The Nitty Gritty
Privacy Policy
The Tax Return Expert
Last updated 20.5.26
The Tax Return Expert is committed to protecting your personal information and being transparent about how we use it.
This privacy policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and your rights.
For the purposes of data protection law, The Tax Return Expert is the data controller for the personal data described in this policy, unless we tell you otherwise.
1. Who we are
The Tax Return Expert provides tax, accountancy, bookkeeping, compliance and advisory services to individuals, businesses, directors, landlords, sole traders, partnerships and companies.
Business name: Expert Accounting Services Ltd T/A The Tax Return Expert
Website: thetaxreturnexpert.co.uk
Email: team@thetaxreturnexpert.co.uk
Address: 59 Woodlands Rd, Chippenham, Wilts, SN14 0HQ
ICO registration number: ZA728622
2. Personal data we collect
We may collect and process personal data including:
Client name, business name, contact details, address, date of birth, National Insurance number, Unique Taxpayer Reference, VAT registration number, company registration number, tax references, HMRC identifiers, accounting records, bookkeeping records, payroll information, income details, expense details, bank transaction information, invoices, receipts, tax return information, company filing information, payment and liability information, correspondence, identity verification documents, engagement records, and information needed to provide our services.
For business clients, we may also process personal data relating to directors, shareholders, employees, contractors, customers, suppliers and other connected individuals where this is necessary for the services we provide.
3. How we collect personal data
We may collect personal data from:
You directly; your business, employer, agent or representative; HMRC; Companies House; accounting and bookkeeping software providers; payroll systems; banks and payment providers; identity verification providers; publicly available sources; professional advisers; and other third-party systems you authorise us to access.
We may also collect information through secure API integrations and software connections where you or your organisation have authorised us to act or where we otherwise have lawful access for service delivery.
4. How we use your personal data
We use personal data to:
Provide tax, accountancy, bookkeeping, payroll, VAT, Self Assessment, company compliance and advisory services; prepare and submit tax returns, accounts and filings; communicate with you; manage deadlines and compliance obligations; monitor tax liabilities and payment status; manage bookkeeping and accounting workflows; maintain records required by law and professional standards; verify identity and prevent fraud; respond to enquiries and complaints; manage our business operations; comply with legal, regulatory and tax obligations; and improve our services.
5. Use of HMRC, Companies House and accounting software integrations
We may use secure software integrations and APIs, including HMRC, Companies House, FreeAgent, Xero, QuickBooks and similar platforms, to access client tax, accounting, bookkeeping and company information where we are authorised to act or where access is necessary to provide our services.
This may include VAT obligations, VAT liabilities, VAT payments, Self Assessment account balances, company filing dates, accounting software invoice balances, bookkeeping status, bank reconciliation indicators and similar practice management information.
We use this information for accountancy, tax compliance, bookkeeping, advisory, workflow management and client support purposes.
We do not store client Government Gateway usernames or passwords. Where API access is used, access is managed using OAuth authorisation, API credentials or secure access tokens held within authorised systems.
Data retrieved through these integrations may be stored within our Google Workspace environment, including internal Google Sheets and dashboards used for practice management and compliance monitoring. Access is restricted to authorised members of The Tax Return Expert team through Google Workspace permissions.
6. Lawful bases for processing
We process personal data under one or more lawful bases, depending on the circumstances.
These may include:
Contract: where processing is necessary to provide services to you or take steps before entering into a contract.
Legal obligation: where processing is necessary to comply with tax, accounting, anti-money laundering, company law, record keeping or other legal obligations.
Legitimate interests: where processing is necessary for our legitimate business interests, such as managing client relationships, monitoring compliance deadlines, improving internal workflows, securing our systems and operating our practice, provided your interests and rights do not override those interests.
Consent: where we ask for specific consent, for example for certain optional communications or where consent is required by law.
The ICO says organisations must include information about their lawful basis in privacy information, and the lawful basis may affect which individual rights apply.
7. Special category data
In some cases, we may process special category data if it is relevant to the services we provide, for example health information affecting tax claims or benefits, or other sensitive information included in tax or financial records.
Where we process special category data, we will only do so where we have an appropriate lawful basis and an additional condition under data protection law.
8. Who we share personal data with
We may share personal data where necessary with:
HMRC, Companies House, accounting software providers, bookkeeping platforms, payroll providers, banks, payment processors, identity verification providers, cloud storage and IT service providers, Google Workspace, professional advisers, insurers, regulators, law enforcement agencies, and other third parties where required by law or necessary to provide our services.
We only share personal data where there is a valid reason to do so and appropriate safeguards are in place.
9. International transfers
Some of the systems and service providers we use may process data outside the United Kingdom. Where this happens, we take steps to ensure appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms.
10. How we store and protect personal data
We store personal data in secure business systems, including practice management systems, accounting software, cloud storage, Google Workspace, email systems and internal dashboards.
Access to client data is restricted to authorised staff who need it for tax, accountancy, bookkeeping, compliance, administrative or client support work.
We use technical and organisational measures to protect personal data, including access controls, user permissions, secure authentication, password controls, audit trails where available, and controlled access to internal systems.
OAuth access and refresh tokens used for API integrations are stored in authorised systems such as Google Apps Script Properties. We do not store HMRC Government Gateway usernames or passwords.
11. How long we keep personal data
We keep personal data only for as long as necessary for the purposes described in this policy, including to provide services, comply with legal and regulatory obligations, resolve disputes, and maintain business records.
In many cases, tax and accounting records may need to be retained for several years after the end of the relevant tax year or accounting period. Specific retention periods may vary depending on the type of record, legal requirements and the services provided.
When data is no longer required, we will delete, anonymise or securely archive it where appropriate.
12. Your rights
Depending on the circumstances, you may have rights under data protection law, including the right to:
Access your personal data; correct inaccurate or incomplete data; request deletion of your data; restrict processing; object to processing; request data portability; withdraw consent where processing is based on consent; and complain to the Information Commissioner’s Office.
The ICO provides guidance on individual rights under UK data protection law, including the right to be informed, access, rectification and erasure.
Some rights may be limited where we need to keep or use data to comply with legal obligations, establish or defend legal claims, or provide contracted services.
13. Marketing
We may contact you about our services where permitted by law. You can opt out of marketing communications at any time by contacting us.
We will not sell your personal data to third parties for marketing purposes.
14. Cookies
Our website may use cookies and similar technologies to operate the site, understand how visitors use it, improve performance, and support security.
Where required, we will ask for your consent before using non-essential cookies.
15. Security incidents and data breaches
If we become aware of a security incident or suspected data breach affecting personal data, we will investigate promptly.
We will review affected systems, users, records and access permissions. Where necessary, we will restrict access, revoke or rotate credentials or tokens, and take steps to reduce the risk of recurrence.
Where required, we will notify the Information Commissioner’s Office and affected individuals within the applicable legal timescales. Where an incident involves HMRC API data or software access, we will notify HMRC through the appropriate developer or support route.
16. Fraud prevention headers and HMRC APIs
Where we use HMRC Making Tax Digital APIs, we submit HMRC fraud prevention headers on relevant VAT and Self Assessment API requests.
Our internal dashboard uses a web application via server model because API calls are made server-side through Google Apps Script. The application sends available client, device, vendor and connection header information, including connection method, device ID, user identifier, browser/user-agent information, screen/window information, timezone, vendor product name/version and vendor identifiers.
The application does not operate its own separate application-level multi-factor authentication process. User access is controlled through Google Workspace authentication and permissions.
We do not store HMRC usernames or passwords. Users authorise access through HMRC OAuth.
17. Changes to this privacy policy
We may update this privacy policy from time to time. The latest version will be published on our website with the updated date.
18. Contact us
For questions about this privacy policy or how we use personal data, contact:
The Tax Return Expert
Email: admin@thetaxreturnexpert.co.uk
Address: 59 Woodlands Rd, Chippenham, Wilts, SN14 0HQ
You also have the right to complain to the Information Commissioner’s Office:
ICO website: https://ico.org.uk
ICO helpline: 0303 123 1113
More Nitty Gritty
Client Terms and Use of Software Integrations
The Tax Return Expert
Last updated 20.5.26
Client Terms and Use of Software Integrations
As part of providing accountancy, tax, bookkeeping, VAT, Self Assessment, company compliance and advisory services, The Tax Return Expert may use secure software tools, third-party platforms and API integrations to access, process and monitor client tax, accounting, bookkeeping and company information.
This may include information obtained from HMRC, Companies House, FreeAgent, Xero, QuickBooks and similar systems, where the client has authorised us to act or where we otherwise have lawful access for service delivery.
These systems may be used to support tax return preparation, VAT compliance, Self Assessment compliance, bookkeeping, company filing deadlines, tax liability monitoring, client communication, internal workflow management and practice compliance monitoring.
The Tax Return Expert does not store client Government Gateway usernames or passwords. Where API access is used, access is managed through OAuth authorisation, API credentials or secure access tokens held within authorised systems.
Access to client data is restricted to authorised members of The Tax Return Expert team who need access for service delivery, compliance monitoring, administration or client support.
The Tax Return Expert will use reasonable technical and organisational measures to protect client information and restrict access to authorised staff.
By engaging The Tax Return Expert to provide tax, accountancy, bookkeeping or compliance services, clients acknowledge that secure software tools and authorised API integrations may be used where appropriate to deliver those services.
We may update this privacy policy from time to time. The latest version will be published on our website with the updated date.