Privacy Policy

1.0 Introduction

Taxflow Partners Limited (“Taxflow Partners”, “we”, “our”, “us”) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store and safeguard your information when you interact with us, use our website or become a client.

We are registered in England & Wales under company number 13357679, with our registered office at:

124 City Road, London, EC1V 2NX, United Kingdom

We are a CIMA Members in Practice firm authorised to provide accounting and related services.

For privacy enquiries, contact: privacy@taxflowpartners.com

2.0 Personal data we collect

We may process the following categories of data depending on the nature of our relationship with you:

Identity & Contact Data

• Name
• Job title
• Business email address
• Business phone number
• Company details

Client & Financial Data

• Accounting, bookkeeping and tax information
• Payroll data
• VAT, corporation tax and personal tax records
• Financial statements
• Information required for AML/KYC compliance
• Documents and communications relating to service delivery

Technical & Usage Data

• IP address
• Browser type
• Device information
• Website usage and analytics (only with your consent)
• Cookies (see section 9)

Marketing & Communications Data

• Communication preferences
• Interaction with our emails
• Records of opt-outs or suppression requests

We may collect information directly from you, via our website, during onboarding, or from publicly accessible sources such as Companies House. We may also receive business contact information from reputable third-party providers who confirm that they collect and share such data lawfully.

3.0 How we use your personal data

We only process personal data where a valid lawful basis applies under UK GDPR.

A. To perform a contract with you

Including:

• Preparing year-end accounts
• Corporation tax compliance
• VAT returns
• Payroll
• Bookkeeping and outsourced finance
• Management accounts
• Tax advisory
• Budgeting, forecasting and business advisory

B. To comply with legal obligations

Including:

• Anti-money laundering (AML) and Know-Your-Customer (KYC) checks
• HMRC and statutory reporting requirements
• Record-keeping obligations for regulated services

C. For our legitimate interests

We may process business contact information to:

• Communicate with individuals acting in a business capacity
• Promoting our services to relevant businesses
• Administer and improve our website and client experience
• Maintain secure systems and operational efficiency

Any direct marketing is limited, relevant and offers a clear opt-out option. We only contact individuals where our services may be relevant to their professional role. We maintain a Legitimate Interest Assessment (LIA) for this activity. We may use business contact details to send relevant business-to-business communications where we believe our services may be of interest. This may include contacting individuals at UK limited companies regarding accounting, tax, or financial services.

When you submit an enquiry, request a quote, or otherwise provide your contact details through a form on this website, we may use those details to send you occasional updates and offers about our services that are similar to those you enquired about. You can opt out at any time using the unsubscribe link in any message, or by contacting us (see “Your rights” below); we will stop straight away.

D. With your consent

We rely on consent for:

• Non-essential cookies
• Marketing where consent is required under PECR

Consent can be withdrawn at any time.

4. How we obtain business contact data

For business-to-business communication, we may obtain contact details from:

• Publicly available sources (e.g., Companies House, company websites, professional directories)
• Individuals who provide their information directly
• Third-party data enrichment and verification providers
• Manual research conducted from publicly available materials

We do not use consumer marketing lists and do not target personal email addresses intended for private use.

5. Sharing your personal data

We may share personal data with trusted partners including:

• Technology and communication service providers
• Professional advisers (legal, compliance, regulatory)
• Our insurers
• HMRC and other authorities where legally required
• Email delivery and campaign tools
• Data enrichment and verification providers
• Cloud hosting and infrastructure providers

Providers we use for this website

The following providers process personal data in connection with this website:

• Netlify, website hosting and form submissions (anything you enter into a form, plus technical data such as your IP address)
• Stripe, payment processing for online checkout (name, email address and payment details; card details go directly to Stripe and are never held by us)
• Loops, transactional and marketing email (name and email address)
• Supabase, hosting the data behind our location pages
• Google reCAPTCHA, preventing automated spam on our forms (IP address and browser/device signals). This is a necessary security measure and operates on all forms.
• Google Analytics, loaded via Google Tag Manager, measuring how the site is used (IP address, pages viewed, device and browser information). Loaded only if you consent to analytics cookies.
• Trustpilot, displaying our customer reviews. This is loaded only if you consent to it; decline and no request is made to Trustpilot at all.

We require all third-party providers to protect your data and only process it in accordance with our instructions and applicable data protection laws. These providers typically act as data processors on our behalf. However, in limited circumstances, certain providers may act as independent data controllers for their own purposes (for example, to operate, secure, improve, or ensure compliance of their services).

We never sell personal data.

6. International transfers

Some service providers may store data outside the UK. Where this applies, appropriate safeguards are used, such as:

• UK International Data Transfer Agreements (IDTAs)
• Standard Contractual Clauses (SCCs)
• Adequacy decisions

7. Data retention

We retain personal data only as long as necessary:

• Accounting and tax records, minimum 6 years
• AML/KYC records, 5 years after the business relationship ends
• Client communications, up to 6 years
• Business-to-business marketing contact data, no longer than 18 months from last meaningful engagement
• Your cookie preference, 12 months, after which you are asked again
• Analytics data (Google Analytics), 14 months

After retention periods expire, data is securely deleted or anonymised.

8. Your rights

Under UK GDPR you have the right to:

• Access your data
• Request correction
• Request erasure
• Object to processing (including direct marketing)
• Restrict processing
• Request data portability
• Withdraw consent
• Complain to the ICO (ico.org.uk)

You have the absolute right to object to your personal data being used for direct marketing at any time. If you object, we will stop using your data for this purpose immediately.

9. Cookies

We keep cookies to a minimum and do not use advertising cookies. Non-essential cookies, including analytics, are only set if you consent. Nothing in the optional list below loads until you accept.

Essential (always active)

• A cookie recording your cookie choice, so we do not ask again on every page.
• Cookies set by Google reCAPTCHA, which protects our forms from automated spam. This is a security measure necessary to provide the form, so it operates without consent, but it never prevents you from contacting us.
• Cookies set by Stripe during checkout, which are necessary to take a payment securely and to prevent fraud.

Optional (only with your consent)

• Google Analytics (loaded via Google Tag Manager), used to understand how visitors use the site so we can improve it. If you decline, Google Tag Manager is never loaded and no analytics cookie is set.
• Trustpilot, used to display our review rating. If you decline, no request is made to Trustpilot and no Trustpilot cookie is set.

You can change your choice at any time by clearing this site’s cookies in your browser, which will make the consent banner appear again.

10. Security

We use a range of technical and organisational measures to protect personal data, including:

• Encryption, including enforced HTTPS across this website
• Access controls
• Secure cloud infrastructure
• Spam and abuse protection on our web forms
• Regular monitoring
• Staff confidentiality and training
• Only authorised personnel access personal data.

11. Updates to this policy

We may update this Privacy Policy periodically. The updated version will be posted on this page, with a revised “Last updated” date.