Privacy Policy

Lexmore Tax Advisory Ltd is the data controller responsible for your personal data. You can contact us at data@lexmore.co.uk.

We may collect the following information:

• Name, email, phone number, and company name (via forms)
• IP address, browser type, and device data (via cookies)

We collect data:

• When you submit a form
• When you sign up for a newsletter
• Through cookies and analytics tools

We process your data for:

• Responding to your enquiries
• Sending marketing communications (if you opt in)
• Improving our website (analytics)
• Lead generation and business development

Lexmore Tax Advisory Ltd may use artificial intelligence (AI), machine learning tools and other technology-assisted systems to support the delivery of our services. These tools may be used to assist with document review, data analysis, summarisation, drafting, quality assurance and administrative tasks.

Where such tools are used, we take reasonable steps to ensure that appropriate security, confidentiality and data protection measures are in place. We do not rely solely on automated decision-making when providing professional advice or preparing claims on behalf of our clients. All work remains subject to appropriate human review and oversight.

Information provided to us may be processed through such systems where reasonably necessary to deliver our services.

We may share your data with:

• Marketing and analytics providers (e.g. Google Analytics)
• CRM platforms and email tools
• Cloud storage providers (e.g. Microsoft 365)

We may also use cloud-based software providers, document management platforms, communication systems, artificial intelligence tools and other technology service providers in connection with the delivery of our services.

We never sell your data.

Lexmore operates a secure Client Portal at lexmore.co.uk/portal for active R&D tax relief clients. When you use the portal, we process the following categories of personal and business data:

• Contact details (name, email, phone)
• Company and tax reference numbers (UTR, VAT, PAYE)
• R&D project details, financial data, and claim information
• Documents and evidence files you upload
• Authentication data (hashed passwords, session tokens, verification codes)
• Trusted device records (if you opt to remember a device for 30 days)
• Referral introductions you submit via the portal

Legal basis: Processing is carried out under the performance of a contract (Article 6(1)(b) UK GDPR) and legitimate interests (Article 6(1)(f) UK GDPR).

Named Data Processors

The following third-party processors are used in the operation of the Client Portal. All are subject to data processing agreements and comply with UK GDPR:

Two-Factor Authentication (2FA)

The portal uses email-based one-time passwords (OTP) as a second authentication factor. When you log in, a 6-digit code is sent to your registered email address. This code expires after 10 minutes and is single-use. You may choose to trust a device for 30 days, in which case a secure device token is stored in an httpOnly cookie on your browser.

Session Security

Portal sessions use httpOnly, Secure, SameSite cookies. Sessions expire after 24 hours, or 30 minutes of inactivity. Lexmore consultants may invalidate all active sessions for a client at any time for security purposes. You may also sign out of all devices via the portal.

We retain your data for as long as necessary to fulfil the purposes described above. If you request deletion, we will securely erase your data unless we are legally required to keep it.

You have the right to:

• Access the personal data we hold about you
• Correct inaccuracies in your data
• Request deletion of your data
• Object to or restrict processing
• Withdraw consent at any time

To exercise these rights, contact data@lexmore.co.uk.

We take steps to ensure your data is stored securely using Microsoft 365 and industry-standard security measures.

We may update this policy occasionally. Any changes will be posted on this page with a revised "last updated" date.