Privacy Policy

1. Who Is the Data Controller?

The data controller for personal data collected via this website is UK Tax Hero, a website operated in England and Wales. For data protection enquiries, please contact us via our Online Helpdesk.

References in this policy to "we", "us", and "our" mean UK Tax Hero as data controller.

2. What Personal Data We Collect

We collect personal data in the following circumstances:

2.1 Data you provide directly

• Contact and enquiry information submitted through our Online Helpdesk (name, email address, message content)
• Feedback or reviews submitted to us or via Trustpilot
• Information provided when applying for or participating in our Partner Programme
• Any correspondence you send to us by any means

2.2 Data collected automatically

• Technical information including your IP address, browser type and version, operating system, and device identifiers
• Usage data including pages viewed, time spent on pages, referral sources, and navigation paths
• Cookie data as described in our Cookie Policy

2.3 Data from third parties

• Analytics data from Google Analytics (anonymised)
• Information from social media platforms where you interact with our pages
• Affiliate tracking data from our partner platforms

We do not knowingly collect personal data from persons under the age of 16.

3. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis to process your personal data. We rely on the following bases:

• Legitimate interests (Article 6(1)(f)): for analytics, site security, fraud prevention, and improving our Services, where your interests do not override ours
• Consent (Article 6(1)(a)): for non-essential cookies and any direct marketing communications (where applicable)
• Contract performance (Article 6(1)(b)): where processing is necessary to fulfil a service you have requested, such as responding to helpdesk enquiries or managing partner programme participation
• Legal obligation (Article 6(1)(c)): where we are required to retain or disclose data by law

Where we rely on your consent, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.

4. How We Use Your Personal Data

We use the personal data we collect to:

• Operate, maintain, and improve the Website and its Services
• Respond to your helpdesk enquiries and correspondence
• Administer the Partner Programme
• Analyse usage patterns to improve user experience and site performance
• Monitor for and prevent security threats, abuse, and fraud
• Comply with our legal and regulatory obligations
• Send service-related notifications where applicable

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Who We Share Your Data With

We do not sell, rent, or trade your personal data. We may share data with trusted third parties strictly as necessary to operate our Services:

• Technology providers: WordPress hosting, website infrastructure, and platform providers who process data on our behalf under data processing agreements
• Analytics providers: Google Analytics (with IP anonymisation enabled). Google's privacy policy applies to this data
• Email and communication tools: used to manage helpdesk responses, subject to appropriate safeguards
• Affiliate and advertising platforms: limited tracking data shared with affiliate partners as described in our Affiliate Disclosure
• Law enforcement or regulatory authorities: where we are legally required or permitted to disclose data

All third-party processors are contractually bound to process data only on our instructions and in compliance with UK GDPR.

International transfers

Some of our third-party providers operate outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Agreement (IDTA) or adequacy decisions.

6. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our general retention periods are:

• Helpdesk and correspondence data: up to 3 years from last contact
• Partner Programme data: for the duration of the partnership plus 6 years
• Analytics data: 26 months (Google Analytics default, with IP anonymisation)
• Cookie data: as set out in our Cookie Policy

Data subject to a legal obligation may be retained for longer periods. Data no longer required is securely deleted or anonymised.

7. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): to request deletion of your data in certain circumstances
• Right to restriction of processing: to request that we limit how we use your data
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests, or to direct marketing
• Right to withdraw consent: where processing is based on consent, to withdraw it at any time

To exercise any of these rights, please contact us through our Online Helpdesk. We will respond within one month as required by UK GDPR.

8. Cookies

We use cookies and similar tracking technologies on this Website. For a full explanation of what cookies we use, why, and how to manage your preferences, please read our Cookie Policy.

9. Security of Your Data

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. These measures include SSL/TLS encryption for data in transit, restricted access controls, and regular security reviews.

No transmission over the internet is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security. Please notify us immediately if you suspect any breach of your data security in relation to our Website.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect the most recent revision. Material changes will be notified via a prominent notice on the Website. Continued use of the Website following such notice constitutes acceptance of the revised policy.

11. Contact & Data Requests

For any data protection queries, subject access requests, or to exercise your rights:

• Online: Online Helpdesk
• ICO (complaints): ico.org.uk

We aim to acknowledge all data protection requests within 5 business days and to respond fully within the statutory one-month period.