Privacy notice

This notice explains what personal data ToggleKit Ltd collects, why we use it, who we share it with, how long we keep it and the rights you have over it.

Who we are

• ToggleKit Ltd, registered in England and Wales, company number 17020947 (opens in new tab)
• Registered office: Suite Ra01, 195-197 Wood Street, London E17 3NU
• Registered with the Information Commission (formerly the ICO), reference ZC093090 (opens in new tab)
• Contact for anything in this notice: Ben Morton, director, ben@togglekit.dev

When we are a controller, and when we are a processor

We are the controller for the personal data described in this notice: business contacts at accountancy practices, the people we work with at our customer practices, our anti-money laundering records and visitors to this website.

When we prepare records for an accountancy practice, the practice’s clients’ data belongs to the practice. The practice is the controller and we are its processor, working only on its written instructions. If you are a client of a practice we work for, the practice’s own privacy notice applies, and the practice is the right first contact. If you contact us about that data, we pass your request to the practice.

Business contacts at accountancy practices

We contact accountancy practices to tell them about our record preparation service.

• What we hold: your name, job title, business email address and business phone number, your practice’s name and public details about the practice, our messages to you and any replies, and whether you have asked us not to contact you again.
• Where it comes from: your practice’s own website and Companies House.
• Why, and our lawful basis: to offer our service to practices, under our legitimate interests in promoting our business to other businesses. We email people at limited companies, limited liability partnerships and Scottish partnerships. We contact other practices only by phone or LinkedIn, after checking the Corporate Telephone Preference Service and the Telephone Preference Service.
• How long we keep it: 12 months after our last contact with you, unless your practice becomes a customer. If you ask us not to contact you again, we keep your email address or phone number and the date on a short suppression list, so that we never contact you again.

You can object to direct marketing at any time. Reply to any of our emails, or email ben@togglekit.dev, and we will stop.

People we work with at customer practices

• What we hold: your name, role and contact details, our agreement with your practice and our correspondence.
• Why, and our lawful basis: to agree and carry out our work for your practice, under our contract with your practice and our legitimate interests in managing that relationship.
• How long we keep it: 6 years after our relationship with your practice ends.

Anti-money laundering records

• What we hold: due diligence records about customer practices, including the names of owners with more than 25%, the practice’s anti-money laundering supervisor and registration, sanctions check results and the checks we made on the person who instructs us.
• Why, and our lawful basis: to meet our obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (legal obligation).
• How long we keep it: 5 years after our relationship with the practice ends, as the regulations require.

Visitors to this website

• Hosting: the site is hosted by Vercel, which processes your IP address and browser details to deliver pages and protect the site from abuse.
• Analytics: we use Vercel Web Analytics and Vercel Speed Insights. They do not use cookies. They record anonymous data: the page you visited, the referring site, your country, your browser, operating system and device type, and page speed measurements. Vercel Web Analytics recognises a visit using a hash of the request, which is discarded after 24 hours. Neither tool lets us identify you.
• Theme setting: if you use the light or dark mode button, your choice is saved in your own browser. It is never sent to us.
• Our lawful basis: our legitimate interests in running a secure website and understanding how it is used.

We do not use advertising or tracking cookies.

Who we share personal data with

We do not sell personal data. We share it only with:

• Zoho, which provides our business email and file storage, in its EU data centre.
• Vercel, which hosts this website and provides the anonymous analytics described above.
• Anthropic, whose AI assistant we use to research practices and draft our emails to them.
• Our professional advisers, such as our accountant, solicitor and insurers, where they need it to advise us.
• HMRC, the National Crime Agency, the police or other authorities, where the law requires us to.

Transfers outside the UK

Some of our providers may process personal data outside the UK, including in the United States. When they do, we rely on the UK’s adequacy regulations or on the safeguards set by UK law, such as the International Data Transfer Agreement or the International Data Transfer Addendum.

How we protect personal data

Every account that holds personal data uses multi-factor authentication, and data is encrypted in transit and at rest. We do not make decisions about anyone by automated means alone.

Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct it if it is wrong;
• ask us to delete it;
• ask us to restrict how we use it;
• object to how we use it, including the absolute right to object to direct marketing at any time;
• ask for data you gave us in a portable format, where that right applies.

Email ben@togglekit.dev to use any of these rights. We reply within one month. Some rights are limited by law, for example where telling you could prejudice the prevention or detection of crime, or where we must keep records under the Money Laundering Regulations.

Complaints

Please contact us first, so we can try to put things right. You also have the right to complain to the Information Commission at ico.org.uk/make-a-complaint (opens in new tab).

Changes to this notice

We update this notice when what we do with personal data changes. The date below shows the latest version.

Last updated: 17 October 2026.