Privacy Policy
Last updated: 10 July 2026
Thyme Tax & Accountancy Ltd (“Thyme”, “we”, “us” or “our”) is committed to protecting the privacy of our clients and of everyone who visits our website. This policy explains what personal data we collect, how we use it, who we share it with, and your rights. It applies to our website at thyme.tax, to the client portal and software we make available to you, and to our accountancy services generally.
1. Who we are
Thyme Tax & Accountancy Ltd is the data controller for the personal data we hold about you. We are a company registered in Scotland (company number SC772358), with our registered office at 36 Angusfield Avenue, Aberdeen, AB15 6AQ, and we are registered with the Information Commissioner’s Office (registration number ZB609173). You can contact us about this policy or your data at contact@thyme.tax.
2. The personal data we collect
Depending on how you interact with us, we may collect:
- If you use our website: the messages and details you send through our contact or quote forms; and technical data such as your IP address, device and browser type, and how you use the site, collected through cookies and similar technologies (see our Cookie Policy).
- If you are a client (or become one): identity and contact details (name, address, email, phone, date of birth); tax identifiers (National Insurance Number, Unique Taxpayer Reference); financial, income and accounting information; bank account and transaction data, including through open banking where you use that feature; documents you provide; Companies House information where you are a director, shareholder or person with significant control; and identity-document and biometric data (a special category of data) collected when we verify your identity, which we do as a standard part of onboarding.
3. How we use your data, and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Providing accounting, bookkeeping, tax and related services under our engagement | Performance of a contract |
| Responding to your website enquiries and quote requests | Performance of a contract, or steps prior to a contract |
| Meeting our legal and regulatory obligations, including tax filing and anti-money-laundering checks | Legal obligation |
| Verifying your identity for anti-money-laundering purposes | Legal obligation (Money Laundering Regulations 2017) |
| Processing biometric data to verify your identity (special category) | Article 9(2)(g) substantial public interest, preventing or detecting unlawful acts (Data Protection Act 2018, Schedule 1, paragraph 10) |
| Managing our relationship with you, administration, security and improving our services | Legitimate interests |
| Marketing our services to you, where applicable | Consent or legitimate interests |
Where we rely on consent (for example for certain marketing, or for open-banking access), you can withdraw it at any time. We do not rely on consent for identity verification, because it is a mandatory anti-money-laundering check.
4. Who we share your data with
We share your data only as necessary to provide our services and meet our obligations, including with:
- HMRC, to file returns and submissions on your behalf;
- Companies House, where relevant to your filings;
- Calceum Limited (“Calceum”), our practice-management and Making Tax Digital software provider, which acts as our processor and processes your data only on our instructions. Calceum’s own sub-processors are listed at calceum.com/policies/sub-processors;
- where you use open-banking features, Calceum’s regulated open-banking provider (a firm authorised by the Financial Conduct Authority and listed in Calceum’s sub-processor list); you authorise that access directly with your bank, and the provider handles your bank data under its own terms;
- Calceum’s identity-verification partner (listed in Calceum’s sub-processor list), which verifies your identity using document and biometric checks as a standard part of onboarding; and
- our professional advisers and insurers, and legal or regulatory authorities where we are required to disclose.
We do not sell your personal data.
5. Cookies and website analytics
Our website uses cookies and similar technologies to make the site work, to remember your choices, and to understand how the site is used so we can improve it. You can control cookies through your browser and through any cookie banner on the site. Full detail is in our Cookie Policy.
6. International transfers
Your data is hosted in the United Kingdom. Where any provider processes data outside the UK, appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.
7. How long we keep your data
We keep your data only as long as necessary for the purposes above and to meet legal requirements. In particular, we generally retain tax and accounting records for at least six years, anti-money-laundering records for five years after the end of our relationship, and website-enquiry records for two years. We then securely delete or anonymise it.
8. Your rights
You have the right to access your data; to have inaccurate data corrected; to have data erased or its use restricted in certain circumstances; to object to certain processing; to data portability; and, where we rely on consent, to withdraw it. To exercise any of these, contact us using the details below. We may need to verify your identity first.
9. Children
Our services and website are intended for adults. We do not knowingly collect data from children, and the website is not directed at anyone under 18.
10. Complaints
If you have a concern about how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk), the UK’s data protection regulator.
11. Contact us
Thyme Tax & Accountancy Ltd 36 Angusfield Avenue, Aberdeen, AB15 6AQ Email: contact@thyme.tax
We may update this policy from time to time. The “Last updated” date above shows the latest version.