Privacy notice for firms and their clients

Who is in charge of your data

Octotax is a trading name of Jacob Norton, a sole trader in the UK (Jacob Norton, a sole trader trading as Octotax). Who decides how your data is used depends on how you use Octotax:

• If you work at a firm (an owner or a member of staff), Jacob Norton is the controller of your account details: who you are, how you sign in and how we keep your account secure. Your firm is the controller of the client work you do in Octotax.
• If you're a client of a firm and use its client area, or your details are in its records, your accountant is the controller of that data. We store and process it for them, on their instructions, under a data processing agreement. Your accountant's own privacy notice explains how they use it.
• If you also use the free Octotax app, Jacob Norton is the controller of the app's data, as explained in our app privacy notice.

Contact us about anything in this notice at [email protected].

People who work at a firm

What we hold

• Your account: your name, work email address, role (owner or staff), the firm you belong to and the permissions an owner has given you.
• Sign-in and security: your password (stored only as a salted hash, never readable), your two-factor sign-in secret (encrypted) and recovery codes (stored only as hashes), your signed-in sessions, and the IP address, browser and time of sign-ins and security events.
• What you do in Octotax: the audit log of changes you make to client records, your timesheet entries, and the tasks and jobs assigned to you. These are part of your firm's records, and owners at your firm can see them.
• Settings and messages: your notification and calendar feed settings, saved views, and any support emails you send us.
• Billing (owners): the billing contact's name, email address and billing address, and the plan and number of seats. Card and bank details are held by our payment provider, Stripe, not by us.

Why we use it, and our lawful basis

• To give you access to the service your firm has signed up for and keep it working (lawful basis: legitimate interests, in providing the service your firm has contracted for; for a firm's owner, also contract).
• To keep accounts and data secure, prevent misuse and investigate problems (lawful basis: legitimate interests).
• To send service emails: sign-in codes, invitations, security alerts, billing emails and notice of changes to our terms. We don't send marketing emails to firm users (lawful basis: legitimate interests and contract).
• To bill your firm and keep accounting records (lawful basis: contract and legal obligation).
• To answer support requests (lawful basis: legitimate interests).

Your firm can see the activity linked to your account, such as the audit log and timesheets, and may use it to manage its work. That's your firm's use, under its own policies as your employer.

Clients who use a firm's client area

Your accountant invites you to their client area, which runs on Octotax. Your accountant is in charge of the data in it. It can include:

• your contact details and the details your accountant holds about you and your business;
• the work they're doing for you, your dates, tax to pay and payment references;
• documents and records you upload or they share with you, messages, signatures, and anything you tell them through the client area (such as life events, changes to your details, feedback, or what you enter in the tools they switch on);
• sign-in records: you sign in with a one-time code sent to the email address your accountant has for you, and sessions last up to 24 hours;
• if you switch on notifications on a phone or computer, a push subscription for that browser, and your choice of email digest or alerts as they happen.

Some emails your accountant sends you, such as Self Assessment questionnaire emails, record when they're opened and when their link is clicked, so your accountant can see whether you've had them. Emails and notifications never include tax amounts or payment references; they tell you there's something to see.

To see, correct or delete your data, or to object to how it's used, contact your accountant first. If you contact us, we'll pass your request to them. If you think something is wrong with the client area itself, email us at [email protected].

If you link the free Octotax app

You can use the client area and the free Octotax app with the same email address and link them. Linking is always your choice:

• Your accountant's work for you shows in your app, and their filings tick off your deadlines. We add the business your accountant has on file to your app so the dates line up; it's then part of your own app.
• You choose what your accountant can see from your app: your app deadlines, Companies House alerts and, only if you switch it on, your tax pot. You can change this at any time.
• You or your accountant can unlink at any time. Your accountant then stops seeing anything from your app straight away. You keep your app and its data, and your accountant keeps their own records about you.

We show your accountant what you choose to share at your request. Anything they then note in their own records is theirs as controller.

Other people in a firm's records

Firms also hold details of people connected with their clients, such as company directors and shareholders, a client's partner, people who enquire about their services, and a client's employees where they appear in payroll documents. The firm is in charge of that data, and we store it for them. Please contact the firm about it; if you contact us, we'll pass your request on.

Who we share data with

• Service providers who help us run Octotax, such as Cloudflare (network and security), Resend (email), Google (encrypted backups) and Stripe (payments). The full list, with what each handles and where, is on our sub-processors page.
• Companies House, when a company is looked up or synced (we send the company name or number only).
• Your browser's push service (for example Apple, Google, Microsoft or Mozilla), if you switch on notifications. Each notification is encrypted so the push service can't read it.
• Your accountant or your firm, as described above.
• Others where the law requires it, for example if a court or regulator orders us to, and, if Octotax is ever transferred to a company or another business, that business (we'll tell firms first).

We never sell personal data, share it with advertisers or use it to train artificial intelligence models.

Where your data is kept

Octotax runs on equipment we operate in the United Kingdom, with encrypted nightly backups kept in Google Drive (Google can't read them). Some service providers handle data outside the UK, such as Cloudflare's global network. Each transfer is covered by UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework) or by the Information Commissioner's standard data transfer clauses. Section 12 of our data processing agreement has the details.

How long we keep it

• Firm users: while your account is active. When an owner removes you, you can no longer sign in, but your name stays on the records you worked on (such as the audit log and timesheets), as part of your firm's records.
• Sign-in codes and sessions: codes expire after 15 minutes. Staff sessions expire after 14 days without use, and client area sessions after 24 hours.
• Your firm's and its clients' data: for as long as the firm uses Octotax and decides to keep it. Each firm sets how long it keeps a former client's records (at least five years after the client leaves, as the anti-money laundering rules require) and can then erase them permanently. When a firm closes its account, everything is deleted after a 30-day grace period.
• Backups: encrypted backups are kept for 30 days, so deleted data drops out of them within 30 days.
• Billing records: for at least six years, as tax law requires.
• Support emails: for as long as they're useful, and no more than two years after a firm's account closes.

How we protect it

Data is encrypted in transit, the most sensitive fields and all uploaded documents are encrypted at rest, each firm's data is kept separate, and only Jacob Norton has administrative access. The full list is on our security page.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to how it's used, and to receive it in a portable format. For data your accountant or firm controls, ask them first. For your own account details, email [email protected] and we'll reply within one month. You can also complain to the Information Commissioner's Office (ico.org.uk), though we'd appreciate the chance to put things right first.

Changes to this notice

If we change this notice in a way that matters, we'll update the date at the top and tell firm owners by email. The terms of service for firms and the data processing agreement cover the rest of our relationship with firms.