Privacy policy

The short version

Who we are

Linx Accounting is the trading name of Linx Accounting Services Limited, a company registered in England and Wales, company number 11742116, registered office 124-128 City Road, London EC1V 2NX.

We are the controller of the personal data described in this policy, which means we decide why and how it is used. We are registered with the Information Commissioner’s Office (ICO), registration number ZC094764, and licensed by the Association of Chartered Certified Accountants (ACCA), firm licence 4859891.

For any question about this policy or about data we hold on you, email info@linxaccounting.com or write to us at the registered office.

Linx Tax Defence and Linx Automate are trading names of the same company. Each has its own website and its own privacy policy, which describe the processing on those sites.

What this policy covers

This policy applies when you:

• visit linxaccounting.com;
• contact us through the website, by email, by telephone or on WhatsApp;
• refer someone to us, or are referred to us by someone else;
• become a client, or are connected with a client, for example as a director of a client company or an employee whose payroll we run.

When you visit the website

Hosting and security

The website is hosted on Cloudflare Pages. Every request for a page passes through Cloudflare, which processes your IP address and the technical details your browser sends, such as the page requested, the browser type and the time, in order to deliver the page and protect the site from attack. Cloudflare keeps request and security logs for a limited period under its own terms. We do not use this information to identify visitors.

Google Analytics, only if you accept

On your first visit a banner asks whether you accept analytics cookies. If you choose Accept, the site loads Google Tag Manager, which loads Google Analytics 4.

Google Analytics tells us, in aggregate, which pages are read, how people found the site, roughly where they are and what kind of device they use. It sets two cookies to do this, listed in our cookie policy. Google uses your IP address to estimate an approximate location, and says that Google Analytics 4 does not log or store IP addresses.

We use Google Analytics to understand how the site is used and to improve it. We do not use it for advertising, and we cannot identify you from it. Google processes the data to provide the service to us; it explains how in How Google uses information from sites or apps that use our services.

If you choose Reject, neither Google Tag Manager nor Google Analytics loads, and your browser sends no request to Google from this site. You can change your choice at any time with the Cookie settings link at the foot of every page.

What the site does not do

The site carries no advertising tags, no Meta Pixel, no Cloudflare Web Analytics and no embedded third-party forms or chat widgets. Its fonts are served from our own domain, so loading a page sends no request to Google Fonts or any other font service.

When you contact us

The contact form

The contact form asks for your name, your email address, optionally a telephone number, what your enquiry is about, and your message.

When you press send, the form goes to a small program that runs on this website’s own domain (a Cloudflare Pages Function). It passes your message to Resend, an email delivery service, which delivers it to our Microsoft 365 mailbox at info@linxaccounting.com. Resend keeps a delivery record for a short period under its own terms; the message itself is kept in our mailbox.

The form records only what you type. It does not record your IP address or details of your browser or device, it takes no attachments, and it sets no cookies. To keep out spam it uses a hidden field that people never see but automated programs tend to fill in, and a check that the form was not sent implausibly quickly. There is no CAPTCHA and no third-party script.

Please do not send identity documents, bank details or tax records through the form. If you become a client, we will ask for what we need at that point.

Email and telephone

If you email or telephone us, we receive your contact details and whatever you tell us. Emails are held in our Microsoft 365 mailbox.

WhatsApp

The WhatsApp buttons on this site are links to wa.me, which opens WhatsApp on your phone or computer. WhatsApp is a service of Meta Platforms. The link fills in a short opening message, which you can edit or delete; nothing is sent until you press send in WhatsApp.

If you message us, we receive your WhatsApp number, your profile name and your messages. Meta processes them under WhatsApp’s own terms and privacy policy.

Referrals

If you refer someone to us

The referral form asks for your name and email address; the name of the person you are referring and, if you have them, their business name, telephone number and email address; and a message. It is delivered in the same way as the contact form, records nothing you do not type, and takes no attachments.

Please refer someone only if they have agreed to hear from us. The form asks you to confirm that they have. When we contact them, we tell them that you passed on their details. Our professional duty of confidentiality means we will not tell you whether they become a client, or anything about their affairs, unless they agree.

If someone has referred you to us

If someone used our referral form to pass on your details, we hold your name, whatever contact and business details they gave us, and their message. Our lawful basis is legitimate interests: the person who referred you has told us you agreed to hear from us, and we use your details only to make that contact.

When we first contact you, we tell you who passed on your details and how we received them, and we offer to delete them. If you would rather not hear from us, or would simply prefer that we did not keep your details, tell us and we will delete them and not contact you again.

If you become a client

Once you engage us we need more information, and what we collect depends on the work. It typically includes the following.

• Identity and anti-money-laundering checks. The Money Laundering Regulations 2017 require us to verify who our clients are and, for a company, who owns and controls it, before we act. We collect identity documents and proof of address, and may use an electronic identity-checking service. Personal data we obtain for these checks is used only to prevent money laundering, terrorist financing and proliferation financing, unless another law permits a different use or you agree to it.
• Tax and accounting records. For example income and expenses, bank statements, payroll, property, pensions and gains, together with identifiers such as your National Insurance number and Unique Taxpayer Reference.
• Filings. With your authority we file returns with HMRC, and accounts and other documents with Companies House. Anything filed at Companies House, including a company’s accounts and its officers’ names and service addresses, goes on the public register.
• Professional obligations. ACCA regulates the practice and may review client files when it monitors our work. We keep records of the work we do and the advice we give.
• Other people’s data. Where we keep the books or run payroll for a business, we also handle personal data about its employees, customers and suppliers. The engagement letter sets out each side’s responsibilities for that data.

Some work needs more sensitive information, such as details of a health condition that affects a tax allowance. We ask for it only where the work requires it and use it only for that purpose.

For client work we use specialist software and service providers, such as accounting and tax software, secure document storage and sharing, electronic signature and identity-checking services. They process client data on our instructions.

If we know or suspect money laundering, the law requires us to report it to the National Crime Agency, and it may prohibit us from telling you that we have done so.

Why we use your data, and our lawful basis

Where we rely on legitimate interests, we have weighed our interest against your rights and concluded that it does not override them. Where we rely on consent, you can withdraw it at any time, and withdrawing does not affect anything we did lawfully beforehand. None of our decisions about you are made solely by automated means.

Who we share it with

We do not sell personal data. We share it only with:

• Cloudflare, which hosts the website and runs the program that handles the forms;
• Resend, which delivers form submissions to our mailbox;
• Microsoft, which provides our email and document storage (Microsoft 365);
• Google, which provides Google Analytics, only if you accept analytics cookies;
• Meta, which runs WhatsApp, if you message us there;
• the software and service providers we use for client work, described above;
• HMRC and Companies House, when we file or correspond for a client with their authority;
• ACCA, our regulator and anti-money-laundering supervisor, when it monitors the practice or the law requires it;
• our professional indemnity insurers and professional advisers, where we need advice or need to deal with a claim;
• law enforcement and other public authorities, where the law requires it, including reports to the National Crime Agency.

If you ask about something that Linx Tax Defence or Linx Automate handles, such as an HMRC enquiry, we may deal with it under that brand. It is the same company, so this is not a disclosure to another organisation; that brand’s privacy policy describes the systems it uses.

Transfers outside the UK

Cloudflare runs a global network, and Resend, Microsoft, Google and Meta may process personal data outside the UK, including in the United States. Where personal data leaves the UK, it goes either to a country the UK Government has recognised as providing adequate protection, or under safeguards approved under UK law, such as the ICO’s International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, as set out in each provider’s terms.

How long we keep it

• Enquiries that do not lead to an engagement, whether by form, email, telephone or WhatsApp: 12 months from our last contact, then deleted.
• Details of someone referred to us who does not become a client: deleted as soon as they ask, and otherwise no later than 3 months after our first contact with them.
• Client records: six years after the engagement ends, which is the period in which a claim about our work can normally be brought, or longer where a law, our regulator or an unresolved matter requires it.
• Anti-money-laundering records: five years after the business relationship ends, then deleted unless a law requires us to keep them or they are needed for legal proceedings.
• Google Analytics data linked to the analytics cookies: no longer than 14 months, the longest period available on Google Analytics’ standard settings. Aggregated reports, which do not identify anyone, are not affected by that limit.
• Your cookie choice: stored in your own browser until you clear it.
• Cloudflare and Resend logs: kept by those providers for their own, limited periods.

Your rights

You can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct anything inaccurate or incomplete;
• delete your data where we have no continuing reason to keep it;
• restrict how we use it while a concern is looked into;
• give you data you provided to us, in a portable format, where we use it on the basis of consent or a contract.

You can also object to our use of your data where we rely on legitimate interests or the public interest, and withdraw consent at any time. For analytics cookies, use the Cookie settings link at the foot of any page.

Email info@linxaccounting.com to exercise any of these rights. We reply within one month. For complex or numerous requests the law allows up to two further months; if we need it, we will tell you within the first month and explain why. We may ask you to confirm your identity first.

Some rights are limited by law. We cannot delete anti-money-laundering records before the five-year period ends, and we may be unable to disclose information connected with a report of suspected money laundering. If a limit applies, we will tell you which one, unless the law prevents that too.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first at info@linxaccounting.com. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Keeping it secure

The website is served over an encrypted connection. Our email and documents are held in Microsoft 365, encrypted in transit and at rest, and access is limited to the people in the practice who need it for your matter. No system is perfectly secure, which is one reason the forms accept no attachments and we ask you not to send financial or identity documents before there is a reason to.

Changes to this policy

If we start using a new system that handles your personal data, we update this policy before that system goes live. The date at the top of the page shows when it last changed. Where a change materially affects clients, we tell them directly.

See also our cookie policy and website terms and conditions.