Taxmo Privacy Policy

Who the controller is

The controller is DataIQ B.V., trading as Taxmo, registered with the Dutch Commercial Registrar (KvK) under number 96127953, at NDSM-Straat 117, 1033 NA, Amsterdam, The Netherlands. Taxmo is a trading name, not a separate legal entity.

As controller under UK GDPR Article 4(7), Taxmo determines the purposes and means of processing and is responsible for demonstrating compliance with the data protection principles. The same address handles both the controller and data protection contact: privacy@taxmo.co.uk.

The policy distinguishes Customer Personal Data, which is what you upload so the service can be delivered, from Account Personal Data, which is what is collected to run your account and the platform.

What is collected

Data you provide: registration and profile details including email, name, optional phone number, and tax details such as National Insurance number, UTR and income sources needed to prepare returns, plus documentation required to deliver the service. If you sign in through a social account, information you have consented to share there, such as a profile photo, may also be received.

Payment data: Taxmo keeps a history of transactions on your account. Card and bank details are handled by the payment processor and are not accessible to or stored by Taxmo.

Communications: what you send when you contact support or subscribe to the newsletter, including message content and attachments. The policy states that email tracking technologies such as beacons may be used to see whether emails were opened. Job applications sent in are processed as well.

Automatically collected data: cookies and similar technologies, device and usage information such as IP address, browser, operating system, pages viewed and timestamps, and a general region inferred from IP address. The policy states that no precise geolocation is collected.

Why it is processed, and on what basis

Stated purposes include providing and improving the service, communicating with you and providing customer support, enabling third-party connections you choose, marketing, personalising your experience, processing transactions, detecting and preventing fraud, and meeting legal and regulatory obligations.

The lawful bases relied on are consent for things like non-essential cookies and marketing, contract for account registration and service delivery, legal obligation for tax, accounting and HMRC-related requirements, and legitimate interests for service improvement, fraud prevention, analytics and product development, which you can object to.

Data that has been anonymised so it can no longer be linked back to you or your device falls outside the policy once de-identified.

Sharing and international transfers

Personal data is shared with service providers acting under Article 28 contracts, including hosting, payments, analytics and fraud prevention, with affiliates under common control, with third-party integrations you connect such as HMRC tools, where the law requires it, and in a business transfer. The policy states there are no sales of personal data.

Taxmo does not operate social features, and customer data such as tax records is not published or shared between users.

The policy names the processors Taxmo uses: Amazon Web Services for hosting and file storage, Neon for the database, Anthropic and OpenAI for the AI features, Resend for email, Stripe, Mollie and Apple for payments, Twilio for messaging, PayBank2Bank for Open Banking, Expo for push notifications, PostHog for analytics after consent, and Google for sign-in and, after you accept analytics cookies, for Tag Manager, Analytics and Ads conversion measurement, and Apple for sign-in. The application servers and database are hosted in the European Union, and uploaded receipts and documents are stored in the AWS Frankfurt region. Several providers are incorporated in the United States, so transfers to them are international transfers covered by a data processing agreement and the standard contractual clauses.

Where data leaves the UK, EEA or Switzerland, the transfer relies on an adequacy decision, or on Standard Contractual Clauses together with the UK International Data Transfer Agreement or Addendum. A copy of the safeguards can be requested from privacy@taxmo.co.uk.

Retention, security and your rights

Retention, as stated by the policy: client and business contact information, covering both Customer Personal Data and Account Personal Data, is kept for up to two years after the last business interaction, on the basis of legitimate interest in defending claims. Accounting records you create in the Service, such as invoices, quotes and credit notes, together with billing and payment data, are kept for seven years, covering the record-keeping period HMRC requires and the period for a claim under the Limitation Act 1980, and an automated job applies it. Newsletter data is kept until you unsubscribe. Technical and usage data is anonymised or deleted once it is no longer needed.

Security measures described include encryption, multi-factor authentication, secure encrypted connections, individually secured accounts and confidentiality obligations on staff. The policy is explicit that no method of transmission over the internet is entirely secure.

Your rights under UK GDPR Articles 15 to 22 are access, rectification, erasure, restriction, objection and portability, along with the right to withdraw consent at any time free of charge. Requests go to privacy@taxmo.co.uk and identity is verified first. Complaints can be made to the Information Commissioner's Office at ico.org.uk.

The service is not intended for anyone under 16, or the applicable local age of consent. Changes to the policy are published on the page with an updated effective date.