Last updated: 8 October 2026
DoneLabs Ltd (Company No. 17056937) provides DoneTax+. For your practice's own account details (your name, email address, practice name, Agent Reference Number and billing) DoneLabs Ltd is the data controller. For the client records your practice handles in DoneTax+, your practice is the data controller and DoneLabs Ltd acts as its data processor, as our Terms of Service set out. Our registered address is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. For any data-related enquiries, contact us at hello@donetaxplus.co.uk.
We collect identity data (name, email address), HMRC OAuth tokens, National Insurance numbers, financial figures and filed submission records, professional data (Agent Reference Number, practice name), client data (National Insurance Numbers, financial transactions submitted on their behalf), and standard usage and technical data generated when you use the platform. If you request early access before opening an account, we collect your practice name, your email address and the number of clients you tell us you have. HMRC OAuth tokens, National Insurance numbers and the stored copy of each filed quarterly update are held using AES-256 application-level encryption.
Your data is used to provide the DoneTax+ service under contract, to send Making Tax Digital for Income Tax submissions to HMRC under legal requirement, to process billing via Stripe under contract, and to maintain security and prevent fraud under our legitimate interests.
UK law requires every Making Tax Digital API call to include fraud prevention headers. These include your IP address, browser fingerprint, and device identifiers. This data is transmitted to HMRC on every submission and cannot be disabled. It is a legal requirement of Making Tax Digital.
We share data with the following processors: Stripe (billing), Vercel (platform hosting), Neon (database storage), Resend (transactional email delivery), Upstash (rate limiting), Amazon Web Services (CloudFront, the network layer every request to DoneTax+ passes through), and Anthropic (support assistant processing, where the in-platform assistant is enabled). Submissions are transmitted to HMRC, which acts as a separate data controller for the data it receives. Your data is never sold, and never used for marketing or profiling. It is processed only by the infrastructure providers that run the service, each named above.
While your subscription is active, your data is kept. Cancelling your subscription ends your access to the product; it does not delete your account or your data. To have your data deleted, email hello@donetaxplus.co.uk and we will delete it within 30 days. Tax records must be kept for at least five years after the 31 January submission deadline of the tax year. That duty is the taxpayer's, so make sure you and your clients hold your own copies before asking us to delete. Early access requests are kept so that we can tell you when DoneTax+ opens to your practice; email hello@donetaxplus.co.uk to be removed at any time. Our database is hosted in the AWS Europe West 2 (London) region, United Kingdom.
Under UK GDPR you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data. To exercise any of these rights, contact hello@donetaxplus.co.uk. You may also lodge a complaint with the Information Commissioner at ico.org.uk.
DoneTax+ uses three cookies. The session cookie (donetaxplus_session) keeps you signed in and is strictly necessary for the platform to function. The device cookie (dtpDeviceId) is set on your first visit and lasts for up to 10 years; it holds a random identifier for your device, which is sent to HMRC as the device ID in the fraud prevention headers that the law requires on every HMRC call. The sign-in cookie (__Host-dtpLinkBrowser) is set when you ask for a sign-in or sign-up link and lasts 35 minutes; it lets us recognise the browser that asked for the link, so that a link opened anywhere else is confirmed with your email address. We do not use advertising cookies, tracking cookies, or any third-party analytics cookies.
We will notify you of any material changes to this privacy policy by email or via an in-platform notice before the changes take effect.
You have the right to raise a formal data protection complaint if you are unhappy with how DoneLabs Ltd handles your personal data. This right is established under the Data (Use and Access) Act 2025 and UK GDPR.To raise a complaint, sign in to your DoneTax+ account and go to donetaxplus.co.uk/settings - your complaint form is in the Data Protection Complaint section. If you are unable to access your account, you can email us directly at hello@donetaxplus.co.uk with the subject line 'Data Protection Complaint'.We will acknowledge your complaint within 30 days of receipt and will keep you informed of progress and expected timeframes for resolution.If you are not satisfied with our response, or if we have not responded within a reasonable time, you have the right to escalate your complaint to the Information Commissioner's Office (ICO). The ICO can be contacted at ico.org.uk or by calling 0303 123 1113.
hello@donetaxplus.co.uk · DoneLabs Ltd · 71-75 Shelton Street · Covent Garden · London · WC2H 9JQ · ICO Registration No. ICO-0001353294