Privacy Policy

This policy is issued by Amaesa Tax Ltd ([company number — to be added on incorporation]), trading as Amaesa Tax, of [registered office address — to be added once incorporated] ("Amaesa Tax", "we", "us" or "our"). We are registered with the UK Information Commissioner's Office ([ICO registration number — to be added once registered with the ICO]).

Amaesa Tax builds and operates a practice management platform for UK accountancy firms, covering Self Assessment, VAT, Payroll, Accounts & Corporation Tax, Bookkeeping, Company Secretarial and AML/KYC, together with a white-labelled client portal and app, document management, and billing.

This policy explains how we handle personal data when:

• an accountancy firm (a "Firm") signs up for and administers an Amaesa Tax account;
• a Firm's staff use the firm portal;
• a Firm's clients (an "Individual") use the white-labelled client portal or app; and
• anyone visits our marketing website at amaesa.co.uk.

If you're the client of an accountancy firm that uses Amaesa Tax, please also read that firm's own privacy notice — as explained in section 3, your firm is usually the controller of your tax and financial data, and their notice governs how they use it. This policy explains our role as their processor, and our role as controller for the platform itself (your account credentials, cookies, support communications, and so on).

UK data protection law distinguishes between two roles, and Amaesa Tax occupies both, depending on the data in question:

• Data controller — for account, billing, marketing and platform-usage data about Firms, their staff, and our own website visitors, we decide the purposes and means of processing, so we're the controller.
• Data processor — for the tax, financial, employment, company and due-diligence data that a Firm inputs, uploads, or has its clients submit through the platform in the course of using our modules, the Firm is the controller and Amaesa Tax is their processor, acting only on the Firm's documented instructions under Article 28 UK GDPR. Those instructions, and our obligations as processor, are set out in the data processing terms incorporated into our Terms of Service with each Firm.

This also applies to AML/KYC due diligence: the Firm remains the entity subject to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 ("MLR 2017") as the regulated accountancy service provider. We provide software to help them apply, record and review that due diligence — we don't decide who a Firm accepts as a client or what risk rating they apply.

• Account and identity data: name, work email address, role, firm affiliation, authentication credentials, and multi-factor authentication status.
• Tax and financial data (processed on a Firm's instructions): income sources (employment, self-employment, dividends, property, interest, capital gains, pensions), VAT transactions, payroll and National Insurance details, company accounts and Corporation Tax computations, ledger and bookkeeping entries, and company secretarial records (officers, PSC register, filings).
• Due diligence data: identity verification information and risk ratings captured through the AML/KYC module, which may include copies of identity documents. See section 7 on special category data.
• Documents: files uploaded to the platform (e.g. bank statements, invoices, engagement letters) and their metadata (filename, folder, upload date, visibility).
• Billing data: billing contact details, subscription plan, and invoice history. Card details are entered directly into Stripe and never touch our servers — see section 9.
• Communications: support requests, in-platform messages between a Firm and its clients, and correspondence with us.
• Usage and device data: IP address, browser and device information, pages visited, timestamps, and actions taken (login, filing, document access), captured in our append-only audit log.
• Cookies and similar technologies: see our Cookie Policy.

• Directly from you, when you register, use the platform, or contact support.
• From your accountancy firm, if you're their client — they invite you to the portal and may upload or enter information about you in the course of preparing your tax affairs.
• Automatically, through your use of the platform — server logs, audit log entries, and cookies.
• From third parties: HMRC and Companies House (confirming the status of a filing submitted at a Firm's instruction), Stripe (payment confirmation), and identity verification/AML providers once a Firm has engaged one through the platform.

Under UK GDPR Article 6, we only process personal data where we have a lawful basis to do so:

Identity verification carried out through the AML/KYC module may involve documents (such as a passport or driving licence) that reveal special category data within the meaning of Article 9 UK GDPR, or that a Firm chooses to treat with equivalent care. Where this applies, our lawful basis is the substantial public interest condition for preventing or detecting unlawful acts (Article 9(2)(g) UK GDPR, read with Schedule 1, Part 2, paragraph 10 of the Data Protection Act 2018), reflecting the Firm's own obligations as a regulated business under MLR 2017.

This data is processed strictly as instructed by the Firm, for due diligence and ongoing monitoring purposes only.

We use strictly necessary cookies to keep you signed in and to protect the platform, and — only with your consent — limited functional and analytics cookies. Full detail, including a table of every cookie we set, its purpose and its duration, is in our Cookie Policy.

• Sub-processors who host and run the platform on our behalf — our current list, including each one's location and international transfer safeguard, is published on our Sub-processors page and kept up to date.
• HMRC and Companies House, when a Firm instructs us to submit a filing on its behalf.
• Identity verification/AML providers, when a Firm runs a due diligence check through the platform.
• Stripe, our payment processor, to process subscription payments — card details are entered directly into Stripe's own hosted payment fields and never pass through our servers.
• Professional advisers (auditors, lawyers, insurers), bound by confidentiality obligations.
• Law enforcement, regulators, or courts, where we're legally required to disclose information — including under the Proceeds of Crime Act 2002 where a suspicious activity report obligation arises.
• A prospective buyer, in the event of a merger, acquisition, or sale of assets, subject to the same protections described in this policy.

We never sell personal data, and we never share it with outsourced third parties beyond what's listed above and on our Sub-processors page.

Our primary infrastructure is hosted in the EU/Ireland, which the UK's own adequacy regulations recognise as providing an adequate level of protection, so no additional safeguard is needed for that transfer.

Where a sub-processor is located outside the UK and the EEA (for example, in the United States), we put an appropriate transfer mechanism in place before any personal data is transferred — either the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or reliance on the UK extension to the EU–US Data Privacy Framework ("UK–US Data Bridge") where the recipient is certified. The safeguard used for each sub-processor is noted on our Sub-processors page.

• Tax and accounting data: retained for the duration of a Firm's contract with us, plus a reasonable period afterward to allow export or handover, reflecting the underlying statutory retention periods that apply to the Firm (HMRC requires Self Assessment records to be kept for at least five years from the 31 January filing deadline; company accounting records generally must be kept for six years under the Companies Act 2006).
• AML due diligence records: retained for five years from the end of the business relationship, in line with Regulation 40 of MLR 2017, unless a Firm is required or permitted to retain them for longer.
• Account data: retained while an account is active, and for a limited period afterward for legal and accounting purposes, generally aligned with the six-year contractual limitation period under the Limitation Act 1980.
• Audit logs: retained to support security investigation and to provide evidence of compliance.
• Marketing data: retained until you withdraw consent or unsubscribe.

Every table in our database is scoped by tenant and protected by Postgres Row-Level Security, so a bug in the application layer can never leak one Firm's data into another's. On top of that: TLS in transit, encryption at rest, mandatory multi-factor authentication for our own staff, an append-only audit log of every login, filing, document access and support action, and rate limiting/capacity quotas to keep the platform stable and to stop any single account from being able to overwhelm it.

If a personal data breach occurs that's likely to result in a risk to individuals, we'll notify the ICO within 72 hours as required by Article 33 UK GDPR, and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by Article 34.

Our Self Assessment, VAT, Payroll, and Corporation Tax computations are produced by deterministic, rules-based calculation engines — not artificial intelligence or machine learning — and every computation is held in draft until a Firm's own qualified staff review and approve it before anything is filed. Our AI-assisted document extraction feature only pre-fills draft fields from an uploaded document for a human to check; it doesn't decide anything by itself. We don't make any decision about you based solely on automated processing that produces legal or similarly significant effects, within the meaning of Article 22 UK GDPR.

Subject to certain exemptions and conditions, you have the following rights under UK GDPR:

• Right of access (Article 15) — request a copy of the personal data we hold about you.
• Right to rectification (Article 16) — ask us to correct inaccurate or incomplete data.
• Right to erasure (Article 17) — ask us to delete your data, subject to our (and our Firm customers') legal obligation to retain tax and AML records for the statutory periods described in section 11.
• Right to restrict processing (Article 18) — ask us to limit how we use your data in certain circumstances.
• Right to data portability (Article 20) — receive certain data in a structured, machine-readable format.
• Right to object (Article 21) — object to processing based on legitimate interests, and to direct marketing at any time.
• Rights related to automated decision-making (Article 22) — as explained in section 13, we don't currently make solely-automated decisions with legal or similarly significant effects about you.
• Right to withdraw consent at any time, where consent is our lawful basis, without affecting processing carried out before withdrawal.

If you're the client of a Firm that uses Amaesa Tax, your Firm is usually the controller of your tax and financial data, so they're the right first point of contact for most requests. You're also welcome to contact us directly at privacy@amaesa.co.uk: where we control the data ourselves, we'll respond directly; where we're only a processor, we'll pass your request to the relevant Firm promptly and let you know we've done so.

We'll respond within one calendar month of a valid request, extendable by a further two months for complex or numerous requests (Article 12(3) UK GDPR), and we may need to verify your identity first. There's ordinarily no charge, except where a request is manifestly unfounded or excessive.

We'd like the chance to put things right, so please contact us first at privacy@amaesa.co.uk. You also have the right to lodge a complaint with the UK's independent regulator at any time:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 · Website: ico.org.uk

Amaesa Tax is a business-to-business platform, and its Self Assessment, VAT, Payroll, Corporation Tax and AML functionality is inherently intended for use by adults and companies acting through their accountancy Firm. We don't knowingly collect personal data from children. If we become aware that we've done so without an appropriate lawful basis, we'll delete it.

We may update this policy from time to time. The "last updated" date at the top always reflects the current version; where a change is material, we'll notify Firms and account holders via the platform or by email. Earlier versions are available on request.

Amaesa Tax Ltd ([company number — to be added on incorporation])
[registered office address — to be added once incorporated]
ICO registration: [ICO registration number — to be added once registered with the ICO]

Privacy queries: privacy@amaesa.co.uk

See also our Terms of Service, Cookie Policy, Acceptable Use Policy and Sub-processors page.