GDPR — Your Data Rights

Last updated: 9 September 2026

Our commitment to UK GDPR

We are committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains your rights in plain English and how to exercise them.

We believe in transparency. You should always know what data we hold, how we use it, and how to take control of it.

Your eight rights

Under UK GDPR, you have eight rights. Here is what each one means for you in practice:

Right of access

You can ask us for a copy of all the personal data we hold about you. We will provide it within one month, free of charge.

Right to rectification

If any of your data is inaccurate or incomplete, you can ask us to correct it. This includes any AI-generated data that you have not yet reviewed.

Right to erasure

You can ask us to delete your personal data. When you close your account, your data is automatically deleted within 30 days.

Right to restriction

In certain circumstances, you can ask us to temporarily stop processing your data — for example, while a data accuracy dispute is resolved.

Right to data portability

You can receive your data in a structured, machine-readable format and transfer it to another service provider.

Right to object

You can object to us processing your data based on legitimate interests or for direct marketing. We will stop unless we have a compelling reason to continue.

Automated decision-making

Alvin's AI produces suggestions like transaction categories and tax estimates — but these are always reviewable and editable by you. No AI makes a final decision about your finances without your input. You have the right not to be subject to decisions based solely on automated processing that produce legal effects.

Right to withdraw consent

Where we process your data based on consent (such as non-essential cookies), you can withdraw that consent at any time. Withdrawing consent does not affect processing that has already taken place.

How to exercise your rights

To exercise any of your rights, simply email us at admin@digitaltaxaccountant.com with your request. You do not need to give a reason.

We will respond within one month of receiving your request. If your request is complex or you have made several requests, we may need up to an extra two months — but we will let you know within one month if this is the case.

Data export

You can export your data from the app at any time. This includes your business and financial data, such as transactions, invoices, bills and mileage entries. The export is provided in a structured format so you can take it to another service if you wish.

Data deletion on account closure

When you close your account, we will delete your personal data within 30 days. The only exception is where we are legally required to retain certain records — for example, HMRC may require tax records to be kept for up to six years. In those cases, we will only retain what is legally necessary and delete the rest.

Our security practices

We protect your data using industry-standard security measures:

Encryption in transit (TLS) and at rest
Row-level security so each user can only access their own data
Strict access controls and audit logging
Regular security reviews
Data stored primarily in the UK and EEA

Contact us

If you have any questions about your data protection rights, please contact us at admin@digitaltaxaccountant.com. You also have the right to complain to the ICO at ico.org.uk.

This document is provided for transparency. If you have questions, contact us at [support email].