Record OS - Privacy Policy
Version: May 2026
1. Introduction
1.1 This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Self Assessment tax return service (the "Service").
1.2 We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1.3 Please read this Privacy Policy carefully. By using our Service, you acknowledge that you have read and understood this Privacy Policy.
2. Who We Are
2.1 Record OS is a trading name of Count Ltd, a company incorporated in England and Wales (company number 16058953), with registered offices at 128 City Road, London, EC1V 2NX.
2.2 For the purposes of data protection law, Record OS is a data controller in respect of its processing of your personal data. TaxReady Limited is a separate, independent data controller in respect of its processing of your personal data for professional tax services (see section 3 below).
2.3 If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at privacy@record-os.com.
3. Data Controllers and Data Sharing
3.1 Record OS and TaxReady Limited are each independent data controllers under UK data protection law. This means each organisation is responsible for its own processing of your personal data. We share your personal data with TaxReady Limited to enable them to provide professional tax services to you.
3.2 TaxReady Limited is a company registered in England and Wales (company number 16039364), authorised by the Institute of Chartered Accountants in England and Wales (ICAEW) and registered with HMRC as a tax agent.
3.3 Our respective roles are:
- Record OS is responsible for: customer acquisition and onboarding; conducting anti-money laundering (AML) and know-your-customer (KYC) checks; collecting your data through our platform; aiding in the preparation of your tax return; providing you with privacy information; acting as your primary contact point for data protection queries; retention of records as required by GDPR and other relevant legislation; billing and payment processing; and platform security.
- TaxReady Limited is responsible for: preparation and review of your tax return before submission; submission of your tax return to HMRC; compliance with ICAEW professional standards; retention of records as required by AML legislation and professional standards; and reporting to authorities where required by law.
3.4 Record OS is the primary contact point for all data protection matters. You can exercise your data protection rights by contacting us at privacy@record-os.com. We will coordinate with TaxReady Limited as necessary to respond to your requests.
3.5 Each controller is responsible for responding to data protection requests relating to its own processing. Record OS is the primary contact point, if you contact us with a request that relates to TaxReady Limited's processing, we will direct you to TaxReady Limited or coordinate with them on your behalf.
4. What Personal Data We Collect
4.1 We collect the following categories of personal data:
| Category | Examples |
|---|---|
| Identity data | Name, date of birth, National Insurance number, Unique Taxpayer Reference (UTR) |
| Contact data | Address, email address, telephone number |
| Financial data | Income (employment, self-employment, rental, investment), expenses, pension contributions, bank account details, payment card details |
| Tax data | Tax relief claims, allowances, previous tax returns, HMRC correspondence, tax calculations |
| Documents | P60s, P45s, P11Ds, bank statements, invoices, receipts, dividend vouchers, mortgage statements |
| Account data | Username, password (encrypted), account preferences, communication preferences |
| Technical data | IP address, browser type, device information, operating system, login data, session data |
| Usage data | How you use our platform, features accessed, time spent, actions taken |
4.2 We do not intentionally collect special category data (such as data about your health, race, religion, or political opinions). However, such data may be incidentally included in documents you upload. If this occurs, we will process it only as necessary to provide the Service and in accordance with applicable law.
5. How We Collect Your Data
5.1 We collect personal data:
- Directly from you: when you create an account, enter information into our platform, upload documents, contact us, or respond to our communications.
- Automatically: when you use our platform, we automatically collect technical and usage data through cookies and similar technologies.
- From third parties: we may receive data from HMRC (such as submission confirmations), identity verification providers, and payment processors.
6. How We Use Your Data
6.1 We use your personal data for the following purposes:
| Purpose | Lawful Basis | Data Used |
|---|---|---|
| To create and manage your account | Contract | Identity, Contact, Account |
| To prepare and submit your tax return | Contract | Identity, Contact, Financial, Tax, Documents |
| To verify your identity (AML/KYC) | Legal obligation | Identity, Contact, Documents |
| To submit information to HMRC | Legal obligation / Contract | Identity, Financial, Tax |
| To process payments | Contract | Identity, Contact, Financial |
| To communicate with you about the Service | Contract / Legitimate interests | Identity, Contact, Account |
| To improve our Service | Legitimate interests | Technical, Usage (anonymised) |
| To prevent fraud and ensure security | Legitimate interests | Identity, Technical, Usage |
| To comply with legal and regulatory obligations | Legal obligation | All categories as required |
6.2 Where we rely on legitimate interests, we have carried out a balancing test to ensure our interests do not override your rights and freedoms. You can request details of this assessment by contacting us.
7. AI and Automated Processing
7.1 We use artificial intelligence (AI) and optical character recognition (OCR) technology to extract data from documents you upload and pre-fill your tax return.
7.2 This automated processing helps us provide the Service more efficiently. However:
- The AI/OCR technology extracts data only and it does not make decisions about your tax liability or provide tax advice.
- All extracted data is reviewed by you and by TaxReady Limited before submission.
- You have the opportunity to correct any errors before approving your tax return.
7.3 No solely automated decisions with legal or significant effects are made about you without human review.
8. Who We Share Your Data With
8.1 We share your personal data with the following recipients:
| Recipient | Purpose |
|---|---|
| TaxReady Limited | AML/KYC checks, tax return preparation, review, and submission to HMRC |
| HMRC | Submission of your Self Assessment tax return |
| Amazon Web Services (AWS) | Cloud hosting provider - stores your data securely in the UK (eu-west-2 region) |
| Payment processor | Stripe - processes your payments securely |
| Document processing | AI/OCR service provider - extracts data from uploaded documents |
| Professional advisors | Lawyers, accountants, auditors - where necessary for legal, compliance, or audit purposes |
| Regulators and authorities | ICO, ICAEW, law enforcement - where required by law or regulation |
8.2 We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes.
9. International Transfers
9.1 Your personal data is stored and processed in the United Kingdom. We use Amazon Web Services (AWS) data centres located in the UK.
9.2 If we need to transfer your data outside the UK, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the Information Commissioner's Office (ICO) or transfers to countries with an adequacy decision.
10. Data Retention
10.1 We retain your personal data for as long as necessary to fulfil the purposes for which it was collected and to comply with legal requirements.
10.2 The following retention periods apply:
- Tax records: 6 years from the end of the relevant tax year (as required by HMRC)
- AML/KYC records: 5 years from the end of our relationship with you (as required by the Money Laundering Regulations)
- Account data: Duration of your account plus 2 years, unless longer retention is required for legal purposes
- Technical/usage data: 12 months
10.3 At the end of the retention period, we will securely delete or anonymise your personal data.
11. Data Security
11.1 We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage.
11.2 Our security measures include:
- Encryption of data in transit (TLS) and at rest (AES-256)
- Access controls and authentication
- Regular security testing and vulnerability assessments
- Staff training on data protection and security
- Incident response procedures
11.3 While we take all reasonable steps to protect your data, no transmission over the internet is completely secure. You are responsible for keeping your account credentials confidential.
12. Your Rights
12.1 Under UK data protection law, you have the following rights:
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Request correction of inaccurate or incomplete data |
| Erasure | Request deletion of your data (subject to legal retention requirements) |
| Restriction | Request that we limit how we use your data |
| Portability | Request a copy of your data in a structured, machine-readable format |
| Objection | Object to processing based on legitimate interests |
| Withdraw consent | Where we rely on consent, withdraw it at any time |
12.2 To exercise your rights, please contact us at privacy@record-os.com. We will respond within one month. If your request is complex, we may extend this by a further two months, but we will let you know.
12.3 Please note that some rights are not absolute. For example, we cannot delete data that we are legally required to retain (such as AML records or tax records within the retention period).
12.4 TaxReady Limited is a separate data controller for its processing. If your request relates to data processed by TaxReady Limited (such as AML records or professional working papers held solely by TaxReady), you can contact us and we will direct you to TaxReady Limited, or you can contact TaxReady Limited directly.
13. Cookies
13.1 We use cookies and similar technologies to operate our platform, remember your preferences, and analyse how our platform is used.
13.2 We use the following types of cookies:
- Strictly necessary cookies: Required for the platform to function (e.g., session cookies, authentication)
- Functional cookies: Remember your preferences and settings
- Analytics cookies: Help us understand how you use our platform so we can improve it
13.3 You can manage your cookie preferences through your browser settings. However, disabling certain cookies may affect the functionality of our platform.
14. Complaints
14.1 If you have any concerns about how we handle your personal data, please contact us first at privacy@record-os.com. We will do our best to resolve your concerns.
14.2 You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
15. Changes to This Privacy Policy
15.1 We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through our platform before the changes take effect.
15.2 The "Version" date at the top of this Privacy Policy indicates when it was last revised.
16. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us via email to privacy@record-os.com.