Privacy Policy

Last updated: 8 June 2026

1. Who we are

SimpleCompanyTax is a trading name of Infuzest Ltd (“we”, “us”, “our”). We provide a digital tax compliance platform designed to help UK micro companies, sole traders, and landlords meet their statutory reporting obligations, including Making Tax Digital requirements. For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, we act as the data controller for personal data collected through our platform. If you have any data protection queries, you may contact us at: privacy@infuzest.co.uk.

2. The data we collect

We may collect and process the following categories of data:

2.1 Identity and contact data — Name, email address, account credentials, communication records.
2.2 Business and tax data — Company information (e.g. company number), tax reference numbers, financial records and accounting information, filing data required for tax submissions.
2.3 Financial transaction data (where connected) — If you connect a bank account, we may receive transaction data including transaction descriptions, amounts, dates, account identifiers. We do not collect or store online banking passwords or security credentials.
2.4 Technical data — IP address, device information, browser type, usage logs, security and audit logs.

3. How we use your data

We process personal data to: provide access to our platform; generate statutory tax filings and financial reports; submit authorised filings to HMRC and Companies House; maintain digital tax records; categorise financial transactions; provide tax summaries and estimates; improve system reliability and security; prevent fraud and misuse; comply with legal and regulatory obligations. We do not use financial data for advertising, credit scoring, lending decisions, or marketing profiling.

4. Open Banking and data aggregation

If you choose to connect your bank account, we use regulated third-party Open Banking or data aggregation providers to retrieve financial transaction data securely and with your explicit consent. Authentication is performed directly with your bank through secure redirection flows. We use retrieved transaction data solely to maintain digital records, categorise income and expenses, generate tax summaries, and support authorised submissions to HMRC. You may revoke access at any time via your bank or within our platform settings. We do not sell, rent, or commercially exploit your financial transaction data.

5. Lawful basis for processing

Under UK GDPR, we rely on: Contractual necessity – to provide our services. Legal obligation – to comply with tax and accounting regulations. Legitimate interests – to operate, secure, and improve our platform. Consent – where required, including for Open Banking data access.

We do not sell personal data. We may share data only where necessary with: HMRC and Companies House for authorised submissions; regulated Open Banking or financial data providers (with your consent); cloud infrastructure and hosting providers; analytics providers (Google, via Google Analytics — only with your consent); professional advisers (legal, accounting); regulatory or law enforcement authorities where required by law. All service providers are required to implement appropriate security safeguards.

We never share your tax, financial, accounting, account, or other personal information that you provide to us with Google Analytics. Google Analytics only receives basic usage (telemetry) data — such as the pages you visit, the device and browser you use, and approximate (city-level) location — and only after you consent to analytics cookies. We use this solely to understand and improve how our website is used; it is never used for advertising and is never linked to your tax or financial records. See our Cookie Policy for details, and you can withdraw consent at any time.

7. Data security

We implement appropriate technical and organisational measures including: encryption in transit using TLS 1.2 or higher; encryption at rest within managed cloud environments; role-based access control; multi-factor authentication for administrative access; secure environment variable management; least-privilege access policies; audit logging and monitoring. We rely on reputable managed cloud providers that maintain industry-standard security certifications.

8. Data retention

We retain personal and financial data only for as long as necessary to provide our services, comply with statutory record-keeping requirements, and meet tax and accounting obligations. Financial and tax-related records may be retained for up to 6 years in line with UK legal requirements. Where legally permissible, you may request deletion of your account and associated data.

9. International transfers

Some service providers may process data outside the UK. Where international transfers occur, we ensure appropriate safeguards are in place in accordance with UK GDPR, including standard contractual clauses or equivalent protective measures.

10. Your rights

Under UK GDPR, you have the right to: request access to your personal data; request correction of inaccurate data; request erasure (subject to legal obligations); restrict or object to processing; data portability; withdraw consent (where consent is the lawful basis); lodge a complaint with the Information Commissioner’s Office (ICO).

11. Contact

For any privacy-related questions: privacy@infuzest.co.uk.

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the most recent revision.