Privacy notice

1 Who we are

JMTI Tax Limited, trading as JMTI, is a specialist tax investigations and disputes practice. We are the controller of the personal information described here, which means we are responsible for it under UK data protection law.

We are registered with the Information Commissioner’s Office (ICO) under registration number ZC255750. Our director, John Moxon, is responsible for data protection matters.

2 What we collect and why

Depending on your matter, we may hold your contact and identity details, identification documents (which we must obtain under anti-money laundering law), financial and tax information, and the papers relating to your enquiry, dispute or appeal, along with our correspondence and notes.

Most of this comes directly from you. We may also receive information from HMRC, your other advisers, people connected with your matter, public sources such as Companies House, and the identity-verification providers we use to meet our legal obligations.

We use this information to advise and represent you, to meet our legal and regulatory obligations (including anti-money laundering checks and any reports the law requires us to make), to run and bill for our practice, and to deal with any complaint or claim. Our lawful bases are performance of our contract with you, compliance with our legal obligations, and our legitimate interests in acting for clients and running the firm. We do not sell your information or use it for marketing without your consent.

3 Sensitive information

Our work sometimes involves information the law treats as particularly sensitive. For example, details of a person’s health where relevant to a “reasonable excuse” argument, or information about alleged dishonesty in an investigation, which counts as criminal offence data. We use such information only where it is necessary for your matter and our legal obligations, relying principally on the condition relating to legal claims under the UK GDPR and the Data Protection Act 2018.

4 Sharing and storage

We share personal information only where necessary. For example, we may share it with HMRC, tribunals and courts when acting for you; with other advisers involved in your matter; with ICAEW, our professional body and anti-money laundering supervisor; with law enforcement where the law requires it; with our insurers if a claim arises; and with the service providers who support our practice (our IT and email provider Microsoft, our website host Netlify, our form provider Formspree, and identity-verification providers).

Some providers store data outside the UK. Where that happens, we make sure it is protected by an appropriate safeguard, such as UK adequacy regulations or the ICO’s standard data transfer terms.

We protect your information with encrypted devices, secure cloud storage with multi-factor authentication, restricted access and confidentiality obligations. If a breach occurs that is likely to put your rights at risk, we will notify the ICO and, where required, tell you.

5 How long we keep it

We keep information only as long as we need it. Client files are generally kept for at least six years after a matter ends; anti-money laundering records for five years; and enquiries that do not lead to us acting for you for up to 12 months. When information is no longer needed, we delete or destroy it securely.

6 Your rights

You have the right to ask for a copy of the information we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to withdraw consent where we rely on it. Some of these rights are limited by law. For example, we cannot delete records we are legally required to keep, and exemptions apply to privileged information and to tax matters.

To exercise any right, please get in touch using the form on our website. There is normally no charge and we will respond within one month, though we may need to confirm your identity first.

7 Contact and complaints

If you have any concerns about how we handle your information, please contact us first and we will do our best to put things right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

We may update this notice from time to time; the date at the top shows when it was last changed.