Privacy Policy

1. Who we are

SimpleCompanyTax is a trading name of Infuzest Ltd (“we”, “us”, “our”), a company registered in England and Wales (Company No. 15370218) with its registered office at 167–169 Great Portland Street, 5th Floor, London, England, W1W 5PF. We provide a digital tax compliance platform designed to help UK micro companies, sole traders, and landlords meet their statutory reporting obligations, including Making Tax Digital requirements. For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, we act as the data controller for personal data collected through our platform. If you have any data protection queries, you may contact us at: privacy@infuzest.co.uk.

Our services are intended for businesses and the individuals who run or represent them; they are not directed at individuals under 18 years of age.

2. The data we collect

We may collect and process the following categories of data:

• 2.1 Identity and contact data — Name, email address, account credentials, communication records.
• 2.2 Business and tax data — Company information (e.g. company number), tax reference numbers, financial records and accounting information, filing data required for tax submissions.
• 2.3 Financial transaction data (where connected) — If you connect a bank account, we may receive transaction data including transaction descriptions, amounts, dates, account identifiers. We do not collect or store online banking passwords or security credentials.
• 2.4 Technical data — IP address, device information, browser type, usage logs, security and audit logs.

3. How we use your data

We process personal data to: provide access to our platform; generate statutory tax filings and financial reports; submit authorised filings to HMRC and Companies House; maintain digital tax records; categorise financial transactions; provide tax summaries and estimates; improve system reliability and security; prevent fraud and misuse; comply with legal and regulatory obligations. We do not use financial data for advertising, credit scoring, lending decisions, or marketing profiling. We do not make decisions that produce legal or similarly significant effects about you solely through automated processing — tax estimates, transaction categorisation, and generated filings are tools prepared for your review and authorisation, not final automated determinations.

4. Open Banking and data aggregation

If you choose to connect your bank account, we use FCA-authorised Open Banking providers where applicable, or other regulated financial data providers, to retrieve financial transaction data securely and with your explicit consent. Authentication is performed directly with your bank through secure redirection flows. We use retrieved transaction data solely to maintain digital records, categorise income and expenses, generate tax summaries, and support authorised submissions to HMRC. You may revoke access at any time via your bank or within our platform settings. We do not sell, rent, or commercially exploit your financial transaction data.

5. Lawful basis for processing

Under UK GDPR, we rely on: Contractual necessity – to provide our services. Legal obligation – to comply with tax and accounting regulations. Legitimate interests – to operate, secure, and improve our platform. Consent – where required, including for Open Banking data access.

The basis we rely on depends on the activity:

6. Data sharing

We will never sell your personal data, tax information, accounting records, banking transaction data, or filing information to third parties. We may share data only where necessary with: HMRC and Companies House for authorised submissions; regulated Open Banking or financial data providers (with your consent); cloud infrastructure and hosting providers; analytics and advertising-measurement providers (Google, via Google Analytics and Google Ads); professional advisers (legal, accounting); regulatory or law enforcement authorities where required by law. All service providers are required to implement appropriate security safeguards.

We never share your tax, financial, accounting, account, or other personal information that you provide to us with Google. Google only receives basic usage (telemetry) data — such as the pages you visit, the device and browser you use, and approximate (city-level) location. We may report a conversion event when you subscribe to a paid plan; this event contains no tax, accounting, banking, or financial transaction data and is used solely to measure advertising effectiveness. Google's analytics tag is loaded only after you accept analytics cookies — before then it does not load and no usage data is sent to Google. See our Cookie Policy for details, and you can withdraw consent at any time.

7. Data security

We implement appropriate technical and organisational measures including: encryption in transit using TLS 1.2 or higher; encryption at rest within managed cloud environments; role-based access control; multi-factor authentication for administrative access; secure environment variable management; least-privilege access policies; audit logging and monitoring. We rely on reputable managed cloud providers that maintain industry-standard security certifications.

8. Data retention

We retain personal and financial data only for as long as necessary to provide our services, comply with statutory record-keeping requirements, and meet tax and accounting obligations. Financial and tax records are retained for the period required by applicable tax and accounting laws, which will generally be at least 6 years and may be longer where legally required (for example, during an open enquiry or dispute). Where legally permissible, you may request deletion of your account and associated data.

9. International transfers

Some service providers may process data outside the UK. Where international transfers occur, we ensure appropriate safeguards are in place in accordance with UK GDPR, including standard contractual clauses or equivalent protective measures.

10. Your rights

Under UK GDPR, you have the right to: request access to your personal data; request correction of inaccurate data; request erasure (subject to legal obligations); restrict or object to processing; data portability; withdraw consent (where consent is the lawful basis); lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters (ico.org.uk).

11. Contact

For any privacy-related questions: privacy@infuzest.co.uk.

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the most recent revision.