This policy explains what personal data Thom Tax collects through this website, why we collect it, and what you can do about it. It covers thomtax.co.uk only.
Who is responsible for your data
Thom Tax is the data controller for the personal data described here. That means we decide what is collected and why.
What we collect
Information you send us. If you email us or submit an enquiry, we receive whatever you choose to include. Typically that is your name, email address, phone number and details of the property you are asking about. We use it to answer you and, if you become a client, to carry out the work.
Information collected automatically, with your consent. If you accept cookies, we collect information about how you use the site: pages viewed, how you arrived, roughly where in the country you are, and what kind of device and browser you used. This is handled by the services listed below. If you reject cookies, none of it is collected.
Server logs. Our hosting provider records requests to the site, including IP address and user agent, for security and to keep the site running. This happens regardless of your cookie choice because it is necessary to deliver the site at all, and the data is not used to build a profile of you.
Why we are allowed to use it
- Consent for analytics and advertising. You give it through the cookie banner and can withdraw it at any time, as easily as you gave it.
- Legitimate interests for replying to enquiries, keeping records of the advice we give, and protecting the site from abuse. We have considered your interests and do not think any of this is surprising or intrusive.
- Legal obligation where tax, accounting or anti-money-laundering rules require us to keep records.
Who we share it with
We do not sell your data. We share it only with providers who help us run the site and the business, and only for that purpose:
- Google (Google Analytics and Google Tag Manager), for measuring how the site is used. Only after you accept analytics cookies.
- Meta (Facebook and Instagram), for measuring and targeting advertising. Only after you accept marketing cookies.
- Cloudflare, which hosts and delivers this site.
Some of these providers process data outside the UK, including in the United States. Where that happens, the transfer relies on the UK extension to the EU-US Data Privacy Framework or on the International Data Transfer Addendum to the standard contractual clauses.
How long we keep it
Enquiries that do not become work are kept for two years, so we can pick up a conversation you started and so we know we have spoken before. Client records are kept for six years after the end of the engagement, which is what tax and company law expects. Analytics data is retained for the period set in Google Analytics, currently fourteen months.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal data we hold about you
- correct anything that is wrong
- delete it, where we have no continuing reason to keep it
- restrict or object to how we use it
- send it to you, or another provider, in a portable format
You can withdraw consent to cookies at any time using the cookie settings, and read what each one does in the cookie policy. Withdrawing consent does not affect anything collected before you withdrew it.
We do not use automated decision-making or profiling that produces legal effects for you.
Complaints
If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk or on 0303 123 1113.
Contact
Contact details for data protection requests are being finalised and will be published here. In the meantime, please use the contact route shown on our contact page.
Changes
If we change what we collect or why, we will update this page and change the date at the top. Where the change is significant we will ask for your cookie consent again rather than assume the old answer still holds.