Privacy Policy

Lexmore Tax Advisory Ltd (company number 16571110), registered office: Carter House G2 Wyvern Court, Stanier Way, Derby, England, DE21 6BF.

We act as a controller where we decide why and how personal information is processed. This policy covers our public website, enquiries, marketing, business relationships and corporate tax advisory engagements. Our services are directed at companies rather than sole traders or partnerships. Where a particular arrangement requires us to act as a processor or in another capacity, that classification and the applicable processing arrangements are assessed separately.

Privacy enquiries and individual rights requests: Tom Hinton, Privacy Lead, tom@lexmore.co.uk. You may also write to our registered office, marked “Privacy”. This policy includes an overview of MyLexmore below.

We may collect names, work contact details, roles, company associations, correspondence, enquiries, meeting notes, marketing choices and website technical information such as IP addresses and device data.

• Website enquiries and consultation bookings, including the details you provide in forms and correspondence.
• HubSpot CRM and business development records, including contact and company details, relationship history, referrals and marketing preferences.
• Client onboarding and ongoing tax advisory engagements: tax references, company and financial information, identity and anti-money-laundering records, and information about directors or beneficial owners.
• R&D tax relief claims and supporting documentation: project and R&D evidence, employee or contractor cost information, financial records and uploaded documents.
• MyLexmore client and accountant accounts: contact details, company associations, account permissions, authentication and session information, security logs and account activity.
• Accounting software integrations, where authorised: relevant accounting records and information needed to establish and maintain the authorisation.
• Website cookies, browser storage, marketing attribution and visitor tracking, subject to applicable consent requirements.

Information about a company can also identify individuals. Sensitive or criminal-offence information is handled only where necessary and subject to applicable additional legal conditions.

We receive information directly from individuals, client companies, authorised accountants and representatives, introducers, public registers, HMRC and service providers.

• When you submit an enquiry, book a consultation, correspond with us or make marketing choices.
• During client onboarding, advisory engagements, R&D claim preparation and use of MyLexmore.
• From authorised accounting integrations and information supplied by clients, accountants and other authorised representatives.
• Through necessary website and account technologies, and optional visitor-identification or marketing technologies subject to applicable consent requirements.

We use personal information to respond to enquiries, manage business relationships and provide corporate tax advisory services. Depending on the circumstances, we rely on legitimate interests, compliance with legal obligations, or contractual necessity where the individual is a contracting party.

• Enquiries, consultation bookings and business relationships: legitimate interests in responding to requests and managing our professional business (Article 6(1)(f)); contractual necessity for steps requested by an individual before entering their own contract where applicable (Article 6(1)(b)).
• Corporate tax advice, R&D claims and supporting evidence: legitimate interests in delivering the company engagement and communicating with its employees and representatives (Article 6(1)(f)); compliance with applicable tax and regulatory obligations (Article 6(1)(c)). Contractual necessity (Article 6(1)(b)) applies only where the individual is a contracting party and the processing is necessary for that contract, not simply because their employer is our client.
• Identity and anti-money-laundering checks and required records: compliance with legal obligations where these apply (Article 6(1)(c)); legitimate interests in appropriate due diligence where it is not legally mandated and that basis is appropriate (Article 6(1)(f)).
• MyLexmore client and accountant access, document handling and authorised accounting integrations: legitimate interests in administering and delivering the company engagement and enabling authorised access (Article 6(1)(f)); legal obligations where applicable (Article 6(1)(c)); contractual necessity only where its individual-party requirements are met (Article 6(1)(b)).
• System security, authentication, account activity and service administration: legitimate interests in protecting systems and information and maintaining our services (Article 6(1)(f)); legal obligations where applicable (Article 6(1)(c)).
• Complaints, legal claims and legitimate recordkeeping: legitimate interests in resolving concerns, establishing or defending claims and maintaining appropriate records (Article 6(1)(f)); compliance with applicable legal obligations (Article 6(1)(c)).
• Business-to-business marketing, lead generation and business development: legitimate interests where permitted (Article 6(1)(f)) and consent where required (Article 6(1)(a)), in accordance with UK GDPR and applicable electronic marketing rules. Optional marketing communications requiring consent are sent on that basis. Individuals can opt out of marketing at any time.
• Optional cookies, visitor identification and marketing attribution: consent where required (Article 6(1)(a)) and compliance with applicable cookie rules. Necessary security and session technologies support our legitimate interests in operating and protecting the service (Article 6(1)(f)), subject to applicable storage rules.

Where we rely on legitimate interests, we consider the necessity of the processing and the interests, rights and freedoms of affected individuals. Where special-category or criminal-offence information is necessary, we assess the additional conditions required by law; an Article 6 lawful basis alone is not sufficient.

AI-assisted tools may be used in business operations where appropriately assessed and authorised. AI used during software development is distinct from operational processing of client information. Use of development tools, including AI-assisted development features, does not itself establish that client documents are sent to an AI service.

This policy does not authorise routine submission of client information to AI services. Any separate use of personal information in AI-assisted workflows requires appropriate confidentiality, legal-basis and supplier controls; professional outputs remain subject to human review.

Potential uses such as document review, analysis, summarisation, drafting, quality assurance or administration require assessment and authorisation for the particular workflow. This policy is not a blanket authorisation to upload client information to AI tools or a claim that those uses are currently operational.

We share information where necessary with authorised client representatives and accountants, HMRC and other public authorities, professional advisers and suppliers supporting our operations. Some recipients act as independent controllers rather than processors.

• Replit: application development and hosting services; development tooling is distinct from operational client processing.
• Microsoft 365, including SharePoint: business communications, collaboration and document storage.
• HubSpot: CRM, business relationship management and consultation bookings.
• SendGrid: transactional email delivery.
• Google: relevant sign-in services and external font requests; font requests may disclose connection information such as an IP address.
• Xero, QuickBooks and Sage: accounting services and relevant integration workflows where authorised; inclusion here does not mean every provider or integration is active for every account.
• ZoomInfo, including Clickagy: business development and visitor-identification services, with optional website tracking subject to applicable consent requirements.
• LinkedIn: business networking, marketing and relevant third-party content.
• IndexNow: notifying search engines of public website URL changes; this is not a service for submitting private client documents.
• Database services: PostgreSQL storage supporting account, client, claim and workflow records.

Suppliers receive information relevant to the services they provide. Their roles and processing locations depend on the service used. Contact our Privacy Lead for information about the recipients and arrangements relevant to your personal information.

Some providers or their support teams may process personal information outside the UK. Restricted international transfers require an applicable legal mechanism, such as a relevant adequacy decision or appropriate contractual safeguards, together with any required assessment. Contact our Privacy Lead for details of the applicable arrangements and how to obtain information about relevant safeguards.

We never sell your data.

MyLexmore supports client and accountant access in connection with our professional engagements. Clients, authorised accountants and representatives may use account features and share information within the permissions applicable to their engagement. This is an overview, not a guarantee of particular technical controls or unrestricted access. Read the dedicated MyLexmore Privacy Notice for details of portal processing.

• Contact details (name, email, phone)
• Company and tax reference numbers (UTR, VAT, PAYE)
• R&D project details, financial data, and claim information
• Documents and evidence files you upload
• Authentication and session information, verification and device records where relevant to the sign-in method used
• Account permissions, security logs and relevant account and document activity
• Referral introductions and information from authorised accounting software connections

Legal basis: The purpose-specific bases in section 4 apply. A contract with a company is not a blanket Article 6(1)(b) basis for processing the personal information of its employees, accountants or representatives.

Documents and authorised software

Relevant documents and evidence are handled through application and document-storage services, including Microsoft 365 and SharePoint where used. Accounting software connections are used where authorised. Supplier roles and verification limits are explained in section 5; no blanket UK hosting or supplier-compliance assurance is given.

Authentication and session security

Authentication and account-security controls help protect access. Information is available only to authorised users according to their permissions. Signing in does not grant access to another company's information.

Access and underlying records

MyLexmore access ends when the engagement terminates. Ending account access does not automatically delete underlying claim, advisory or compliance records, which remain subject to the retention requirements in section 6.

Our website uses necessary cookies and similar technologies for security, session management and preferences. Optional marketing and visitor-identification technologies, including ZoomInfo/Clickagy where enabled, are subject to the applicable consent requirements. Marketing attribution may use cookies or browser storage to associate an enquiry with a campaign or referral.

Booking, social and other third-party resources may make separate browser requests when accessed or loaded. External booking sites and other providers have their own notices. External font requests may send connection information to the font provider without being an analytics integration.

You can manage optional cookies through the website’s cookie controls. See the existing Cookie Policy for provider details, browser storage, durations and how to accept, reject or withdraw optional consent. Acknowledging the MyLexmore Privacy Notice does not give consent to optional cookies or marketing and does not change your cookie choices.

We keep information only for as long as needed for the relevant purpose, applicable legal obligations and legitimate recordkeeping requirements. Relevant records may be retained longer for an HMRC enquiry, dispute, investigation or legal hold. Retention in supplier systems and backups may follow separate, documented cycles.

• Active prospects: records may be retained while there is a legitimate ongoing business relationship or sales opportunity, subject to periodic review.
• Inactive prospects: basic inactive-prospect CRM information may ordinarily be retained for up to five years from the last meaningful interaction, where justified and subject to a continuing lawful basis. Marketing objections and suppression records are managed separately.
• R&D claims and supporting records: a provisional seven-year baseline, subject to applicable statutory and contractual retention rules, which take precedence, and appropriate extensions where justified. This baseline remains provisional, not an assertion of final approval.
• Ongoing clients: relevant historical information may continue to be retained where justified by continuing engagements.
• Identity and anti-money-laundering records: retained in line with applicable legal requirements, generally five years after the business relationship ends where those rules apply.
• Former clients: MyLexmore access ends when the engagement terminates, but underlying records remain subject to applicable retention requirements.
• Routine MyLexmore security and activity logs: a 365-day retention policy, with exceptions for investigations and legal holds.

These periods describe our retention policy; they do not mean that every record is deleted automatically on a fixed date. Deletion requests are assessed against applicable rights, legal obligations and justified retention needs, including investigations and legal holds. For details about retention applicable to particular information, contact our Privacy Lead.

Depending on the circumstances and applicable legal conditions, you have the right to:

• Access the personal data we hold about you
• Correct inaccuracies in your data
• Request deletion of your data
• Object to or restrict processing
• Request data portability where the applicable conditions are met
• Object to processing based on legitimate interests and to direct marketing at any time
• Withdraw consent at any time where we rely on it, without affecting earlier lawful processing

To exercise these rights, contact tom@lexmore.co.uk. We may need to verify your identity. We normally respond within one calendar month, subject to lawful extensions and exemptions. These rights are not absolute; applicable exceptions and legal retention requirements may limit a request.

You can complain to the UK Information Commissioner’s Office (ICO).

We use appropriate technical and organisational safeguards, including HTTPS connections, account permissions, authentication controls and restricted document access. Password protection, accounting authorisation credentials and document activity controls are assessed within the relevant application workflows. No online service can guarantee absolute security.

The controls that apply depend on the service, account and activity involved. Please contact our Privacy Lead if you have concerns about the security of your personal information.

We will update this policy when our processing practices or legal requirements change. The policy date above identifies this version, which takes effect when published. Please check this page for the current wording and contact our Privacy Lead if you have questions about a change.