Privacy notice

Tally is private software with a single user. It reads the tax and filing position of JAMES GREENWOOD LTD and of its sole director, on behalf of that director, so that deadlines and liabilities are noticed before they become penalties.

There are no customers, clients or third-party users. No other person's data is accessed, held or processed. Nothing is sold, shared, published or used for advertising, and there is no analytics or tracking of any kind.

JAMES GREENWOOD LTD, a company registered in England and Wales, number 11311731, is the data controller, together with its sole director acting in a personal capacity for his own tax affairs.

Contact: jamey@greenwood.im

Tally holds only what it needs to say what is owed and when:

• Company records — filing deadlines, filing history and filed accounts from the Companies House public register
• Tax position — VAT, Corporation Tax and Self Assessment obligations, liabilities, payments, penalties and interest
• Accounting records — bank transactions and invoices from the company's bookkeeping system
• Correspondence — email from tax authorities, the company's accountant and its bank, where it evidences a deadline or an amount

The lawful basis is legitimate interest: a company and its director keeping accurate records of their own statutory obligations. Some of it is also a legal obligation, since company and tax records must be kept.

Companies House, HM Revenue & Customs, the company's accounting software and the director's own mailbox. Each connection is read-only and authorised by the director through that provider's own consent screen, which he can withdraw there at any time.

Tally does not file anything and does not move money. It has no ability to submit a return, authorise a payment or change a record at any authority or bank.

• Held in a PostgreSQL database on a single server operated by the controller
• Reached only over HTTPS, and only after signing in
• Access credentials for connected services are encrypted at rest with AES-256-GCM under a key held outside the database
• Backed up nightly with restic, which encrypts on this machine before anything is uploaded. Backups are stored in the European Union, in Amsterdam. The storage provider holds ciphertext and does not hold the key

For as long as the underlying records must be kept — company and tax records are ordinarily retained for at least six years — and then no longer. Nothing is retained for any purpose beyond the one it was collected for.

The only individual whose personal data is held is the director operating the software, who has direct access to all of it. Rights of access, correction, erasure, restriction, portability and objection apply in the ordinary way and can be exercised at the address above.

A complaint may be made to the Information Commissioner's Office at ico.org.uk.