
  • Financial and tax data — income, expenses, bank and transaction details, employment, property, pensions, investments, VAT and other information needed to prepare your accounts and tax returns.
  • Account data — login credentials, settings and preferences.
  • Payment data — billing details and payment records (card payments are processed by our payment providers; we do not store full card numbers).
  • Technical and usage data — IP address, device and browser information, and how you use our website and software.
  • Communications — messages, support tickets and live-chat conversations with us.
  • Marketing preferences — your choices about receiving communications from us.

Most tax data is not "special category" data, but if you provide special category data (for example health information relevant to a claim) we will only use it where the law allows. We do not knowingly collect data from children.

3. How we collect it

We collect data directly from you (when you register, enter information, or contact us); automatically (through cookies and similar technologies when you use our website and software); and from third parties where you have authorised it, such as your bank via open banking, HMRC, or a previous adviser.

4. How and why we use your data, and our lawful bases

  • To provide our software and services, including preparing and filing returns and managing your account — lawful basis: performance of a contract.
  • To comply with our legal and regulatory obligations, including tax law, anti-money-laundering requirements (Money Laundering Regulations 2017 and the Proceeds of Crime Act 2002), accounting and record-keeping rules — lawful basis: legal obligation.
  • To verify your identity and prevent fraud and financial crime — lawful basis: legal obligation and our legitimate interests in protecting our business and clients.
  • To take payment for our services — lawful basis: performance of a contract.
  • To operate, secure and improve our website and software, and for analytics — lawful basis: our legitimate interests in running and improving our service.
  • To send you service messages (such as deadline reminders and important notices) — lawful basis: performance of a contract or legitimate interests.
  • To send you marketing about our services — lawful basis: your consent, or our legitimate interests where permitted, and always in line with the Privacy and Electronic Communications Regulations (PECR).

5. Who we share your data with

We do not sell your personal data. We share it only as needed to provide our services and meet our obligations, with:

  • HMRC and other authorities, where required to file returns or comply with the law.
  • Our regulator and professional body (ICAEW), for example during a quality or compliance review — its reviewers are bound by confidentiality.
  • Service providers acting on our behalf (processors), under written contracts requiring them to protect your data — for example our hosting provider, payment providers (Stripe and GoCardless), identity-verification and open-banking providers, our email and live-chat provider (Zendesk), and analytics providers.
  • Professional advisers and subcontractors who help deliver your engagement.
  • Acquirers, if our business is reorganised, sold or transferred, subject to confidentiality.

6. International transfers

Where a provider processes your data outside the UK, we ensure an appropriate safeguard is in place — such as the country being covered by UK "adequacy" regulations, or the use of the ICO's International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses). You can ask us for details of the safeguards used.

7. How long we keep your data

We keep your personal data only as long as necessary for the purposes above. In practice, tax, accounting and anti-money-laundering law generally requires us to keep client and engagement records for at least six years after the end of the relevant tax year or our engagement, and sometimes longer. When data is no longer needed we securely delete or anonymise it.

8. How we protect your data

We use appropriate technical and organisational measures — including encryption in transit, access controls and secure hosting — to protect your data against loss, misuse and unauthorised access. No system is completely secure, but we take our responsibilities seriously and will notify you and the ICO of any breach where the law requires.

9. Your rights

Under UK data protection law you have the right to: be informed about how we use your data; access a copy of it; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to processing; data portability; and, where we rely on consent, to withdraw that consent at any time. Some rights are qualified — for example, we may need to keep certain records to meet our legal obligations.

To exercise any right, contact us using the details in section 1. We will respond within one month (extendable for complex requests) and there is normally no charge. We may need to verify your identity first.

10. Marketing and your choices

You can opt out of marketing at any time using the unsubscribe link in our emails or by contacting us. Opting out of marketing does not stop service messages we must send to administer your account.

11. Cookies

Our website uses cookies and similar technologies — strictly necessary cookies to make the site work, and, with your agreement where required, analytics cookies to understand usage. You can control cookies through your browser settings.

12. Automated decision-making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Our software performs automated calculations, but a return is only submitted after you (or your adviser) review and approve it.

13. Changes to this notice

We may update this notice from time to time. The current version is always shown here with the "last updated" date; where changes are significant we will take reasonable steps to tell you.

14. How to complain

If you have concerns about how we handle your data, please contact us first and we will try to resolve them. You also have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — telephone 0303 123 1113, or at ico.org.uk.

Questions about your privacy? Contact us.