Draft: the business details in [square brackets] are still to be added.
Privacy policy
Last updated 1 November 2026
This policy explains what personal information TaxoLink collects, why, how long we keep it and your rights. It covers both parts of the service: Making Tax Digital for Income Tax (landlords and self-employed people) and Making Tax Digital for VAT. TaxoLink (taxolink.co.uk) is run by a sole trader trading as TaxoLink. Business address: 4 Sandal Avenue, Leicester, LE4 5HZ. In this policy "we" and "us" mean TaxoLink. We are the data controller for the information in your account. Contact us at [email protected]. Our Information Commissioner's Office registration number is [ICO registration number].
What we collect
Your account
| Information | Why | Lawful basis |
|---|---|---|
| Name, email address, mobile number (optional), password (stored only as a secure hash) | To create and secure your account | Contract |
| Sign-in codes sent to your email | Two-step sign-in, to protect your tax information | Contract; legitimate interests (security) |
| The services you chose at sign-up, how you keep your records, and your settings (such as reminder emails) | To show you only what applies to you | Contract |
Income Tax
| Information | Why | Lawful basis |
|---|---|---|
| National Insurance number and date of birth (stored encrypted) | HMRC needs your National Insurance number to find your businesses and deadlines | Contract |
| Property addresses and ownership shares, self-employed business names, income, expenses, receipts and spreadsheets you upload | To keep your digital records and prepare your quarterly updates and tax return | Contract; legal obligation (Making Tax Digital record keeping) |
| Your answers for the tax return (for example other income, reliefs and charges, losses and adjustments) | To send them to HMRC when you confirm your tax return | Contract |
| What HMRC holds for you: your businesses, deadlines, your status for Making Tax Digital, tax calculations and amounts due | To show your deadlines and HMRC's figures before you send anything | Contract |
VAT
| Information | Why | Lawful basis |
|---|---|---|
| Your VAT number, business name, address and contact details for invoices, and your VAT settings (scheme, return frequency, Flat Rate details) | To get your VAT deadlines from HMRC and work out your returns | Contract |
| Sales and purchase invoices you record (including your customers' and suppliers' names and addresses), adjustments, and VAT spreadsheets you upload | To keep your VAT records and work out the 9 boxes of each return | Contract; legal obligation (Making Tax Digital for VAT record keeping) |
| What HMRC holds for your VAT number: deadlines, amounts owed and payments | To show your deadlines and send you reminders | Contract |
If you record invoices, you are responsible for the information about your own customers and suppliers in them; we process it for you to keep your VAT records.
Both services
| Information | Why | Lawful basis |
|---|---|---|
| Your HMRC connections (access tokens, stored encrypted; Income Tax and VAT are connected separately) | To read from HMRC and send what you confirm | Contract |
| Copies of everything you send to HMRC, HMRC's receipts and responses, and the declaration you agreed to | Your submission history, and proof of what was sent | Contract; legal obligation |
| Device and connection details: IP address, a device identifier kept in your browser, browser type, screen and window size, time zone, and the time you completed two-step sign-in | The law requires software to send these "fraud prevention" details to HMRC with every Making Tax Digital request | Legal obligation |
| Security and activity logs (sign-ins, changes to records, submissions, IP address, browser) | To keep the service secure, investigate problems and keep an audit trail | Legitimate interests (security, fraud prevention) |
We don't use your information for advertising, we don't sell it, and we don't use tracking or analytics cookies.
Who we share it with
- HMRC: only when you connect your HMRC account and confirm something to send, plus the fraud prevention details the law requires with each request.
- Service providers who process data for us under contract:
- Hosting: our application and database run on our own server in the United Kingdom.
- Brevo (Sendinblue SAS, France): sends our emails (sign-in codes, reminders). It receives your email address and the email's text, never your tax figures.
- Cloudflare: protects and delivers the website. Your connection passes through Cloudflare's network, encrypted.
- Anyone we're legally required to share it with, such as a court or regulator.
Brevo is in the European Union, which the UK recognises as protecting personal data adequately (UK adequacy regulations). Cloudflare is a US company: transfers to it are covered by the UK Extension to the EU-US Data Privacy Framework and its contractual safeguards.
How long we keep it
- Your records and account (income, expenses, receipts, VAT invoices, uploaded files, what you sent to HMRC, your details): while your account is open, so you can keep your Making Tax Digital records here: HMRC requires them for at least 5 years after the 31 January deadline for Income Tax, and 6 years for VAT.
- Security and activity logs: kept with the records they relate to, as an audit trail of what was sent.
- HMRC access tokens: deleted when you disconnect from HMRC. HMRC's permission lasts at most 18 months.
- Sign-in codes: 10 minutes.
When you delete your account (Profile → Delete my account) we delete everything we hold for you at once, including uploaded files, and keep nothing. What you already sent to HMRC stays with HMRC, in your HMRC online account. Keeping your tax records for the periods above is your own duty, so download them first (Profile → Download my data).
How we protect it
Encrypted connections (HTTPS), two-step sign-in, passwords stored as hashes, encryption of HMRC tokens, National Insurance numbers and submitted data, strict access controls so customers can only see their own records, security headers, regular checks for software vulnerabilities, and audit logs. We never ask for or store your HMRC (Government Gateway) password: you sign in on HMRC's own website.
Reporting a security problem
If you think your account, or our service, has a security problem, email [email protected] straight away. We investigate every report, and tell the Information Commissioner's Office and HMRC about a personal data breach within 72 hours, as the law and HMRC require.
Cookies and browser storage
We use one essential cookie to keep you signed in, and store a random device identifier in your browser because HMRC requires it for fraud prevention. We don't use advertising or analytics cookies, so we don't ask for cookie consent.
Your rights
You can see and correct your information, delete it (Profile → Delete my account), restrict or object to how we use it, and get a copy to take elsewhere. You can download everything we hold for you at any time from Profile → Download my data, and your records as a CSV file from Transactions. For anything else, email [email protected]; we'll reply within one month.
You can also withdraw our access to HMRC at any time, in the app (Disconnect) or at HMRC: www.tax.service.gov.uk/applications-manage-authority.
If you're unhappy with how we handle your information you can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
Changes
We'll tell you about important changes to this policy by email or in the app.