Privacy Policy

Last Updated: 2 October 2026
Version: 2.0
Data Controller: Laura Brown, c/o TaxAssist Accountants, 45 Cowane Street, Stirling, FK8 1JW

1. Introduction

This privacy policy explains how we collect, use, store, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are committed to protecting your privacy and ensuring your personal data is handled securely and transparently. This policy applies to all personal data processed through our website, services, and direct interactions.

2. What Personal Data We Collect

We may collect and process the following categories of personal data:

Identity Data — including your name and title.

Contact Data — including your email address, phone number, and postal address.

Demographic Data — including your postcode and location.

Transaction Data — including details of services you have enquired about or purchased.

Technical Data — including your IP address, browser type, device information, and cookies.

Usage Data — including information about how you use our website and services.

3. Lawful Basis for Processing

We only process your personal data when we have a valid legal basis under Article 6 of UK GDPR. The legal bases we rely on are:

Contract Performance — We process your identity, contact, and transaction data when it is necessary to take steps at your request prior to entering into a contract, or to perform our contract with you. This includes responding to enquiries and providing accounting services.

Legal Obligation — We process your data when necessary to comply with legal obligations, such as tax regulations requiring us to maintain client accounting records for HMRC.

Legitimate Interests — We process your data where it is necessary for our legitimate interests, provided these interests do not override your rights and freedoms. Our legitimate interests include running and growing our business, developing and improving our services, keeping our records updated, fulfilling our duties to clients and employees, and ensuring website security and functionality.

4. How We Use Your Information

We use your personal data for the following purposes:

To provide accounting and tax services you have requested.

To respond to your enquiries submitted through our website contact form and communicate with you.

To maintain accurate business records.

To improve our website, products, and services.

To comply with legal and regulatory obligations.

To prevent fraud and ensure website security.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which we collected it. Our retention periods are as follows:

Client accounting records are retained for 6 years after the end of the financial year, as required by HMRC regulations.

Enquiry data from non-clients is retained for 2 years from the date of last contact.

Website log data is retained for 12 months.

Cookies and tracking data are retained as specified in our Cookie Policy, for a maximum of 13 months.

After these periods expire, your data will be securely deleted or anonymised.

6. Your Data Protection Rights

Under UK GDPR, you have the following rights:

Right to Access — You have the right to request a copy of the personal data we hold about you. To exercise this right, please contact us using the details provided below.

Right to Rectification — You have the right to request correction of any inaccurate personal data we hold about you. Please contact us with your updated information.

Right to Erasure — You have the right to request deletion of your personal data, also known as the right to be forgotten. Please contact us with your request. Note that this right is subject to our legal retention requirements, and we may need to retain certain data to comply with legal obligations.

Right to Restrict Processing — You have the right to request that we limit how we use your personal data. Please contact us with your request.

Right to Data Portability — You have the right to receive your personal data in a structured, commonly used, and machine-readable format. Please contact us to request an export of your data.

Right to Object — You have the right to object to processing based on legitimate interests. Please contact us with your objection.

Right to Complain — You have the right to lodge a complaint with the Information Commissioner's Office (ICO). See Section 11 below for contact details.

We will respond to all requests within one month. This period may be extended by two months for complex requests, in which case we will notify you within one month of receiving your request.

7. Data Security and International Transfers

We implement appropriate technical and organisational measures to protect your personal data. These measures include encryption of data in transit using SSL/TLS, access controls and authentication procedures, regular security assessments, and staff training on data protection.

Your personal data is primarily processed within the UK. However, some of our third-party service providers process data outside the UK. When this occurs, we ensure appropriate safeguards are in place, such as UK adequacy regulations for approved countries, UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs), and additional technical safeguards where required.

8. Third Parties and Data Processors

We use the following third-party service providers who may process your personal data on our behalf:

IONOS provides website hosting and server infrastructure for our website. When you submit personal data through our website contact form, IONOS processes this data as part of their hosting services. IONOS is based in Germany and operates within the EU.

Xero provides cloud-based accounting software for client record management and financial processing. Xero is based in New Zealand and processes data in accordance with UK GDPR requirements using Standard Contractual Clauses.

Microsoft (OneDrive) provides cloud storage services for document storage and file sharing. Microsoft processes data in accordance with UK GDPR requirements using Standard Contractual Clauses and UK International Data Transfer Agreements.

Google (Google Drive) provides cloud storage services for document storage and file sharing. Google processes data in accordance with UK GDPR requirements using Standard Contractual Clauses.

All processors are bound by data protection contracts requiring them to process data only on our documented instructions, ensure staff confidentiality, implement appropriate security measures, not engage sub-processors without our consent, assist with data subject requests, return or delete data at contract end, and submit to audits and inspections.

Arwen Williamson provides transcription and document preparation support. She is based in Inverness and processes data under a data protection contract with appropriate confidentiality and security measures.

We will never sell your personal data to third parties.

9. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enable core website functionality, analyse website traffic and usage, and remember your preferences.

When you first visit our website, you will be presented with a cookie banner allowing you to accept all cookies, reject non-essential cookies, or customise your preferences. Strictly necessary cookies, which are required for website operation, are set automatically. All other cookies require your active consent before being placed on your device.

For detailed information about the specific cookies we use, their purposes, and duration, please see our Cookie Policy. You can change your cookie preferences at any time by clicking the cookie settings link in our website footer.

What Are Cookies

Cookies are small text files stored on your device when you visit our website. They help the website function properly and improve your experience.

Cookies We Use

We use the following categories of cookies:

Essential Cookies — These cookies are necessary for the website to function and cannot be switched off. They are usually only set in response to actions you take, such as setting your privacy preferences, logging in, or filling in forms. You can set your browser to block these cookies, but some parts of the website will not work.

• Session Cookies — Set by IONOS to maintain your session while using our website. These expire when you close your browser.
• Contact Form Cookies — Essential cookies set by our IONOS contact form to prevent spam and ensure form functionality. These expire at the end of your session.

Functional Cookies — These cookies enable enhanced functionality and personalisation.

• TidyCal Cookies — Set by TidyCal (tidyhire.io) to enable our online booking system. These cookies remember your booking preferences and session information. TidyCal is based in the United States and processes data under Standard Contractual Clauses.

Social Media Cookies — These cookies are set by third-party social media platforms.

• Facebook Cookies — Set by Facebook (facebook.com) through our embedded Facebook widget that displays our posts. These cookies track your interaction with the widget and may be used by Facebook for their own purposes. Facebook is based in the United States and processes data under Standard Contractual Clauses.

Managing Cookies

When you first visit our website, you will see a cookie banner allowing you to:

• Accept all cookies
• Reject non-essential cookies (only essential cookies will be used)
• Customise your preferences by category

You can change your cookie preferences at any time by clicking the cookie settings link in our website footer.

How to Block Cookies

You can also block cookies through your browser settings. However, blocking essential cookies will prevent parts of our website from working properly. Instructions for managing cookies in common browsers:

• Google Chrome: Settings > Privacy and Security > Cookies
• Mozilla Firefox: Options > Privacy and Security > Cookies
• Microsoft Edge: Settings > Cookies and Site Permissions
• Safari: Preferences > Privacy

Cookie Duration

• Essential session cookies: Expire when you close your browser
• TidyCal functional cookies: Up to 13 months
• LinkedIn cookies: Up to 13 months

10. External Links and Social Media

Our website may contain links to external websites. We are not responsible for the privacy practices or content of these sites. We encourage you to review the privacy policies of any third-party sites you visit.

We maintain official profiles on social media platforms. Please verify profile authenticity before sharing personal information. We will never request passwords or sensitive data via social media. Social sharing buttons on our site may allow those platforms to track your activity.

11. Contact Information and Complaints

Data Controller:
TaxAssist Accountants
45 Cowane Street
Stirling
FK8 1JW

Contact for Data Protection Queries:
Laura Brown
Telephone: 01786 431 700
Email: laura@brownowl.scot

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk

12. Changes to This Policy

We review this privacy policy regularly and will update it to reflect changes in our practices or legal requirements. We will notify you of significant changes by updating the Last Updated date at the top of this policy, posting a notice on our website, and through direct communication where required by law. Please check this page periodically to ensure you are satisfied with any changes.

13. Downloads and Media Files

Any downloadable documents or media are provided at your own risk. While we take precautions to ensure authenticity, we recommend verifying files with antivirus software. We accept no responsibility for downloads from external third-party websites linked from our site.

END OF PRIVACY POLICY