Privacy Policy
Last updated: April 2026. We notify clients of material changes by email. The latest version of this notice is always published at this URL.
Data controller
TSG Taxation Ltd (company number 10835454) is the data controller for personal information collected through this website and in the course of providing professional services.
Registered office: Office G14 Moulton Park Business Centre, Redhouse Road, Northampton, Northamptonshire, NN3 6AQ.
ICO registration: ZB494209.
What we collect
When you submit a contact form or review request we collect your name, email address, phone number (if you provide it), the nature of your enquiry, and any details you include in your message.
If you become a client, we also collect the information required to perform the engagement and to meet our professional and legal obligations. This includes anti-money laundering identification (photograph ID and proof of address), financial information relevant to your tax affairs, and correspondence records.
Some of this information may include special category data under UK GDPR (Article 9) — for example, biometric details or nationality contained within a passport. We process it on the basis of substantial public interest in preventing money laundering and financial crime, as permitted by the Data Protection Act 2018, and in compliance with our obligations under the Money Laundering Regulations 2017.
We also collect anonymised website analytics (pages visited, browser type, referring site, country) using a self-hosted, cookieless analytics system. IP addresses are hashed with a daily-rotating salt and cannot be reversed.
Personal data about other people
When you engage us, you may give us personal data about other people — for example, your spouse’s tax details, employees’ payroll data, beneficial owners of a company, or business contacts named in correspondence.
By providing this data, you confirm that you have the right to share it with us and that the individuals concerned are aware their information has been provided to TSG Taxation Ltd for the purposes of our engagement. Where it is reasonable for us to do so, we may communicate directly with those individuals about how we are processing their data.
How we use it
We use your information to respond to enquiries, scope and price engagements, perform the services you have engaged us for, meet our regulatory obligations, and keep you informed about matters that affect you.
We do not sell your data. We do not share your data with third parties except the subprocessors listed below and where we are legally required to do so.
Marketing communications
We send three kinds of email:
Transactional — quotes, engagement letters, invoices, requests for information, filings, and reminders relating to work we are doing for you. These are sent on the basis of contractual necessity and cannot be opted out of while the engagement is in place.
Regulatory — notifications about changes in tax law, HMRC deadlines, or compliance matters that directly affect your position. These are sent to clients as part of the service you have engaged us for.
Marketing — newsletters, articles, and information about new services we offer. These are sent only to existing clients (under the soft opt-in basis in PECR Regulation 22(3)) or to people who have explicitly subscribed. Every marketing email contains an unsubscribe link. Unsubscribing affects only marketing — you will continue to receive transactional and regulatory communications relevant to your engagement.
You can also unsubscribe from marketing at any time by emailing team@tsgtaxation.com.
Profiling and lead scoring
When you submit an enquiry through this website we combine your submission with your anonymous browsing activity in the same session (pages visited, calculators used, time spent) to help us understand the nature of your enquiry and prepare for our first conversation. This is an automated process but has no legal effect on you and does not result in automated decisions being taken about you.
You have the right to object to this processing at any time. Email team@tsgtaxation.com and we will stop scoring your enquiry and remove the scoring data.
Legal basis
We process personal data on the following bases under UK GDPR:
- Consent — when you submit a form on this website, agreeing to our processing of your enquiry
- Pre-contractual steps — scoping your engagement and issuing a quote
- Contractual necessity — performing services you have engaged us for
- Legal obligation — regulatory, tax, and anti-money laundering duties (HMRC, Companies House, MLR 2017)
- Legitimate interests — responding to enquiries, preparing for first conversations, maintaining security, and improving our services
How long we keep it
We retain personal data only for as long as necessary:
- Enquiries that do not become engagements — 6 months from the date of submission, then automatically deleted
- Client records and engagement files — seven years from the end of the engagement (HMRC and professional body requirements)
- Anti-money laundering records — five years from the end of the engagement (MLR 2017)
- Website analytics — 24 months, then automatically deleted
- Invoicing and accounting records — seven years (Companies Act, VAT Act)
How we store it
All client data is held on our own systems in the United Kingdom. Sensitive files (anti-money laundering documents, client working papers) are held behind our office firewall and not stored on public cloud platforms. Website enquiry data is held on our UK-hosted server.
Subprocessors
We use a small number of third-party services to operate our business. Each has their own data processing agreement in place with us:
- Brevo (Sendinblue SAS, France) — transactional email (enquiry notifications, quotes, engagement letters, invoices)
- Stripe Payments UK Ltd — card payment processing. Card details are entered directly into Stripe’s hosted payment forms and do not pass through our systems.
- Our UK hosting provider — website infrastructure
International transfers — Brevo is established in France. Personal data transferred to Brevo is covered by the UK Government’s adequacy regulations for the European Economic Area, which means no additional safeguards are required for the transfer. All other subprocessors are UK-based.
We will update this list if we add or change subprocessors.
Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data (subject to our legal and regulatory retention obligations)
- Object to processing based on legitimate interests, including our lead scoring — we will assess your objection against our continuing legitimate interest
- Object to direct marketing at any time — this is an absolute right and we will stop marketing to you immediately
- Request data portability (receive your data in a structured, machine-readable format)
- Withdraw consent at any time (this will not affect processing we have already carried out)
To exercise any of these rights, email team@tsgtaxation.com. We will respond within one month.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office.
Cookies
This website does not use cookies for analytics or advertising. Our analytics system is entirely cookieless.
We use sessionStorage (not cookies) to remember temporary preferences during your visit, such as dismissing a banner. This data is cleared when you close your browser and is not transmitted to our servers.
Security
We take appropriate technical and organisational measures to protect personal data, including encryption in transit, firewall-protected storage for sensitive files, rate limiting on public forms, and restricted staff access on a need-to-know basis. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR.
Contact
If you have questions about this policy or how we handle your data, email team@tsgtaxation.com or write to us at our registered office.