Privacy policy

1. Who we are

Linx Tax Defence is a trading name of Linx Accounting Services Limited, a company registered in England and Wales, company number 11742116, registered office 124-128 City Road, London, England, EC1V 2NX.

We are licensed and regulated by the Association of Chartered Certified Accountants, licence number 4859891. We are the data controller for the personal data described in this policy, and we are registered with the Information Commissioner’s Office under registration number ZC094764.

Questions about this policy, or about anything we hold on you: info@linxtaxdefence.co.uk, or by post at the address above.

2. What this policy covers

This policy explains how we handle personal data when you:

• visit this website;
• contact us by WhatsApp, telephone or email about a possible engagement;
• respond to an advertisement we have placed;
• become a client of the practice.

3. What we collect, and when

When you visit this website

This site sets no analytics cookies and runs no analytics software. We do not build a profile of you, and we cannot tell who you are from a visit alone.

Our hosting provider, Cloudflare, processes technical information such as your IP address in order to serve the pages and to protect the site from attack. That is a necessary part of delivering any website.

If you agree to advertising cookies through the banner, we load the Meta Pixel and the Google Ads tag. They tell us whether an advertisement led to an enquiry, and nothing else — we do not use either to build advertising audiences. Section 10 and our cookie policy explain that in full. If you do not agree, neither is loaded and neither company is contacted.

When you contact us about an HMRC matter

By WhatsApp, telephone or email, we receive whatever you choose to send: typically your name, your contact details, an image of your HMRC letter, and what you tell us about your situation. On WhatsApp we also receive your display name and number.

We ask for this so we can identify what your correspondence actually is, tell you what deadline applies, and give you an accurate fee quotation.

When you use the enquiry form on this website

The form asks for your name, your email address, optionally a telephone number, which kind of HMRC correspondence you have received, any deadline shown on it, and whatever you write in the message box. Those answers are sent to our mailbox and nowhere else.

The form is part of this website rather than an embedded widget from another company. It sets no cookies, loads no third-party script, and nothing about your visit reaches us unless you press Send. We use Resend to carry the message from the website to our mailbox; Resend keeps a delivery log of the message for a short period, as any mail service does.

The form deliberately accepts no attachments. If you want to send a photograph of the letter, WhatsApp or email it — that way you decide what leaves your device.

One thing the form sends is not something you typed. If you arrived by clicking one of our Google adverts and you accepted advertising cookies, Google will have added a click identifier to the web address — a short code such as gclid. Your browser keeps it for the rest of that visit and sends it with your enquiry, so that we can tell which advert produced it. It identifies the advert and the click, not you: it is not your name, your location, your device or your browsing history, and on its own it means nothing to anyone but Google and us. If you chose “Essential only”, nothing is kept and nothing is sent. We do not currently send it back to Google; if that ever changes, we will say so here first.

If you respond to one of our advertisements

Where we run advertising that carries an enquiry form, the form asks for your name and contact details, the type of correspondence you have received from HMRC, whether the matter concerns a company, a sole trade, a partnership or your personal tax position, an approximate band for your turnover or income, and the response deadline that applies. The advertising platform passes those answers to us.

If you telephone the number shown in one of our advertisements

Our adverts on Google carry a call button. The number behind that button is a Google forwarding number — a number belonging to Google that rings straight through to us. It exists so we can tell which adverts produce real telephone enquiries rather than clicks.

Because the call is connected by Google, Google knows it happened. Google records the number you called from, the date and time, how long the call lasted, whether it connected, and the area you called from. Google reports that back to us in a limited form: we see the date, time, duration, whether it connected and your area code — not your full telephone number, unless you tell it to us yourself during the call. Calls placed this way are not recorded by Google or by us.

If you become a client

We then collect what the engagement requires: financial records, the documents needed for identity and anti-money-laundering checks, and correspondence with HMRC conducted on your behalf.

4. Why we use it, and our lawful basis

Where we rely on consent you can withdraw it whenever you like: reply “STOP” to any WhatsApp message, email us, or use cookie settings for advertising cookies. Withdrawing consent does not affect anything we did lawfully beforehand.

Where we rely on legitimate interests, we have weighed our interest in responding against your rights and concluded it does not override them, because you approached us and are expecting an answer.

5. Who we share it with

We do not sell your personal data, and we never will. We share it only with:

• Cloudflare — hosts this website and delivers its pages.
• Microsoft — our email and document storage (Outlook and SharePoint).
• Resend — carries submissions from the enquiry form on this website to our mailbox. It sees the message in order to deliver it and keeps a delivery log; it is not used for marketing email and holds no list of any kind.
• HubSpot — our client relationship management system, which holds your contact details and the status of your enquiry. Our HubSpot account is hosted in the European Union.
• Meta Platforms — where you contact us on WhatsApp, or submit a form through one of our advertisements, Meta processes that data under its own privacy policy. Where we measure which advertisements produce genuine enquiries, any information we send Meta is hashed and pseudonymised first.
• Google — if you agreed to advertising cookies and you reached us from a Google search advertisement, Google is told that an enquiry was sent. It is told that an advertisement worked, not who you are: we send no name, no email address and no telephone number, and the tag loads for nobody who declines advertising cookies. Separately, if you ring us using the call button in one of our Google adverts, Google connects that call through a forwarding number and therefore processes your telephone number, the time and the duration. That part happens in the advert rather than on this site, so the cookie banner does not control it — see “If you telephone the number shown in one of our advertisements” in section 3.
• HMRC — only where you have engaged us and authorised us to act as your agent.
• Our regulator (ACCA), our insurers and our professional advisers — where we are required or entitled to disclose.

We have written data-processing terms in place with each of these providers.

6. Transfers outside the UK

Some of those providers process data outside the United Kingdom. Where they do, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision, as appropriate to that provider.

7. How long we keep it

• Enquiries that do not become engagements: 12 months from your last contact with us, then deleted.
• WhatsApp conversations with non-clients: 12 months.
• Enquiry form delivery logs held by Resend: retained by Resend under its own published retention period, which is shorter than ours. The message itself lives in our mailbox and follows the enquiry retention above.
• Client records: at least 6 years after the engagement ends, to meet HMRC and ACCA record-keeping requirements.
• Anti-money-laundering records: 5 years from the end of the business relationship, as the regulations require.

8. Your rights

You have the right to:

• be told what we hold about you, and get a copy of it;
• have anything inaccurate corrected;
• have data deleted where there is no good reason for us to keep it;
• object to, or ask us to restrict, how we use it;
• ask us to transfer it to another provider;
• withdraw consent at any time.

Email info@linxtaxdefence.co.uk to exercise any of these. We will respond within one month.

Where the law requires us to keep records — anti-money-laundering material in particular — we may not be able to delete on request. If that applies we will tell you which obligation prevents it.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.

9. Security

We hold your data on access-controlled systems, encrypted in transit and at rest, and restrict access to those in the practice who need it for your matter. No system is perfectly secure, but we take the protection of client data seriously and review our arrangements annually.

This is also why we ask you not to send financial documents or identity papers at the enquiry stage: the fewer sensitive documents in transit before there is a reason for them, the better.

10. Cookies

This site sets no non-essential cookies unless you agree. Our cookie policy sets out exactly what is set, by whom, and how to change your mind — and you can reopen the choice at any time using cookie settings.

11. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If we start using a new system that handles your data, we update this policy before that system goes live rather than afterwards. Where a change materially affects clients, we tell them directly.