CGT Online
Legal

Privacy Notice

How File CGT Online collects and uses your personal data

Effective 6 July 2026Everest and Co Accountants Limited · regulated by the ICAEW

1. Introduction and identity of the controller

1.1
This Privacy Notice explains how we collect, use, share and protect your personal data when you use File CGT Online, and your rights in relation to that data. It should be read together with the Letter of Engagement and the Terms of Service.
1.2
The controller of your personal data is Everest and Co Accountants Limited, a company registered in England and Wales under number 16144493, whose registered office is at 61 Worcester Street, Wolverhampton, West Midlands, WV2 4LQ, trading as File CGT Online and regulated by the ICAEW. We are registered with the Information Commissioner’s Office. We process personal data in accordance with the UK GDPR and the Data Protection Act 2018.
1.3
You may contact us about your personal data, including to exercise any of your rights, at hello@filecgtonline.co.uk, 61 Worcester Street, Wolverhampton, WV2 4LQ or Tel No TBC

2. The personal data we collect

Depending on how you use the Service, we collect and process:

  • identity and contact details: your name, address, date of birth, email address and telephone number;
  • identity-verification information: information and documents used to confirm your identity and to carry out anti-money laundering screening, which may include a copy of an identity document and the results of electronic checks;
  • disposal and financial information: details of the property, dates, prices, costs, reliefs and other information needed to calculate and report your gain, together with the documents you upload;
  • information obtained from HMRC that is relevant to your return;
  • payment information: processed by our payment provider; we do not store full card details;
  • records of our dealings with you: messages, correspondence, and recordings or notes of calls; and
  • technical and usage data: information about how you access and use the platform, including device and log data.

3. Why we use your data and our lawful bases

3.1
We use your personal data to take you on and retain you as a client in accordance with legal and professional requirements (including anti-money laundering obligations); to verify your identity; to prepare, review and file your CGT Return; to deal with HMRC on your behalf; to take payment; to communicate with you and handle queries and complaints; to keep records; and to comply with our legal, regulatory and professional obligations.
3.2
Our lawful bases for this processing are: performance of our contract with you; compliance with legal obligations (tax and anti-money laundering law and our professional rules); our legitimate interests in operating, securing, and improving the Service and in defending against claims; and, for optional marketing only, your consent, which you may withdraw at any time.

4. Special category and criminal offence data

4.1
In carrying out identity and anti-money laundering checks we may process special category data or information relating to criminal offences. Where we do so, we rely on the bases permitted for those purposes under the Data Protection Act 2018, including compliance with a legal obligation and the prevention and detection of unlawful acts.

5. Automated tools, artificial intelligence and call recording

5.1
We use software, automation and artificial-intelligence-assisted tools to help read documents, prepare drafts and operate the Service efficiently. These tools assist our qualified staff and do not make decisions about you on their own. We do not carry out solely automated decision-making that produces legal or similarly significant effects for you; a qualified member of the Firm reviews the work before any CGT Return is filed.
5.2
Telephone and video calls may be recorded, and messages retained, for training, quality-assurance and compliance purposes.

6. Who we share your data with

6.1

To provide the Service and meet our obligations, we may disclose your personal data to:

  • (a)HMRC;
  • (b)the third parties that operate parts of our platform on our behalf. For example identity-verification, payment, communications, scheduling, document-processing and hosting providers, who act on our instructions under written contract;
  • (c)our professional advisers and insurers;
  • (d)the ICAEW, and any reviewer acting on its behalf, in connection with quality assurance; and
  • (e)where the law permits or requires, courts, tribunals, the Information Commissioner’s Office, and law-enforcement or other authorities.
6.2
We do not sell your personal data.

7. Processing and storage outside the United Kingdom

7.1
Some of the processing carried out on our behalf may take place outside the United Kingdom. Where that occurs, we ensure the transfer is protected either by an adequacy decision or by appropriate safeguards (such as the Information Commissioner’s International Data Transfer Agreement or equivalent contractual protections), so that your data receives a level of protection equivalent to that required in the United Kingdom.

8. How long we keep your data

8.1
We retain records relating to the tax work we carry out for you for seven years from the end of the tax year to which they relate. Certain identity and anti-money laundering records are kept for the duration of our engagement and for five years thereafter, as required by the Money Laundering Regulations 2017. Some information is kept for as long as necessary to defend against potential claims within applicable limitation periods. After the relevant period, we securely delete or anonymise the data.

9. Security

9.1
We apply appropriate technical and organisational measures to protect your personal data and restrict access to those who need it. No transmission over the internet is ever wholly secure, and we maintain measures to deal with any suspected breach.

10. Your rights

10.1
Under data protection law you have the right to be informed about how your data is used; to access a copy of it; to have inaccurate data corrected; to have data erased in certain circumstances; to restrict or object to processing in certain circumstances; and, where processing is automated and based on consent or contract, to data portability.
10.2
To exercise any right, contact us using the details in clause 1. We will respond within one month, and will tell you if we need to extend that period (by up to two further months) or if we are entitled to withhold information. For example where its release would be likely to prejudice the prevention or detection of crime, the assessment or collection of tax, or reveal information about another person.

11. Complaints

11.1
If you are concerned about how we handle your data, please tell us first so that we can put matters right. You may also complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (www.ico.org.uk), or to the ICAEW.

12. Changes to this Notice

12.1
We may update this Privacy Notice from time to time. The current version is always available on the platform and is identified by its effective date: 06 July 2026