Last updated: 29 October 2026
This notice explains how Taxlab Limited (“Taxlab”, “we”, “us”) collects and uses personal data about our clients, prospective clients, the people connected with our clients, and visitors to this website. It is provided under Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
1. Who we are
Taxlab Limited is the controller of your personal data. We are registered in Scotland (company number SC313001), with our registered office at 4 Glenfield, Livingston, West Lothian, EH54 7BG. Our trading address is 95 South Bridge Street, Bathgate, West Lothian, EH48 1TJ.
We are registered with the Information Commissioner’s Office (ICO), registration number Z1724845.
Our data protection lead is Inty Ahmed, Director. You can contact him at hello@taxlab.co.uk, by telephone on 0845 862 6009, or by post at our trading address.
2. The personal data we collect
Depending on our relationship with you, we may collect:
- Identity and contact details – name, address, email, telephone number, date of birth
- Identity verification records – copies of passports, driving licences and proof of address, and the results of electronic identity checks
- Tax and financial information – National Insurance number, Unique Taxpayer Reference, income, gains, bank details, pension and investment information, and other information needed to prepare accounts and returns
- Business information – details of directors, shareholders, persons with significant control, employees and subcontractors of the businesses we act for
- Payroll information – where we run payroll for an employer, details of that employer’s staff
- Correspondence – emails, messages and notes of calls and meetings
- Website information – information you enter in our contact, enquiry or newsletter forms, and technical information described in our cookie policy
We may receive some of this information from third parties, such as HMRC, Companies House, your bank, your previous accountant, your employer or business partners, and identity verification providers.
We do not normally need special category data (for example, health information). If we need it – for instance to claim a tax relief linked to a disability – we will only use it where the law allows and will tell you first.
3. Why we use your data and our lawful basis
- To provide our services to you – preparing accounts and tax returns, payroll, VAT, company secretarial and advisory work. Lawful basis: performance of our contract with you, or steps you ask us to take before entering a contract.
- To meet our legal and regulatory obligations – including customer due diligence under the Money Laundering Regulations 2017, record keeping, reporting to the National Crime Agency, filing with HMRC and Companies House, and our obligations as a member firm of ACCA. Lawful basis: legal obligation.
- To run our business – billing, recovering fees, quality control, maintaining our professional indemnity insurance and dealing with complaints or legal claims. Lawful basis: our legitimate interests in running a professional practice.
- Where we act for a business – using details of directors, shareholders and employees of that business. Lawful basis: our legitimate interests in providing services to our client, and legal obligation.
- To respond to enquiries made through our website. Lawful basis: steps you ask us to take before entering a contract, or our legitimate interests.
- To keep our website secure and working well – including spam and abuse protection, backups and visitor statistics. Lawful basis: our legitimate interests in running a secure website, and, for cookies, the rules described in our cookie policy.
- To send you news and updates about our services. Lawful basis: consent where required, or our legitimate interests for existing clients. You can opt out at any time.
Personal data we obtain to carry out anti-money laundering checks will only be used to prevent money laundering and terrorist financing, unless another use is permitted by law or you have agreed to it.
If you do not provide the information we need for anti-money laundering checks or for the work you have asked us to do, we may be unable to act for you.
4. When we act as a processor
When we run payroll or keep records for a business, that business is usually the controller of its employees’ data and we process it on its behalf under a written agreement. Employees with questions about how their data is used should first contact their employer.
5. Who we share your data with
We only share personal data where it is needed for the purposes above. This may include:
- HM Revenue & Customs, Companies House, The Pensions Regulator and other government bodies
- ACCA, as our professional body and anti-money laundering supervisor, for monitoring and regulatory purposes
- the National Crime Agency and law enforcement bodies, where the law requires
- our professional indemnity insurers, legal advisers and other professional advisers
- third parties you ask us to deal with, such as your bank, mortgage lender or solicitor
- an alternate practitioner appointed to look after our clients if our director is unable to work
- software and service providers who process data on our behalf, such as cloud accounting, tax, payroll, practice management, document storage, e-signature, email and identity verification providers (for example Xero, FreeAgent, QuickBooks, TaxCalc, BrightPay, Dext, Karbon, OnePageCRM, Zoho Sign, Google Workspace and Dropbox)
Our website
When you visit or use taxlab.co.uk, the following providers may process your personal data for us:
- IONOS – hosts our website and may store copies of information submitted through website forms
- OnePageCRM – receives the details you enter in our contact and enquiry forms
- Automattic (Jetpack and Akismet) – website security, spam filtering and visitor statistics
- Google – reCAPTCHA spam protection on our forms and login page, YouTube video embeds and Google Maps
- BlogVault and UpdraftPlus – secure website backups
- Our email newsletter provider – if you sign up to our newsletter
- WhatsApp and Meta (Facebook Messenger) – if you choose to message us using these services, they process your messages under their own privacy policies
Our service providers may only use your data under our instructions and must keep it secure. We do not sell personal data.
6. International transfers
Some of our software providers store or access data outside the UK. Where this happens, we make sure the transfer is protected – for example, the country is covered by UK adequacy regulations, or the provider uses the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can contact us for more information about these safeguards.
7. How long we keep your data
- Client files, including tax and accounting records: 7 years from the end of the tax year or accounting period they relate to, or 7 years after our engagement ends for information needed across several years (such as capital gains base costs)
- Customer due diligence records: at least 5 years after our business relationship ends, as required by the Money Laundering Regulations 2017
- Website enquiries from people who do not become clients: up to 2 years
- Newsletter subscriptions: until you unsubscribe
We may keep information for longer where we need it to deal with a complaint or legal claim.
8. Keeping your data secure
We use appropriate technical and organisational measures to protect personal data, including encrypted communications, secure client portals, access controls and multi-factor authentication. Our staff are bound by duties of professional confidentiality. Please do not send confidential documents through WhatsApp, Messenger or our website forms; we will give you a secure way to share them.
9. Your rights
You have the right to:
- be informed about how we use your data
- access the personal data we hold about you
- have inaccurate or incomplete data corrected
- have your data erased in certain circumstances
- restrict how we use your data in certain circumstances
- object to processing based on our legitimate interests, and to direct marketing at any time
- data portability, where processing is based on consent or contract and carried out by automated means
- withdraw consent at any time, where we rely on consent
Some rights are limited – for example, we cannot delete records we are required by law to keep, and we may be prevented from telling you about some anti-money laundering matters.
To exercise any of these rights, contact us using the details in section 1. We will respond within one month, which may be extended by up to two further months for complex requests. We do not normally charge a fee. We may ask you to confirm your identity.
We do not make decisions about you using solely automated processing.
10. Complaints
If you are unhappy with how we have handled your personal data, you have the right to complain to us. Please contact Inty Ahmed using the details in section 1. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you informed of progress and tell you the outcome.
You also have the right to complain to the Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; ico.org.uk/make-a-complaint. We would appreciate the chance to resolve your concern first.
11. Changes to this notice
We review this notice regularly. The date at the top shows when it was last updated. Where changes are significant, we will tell our clients directly.