Privacy notice

1. Who we are

LetsFile Limited ("we", "us", "our") is a UK company. We are the data controller for personal data processed through this website and our 60-day Capital Gains Tax filing service.

Registered office: Studio 19a Oru Space Sutton, 7 Throwley Way, Sutton SM1 4AF, United Kingdom.

Data protection: we process personal data in accordance with UK GDPR and the Data Protection Act 2018.

Privacy contact: [email protected].

Data Protection Officer: a DPO is not appointed under Article 37(1) UK GDPR. We have assessed that none of the mandatory triggers apply (we are not a public authority; our core activities do not consist of large-scale, regular and systematic monitoring; and we do not process Article 9 special-category data on a large scale). All privacy questions are handled by the team via the address above.

2. The data we collect

Identity data: your full name, date of birth, National Insurance number, photo ID, and a selfie taken during identity verification.
Contact data: email address and, where provided, phone number and postal address.
Transaction data: your property completion statement, original purchase documents, improvement-cost invoices, joint-owner details where relevant.
Financial data: sale and purchase prices, allowable costs, CGT liability calculated on your behalf, your tax band, HMRC submission references, bank details for any refund (we never store full card numbers).
Technical data: IP address, browser type, device type, session data from standard web server logs and our privacy-focused analytics.
Referral Partner consent data: if you join our Referral Partner Programme, we record your acceptance of the Referral Partner Agreement (the date and time, the IP address and browser you used, and the version of the agreement you accepted) as proof of agreement. The lawful bases are Article 6(1)(b) (performance of the Partner agreement) and Article 6(1)(f) (our legitimate interest in keeping a reliable record of acceptance).

Where the data comes from: nearly all data is provided directly by you. We also receive an HMRC submission reference back from HMRC after filing, and a verification result from our identity-check provider (SmartSearch).

3. Why we process your data (lawful bases)

To prepare and file your 60-day CGT return: Article 6(1)(b), performance of our contract with you.
To verify your identity: Article 6(1)(c), legal obligation under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 ("MLR 2017") and HMRC tax-agent requirements.
To communicate with you about your return: Article 6(1)(b), performance of contract.
To retain records for the statutory period: Article 6(1)(c), legal obligation (HMRC requires tax agents to retain client records for at least 6 years).
To send you marketing emails: Article 6(1)(a), your consent. We only send these where you have explicitly opted in at point of email collection. You can withdraw consent at any time using the unsubscribe link in every email or by emailing [email protected].
To improve our service and detect fraud: Article 6(1)(f), legitimate interests, balanced against your rights (we anonymise wherever possible and you can object to this processing at any time).

We do not sell your personal data. Ever.

4. Automated decisions and profiling

Our CGT calculator runs computations on the figures you enter and returns an estimate. It does not produce a legally or similarly significant decision about you, and a Chartered Accountant/Chartered Tax Advisor reviews every Reviewed and Emergency return before HMRC submission. We do not engage in Article 22 automated decision-making.

5. Who we share data with (named processors)

We share personal data with the following categories of recipient:

HMRC: we submit your CGT return through HMRC's CGT-on-UK-Property service as your authorised agent. Recipient country: United Kingdom.
Our Chartered Accountant/Chartered Tax Advisor: the qualified practitioner who reviews and signs your return (Reviewed and Emergency tiers). UK-based.

We also use the following processors under signed (or auto-enrolled) Article 28 data processing agreements:

Stripe Payments UK Ltd: card payments, billing. UK + US (transfers covered under the UK extension of the EU-US Data Privacy Framework).
Cloudflare, Inc.: CDN, DDoS protection, Pages hosting, Access, R2 object storage for your uploaded documents. UK + US (UK-US Data Privacy Framework).
SmartSearch (SmartCredit Limited, company number 05534508): electronic identity and anti-money-laundering (AML) verification. UK-based. Where a document or biometric check is required, that data is processed by SmartSearch and retained for the statutory AML record-keeping period.
Emailit: transactional and (where consented) marketing email delivery. EU-based.
Ideal Postcodes Ltd: UK postcode lookup. UK-based.
IONOS (IONOS SE): our virtual private server (VPS) provider. Our server and all data held on it are located in the United Kingdom. Hosts our application, database, and self-hosted services (Mautic, Matomo, n8n, etc.).

The self-hosted services above (Mautic for email marketing, Matomo for analytics, n8n for workflows, GlitchTip for error monitoring, Metabase for internal reporting, DocuSeal for engagement letters, OpenProject for case management) run on our own infrastructure, so they are not third-party processors.

6. International transfers

Where personal data is transferred outside the UK and EEA, we rely on one of the following safeguards in this order of preference:

Adequacy decisions: for transfers to countries the UK Government has determined provide an adequate level of protection (e.g. the EEA, the UK extension of the EU-US Data Privacy Framework for certified US recipients).
UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK addendum, where no adequacy decision applies.

Stripe and Cloudflare are both certified under the UK extension of the EU-US Data Privacy Framework. Where you would like a copy of the safeguard we rely on for a specific transfer, contact [email protected].

7. Document retention

The Money Laundering Regulations 2017 and HMRC's record-keeping rules require tax agents to retain client records for at least 6 years from the end of the relevant tax year. We retain the documents you provide and the completed returns for this period. After 6 years, documents are securely and permanently deleted unless a longer retention period is required by law (for example, an ongoing HMRC enquiry).

Identity verification data is retained by SmartSearch for the period required by MLR 2017 (5 years from the end of the business relationship) and then deleted.

Marketing data: if you have given consent to marketing emails, we retain your email address for that purpose until you withdraw consent or for 2 years of inactivity, whichever is sooner.

8. Cookies and analytics

Cookieless analytics (always on). Every page uses Matomo, a privacy-focused analytics platform we host on our own infrastructure. It is configured to set no cookies and to anonymise your IP address. Because it stores nothing on, and reads nothing from, your device, it falls outside the consent requirement of the Privacy and Electronic Communications Regulations (PECR). The limited personal data involved (an anonymised IP and how pages are used) is processed under Article 6(1)(f) UK GDPR, legitimate interests (understanding and improving our service), balanced against your rights.

Because it is cookieless, our Matomo analytics is not controlled by the "analytics" toggle in the cookie banner: that toggle governs cookie-based trackers (see below). To opt out of our cookieless analytics, enable your browser's "Do Not Track" setting: we honour it and will not record your visit. You can also object under Article 21 by emailing [email protected].

Functional cookies (always on). A small number of strictly-necessary, first-party cookies keep you signed in, keep the service secure, remember your cookie choices, and remember which referral link brought you here so your discount is applied and the person who referred you is credited. They store no third-party tracking identifiers. They do not require consent under PECR because they are necessary to provide the service, including the referral discount you requested by following the link.

Cookie	Purpose	Duration
`lfc_ref`	Remembers the referral link you arrived through, so your 20% discount is applied at checkout and the person who referred you is credited. First-party only.	90 days
`lfc.session` / `__Secure-lfc.session`	Keeps you signed in to your account while you file.	Up to 24 hours
`lfc_session_hint`	Lets our pages show the correct "Log in" / "Log out" state.	24 hours
`cc_cookie`	Remembers your cookie-banner choices.	6 months

We do not use these cookies to build advertising profiles or to share data with third parties.

Advertising cookies (consent only). We set no advertising or third-party tracking cookies unless you accept them in the cookie banner. Where you consent, we use Google Ads and Meta tags, governed by Google Consent Mode v2, to measure our marketing. You can change or withdraw your choice at any time via the "Cookie preferences" link.

9. Security

Documents you upload are encrypted in transit (TLS 1.3) and at rest (AES-256). Our systems are hosted on infrastructure with appropriate access controls, intrusion detection, and DDoS protection. We conduct periodic security reviews and maintain an internal data-breach response procedure aligned to UK GDPR Article 33 (72-hour ICO notification where required) and Article 34 (notification to affected data subjects where the risk is high).

10. Your rights

Under UK GDPR you have the right to:

Access a copy of the personal data we hold about you (Article 15).
Rectification of inaccurate or incomplete personal data (Article 16).
Erasure of your personal data, subject to our legal obligations to retain certain records for HMRC and MLR 2017 purposes (Article 17).
Restrict processing in certain circumstances (Article 18).
Data portability: receive your data in a structured, machine-readable format (Article 20).
Object to processing based on legitimate interests (Article 21).
Withdraw consent at any time for processing based on consent (e.g. marketing emails) (Article 7(3)).
Lodge a complaint with the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

To exercise any of these rights, contact [email protected]. We will respond within one calendar month, or explain why we need an extension (Article 12(3)). We may need to verify your identity before responding.

11. Children

Our service is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe we have done so in error, please contact us and we will delete it.

12. Changes to this notice

We may update this notice from time to time. The date at the top of this page reflects the last revision. Material changes will be communicated by email to existing customers. Continued use of the service after a change indicates your acceptance of the updated notice.