Privacy Policy

1. Who We Are

Loomi is a VAT compliance software platform operated by TAXME LTD, a company registered in England and Wales. In this Privacy Policy, “Loomi”, “we”, “us” and “our” mean TAXME LTD.

This Privacy Policy explains how we collect, use, disclose, store and protect personal data in connection with our website, Loomi platform and related services, including optional VAT compliance and filing services. For privacy enquiries, contact hello@loomi.tax.

Where customers use Loomi to process transaction data, TAXME LTD generally acts as a data processor on their behalf. Where TAXME LTD provides professional VAT compliance or filing services, it may act as an independent data controller for certain activities, including maintaining legally required records and managing regulatory correspondence, depending on the services and applicable law.

2. Who This Privacy Policy Applies To

This Privacy Policy applies to visitors to our website, Loomi account holders and users, prospective customers, business contacts and individuals whose personal data TAXME LTD processes for its own purposes. Customer-uploaded transaction records may include information about purchasers, suppliers and other individuals. Where we process such data solely on a business customer’s behalf, that customer generally acts as the data controller and our Data Processing Agreement applies. This Privacy Policy also applies to members of accountancy practices who use Loomi, and to contacts at a practice’s clients who receive an email or link from Loomi on the practice’s behalf; for their clients’ data, we act on the practice’s behalf under our Data Processing Agreement.

3. Personal Data We Collect

Depending on how you interact with Loomi, we may process the following information:

Account and contact information: Names, email addresses, company names, business contact details, account credentials or authentication identifiers, user roles and communications.

Business and VAT information: Business identification details, VAT registration numbers, countries of registration and information needed to prepare VAT calculations and returns.

Transaction and financial information: Sales, purchases, refunds, movements of goods, dates, invoice details, amounts, currencies and VAT-related information from uploaded files or authorised connections. Source records may also contain personal information about customers, suppliers or other individuals.

Subscription and billing information: Subscription plans, billing details, invoices, payment status and relevant payment information available to us through our payment provider.

Technical and usage information: IP addresses, browser and device information, login activity, security logs and information about use of our website and platform.

Professional VAT filing information: Where filing services are separately requested, filing authorisations, tax-authority correspondence, submitted returns, acknowledgements and supporting documentation.

3.1 Where We Obtain Personal Data

We obtain information directly from individuals who create accounts, use our services or contact us. We may also receive information from business customers uploading files, authorised marketplace or e-commerce integrations, tax authorities, professional advisers, authorised filing partners and relevant public business or tax registers.

Certain account details and relevant business or transaction information are necessary to provide requested services. If this information is not provided, some platform functions or VAT filing services may be unavailable.

4. How and Why We Use Personal Data

We process personal data for the following purposes, relying on lawful bases under Article 6 of the UK General Data Protection Regulation (UK GDPR):

• Providing our services: To manage accounts, operate Loomi, provide customer support and deliver requested services, including optional VAT filing. We rely on contractual necessity where applicable, or legitimate interests in providing services to business customers.
• Payments and legal compliance: To manage subscriptions, issue invoices, maintain required records and comply with applicable tax and legal obligations. We rely on contractual necessity, legitimate interests or legal obligations, as appropriate.
• Security and communications: To protect our platform, prevent fraud and respond to enquiries. We generally rely on legitimate interests.
• Marketing and cookies: To send permitted marketing communications and use cookies, relying on consent where required or legitimate interests where legally permitted, subject to applicable electronic marketing and cookie rules.
• Professional records: To retain relevant filing confirmations, correspondence and other records where legally required or reasonably necessary to establish or defend legal claims.

Where we process transaction data solely on behalf of business customers, we generally act as a data processor under our Data Processing Agreement.

Loomi uses deterministic, expert-written rules to classify transactions, determine VAT treatment and calculate VAT amounts. AI does not classify transactions or determine VAT calculations; it is used only to reword, in plainer language, alerts that Loomi’s deterministic checks have already raised. AI commentary does not override the rules engine’s results.

5. Sharing Personal Data

We may share personal data with trusted third-party service providers where necessary to operate Loomi and deliver our services. These may include cloud hosting providers, payment processors, IT and security providers, and customer support services. They include providers of hosting and data storage, sign-in, email delivery, VAT number checks against the EU VIES system, error monitoring, internal team messaging, and an AI service that rewords alerts in plainer language. The current list of providers that process customer data for us is in Schedule 2 of our Data Processing Agreement.

Where customers request VAT filing services, we may also share relevant information with tax authorities, professional accountants, tax agents or other authorised filing partners, including providers in other countries. We require service providers acting on our behalf to protect personal data and comply with applicable data protection requirements. Some professional advisers, tax authorities and filing partners may act as independent data controllers under their own legal responsibilities.

We do not sell personal data.

6. International Data Transfers

As Loomi provides services internationally, personal data may be processed or accessed in countries outside the United Kingdom, including where we work with technology providers or authorised VAT filing partners. The Loomi platform’s data is hosted in the European Union (Frankfurt, Germany). Some of our service providers are based in the United States.

Where international transfers take place, we comply with applicable data protection laws and use appropriate safeguards, which may include recognised adequacy arrangements or approved contractual protections. You may contact hello@loomi.tax for further information about safeguards applicable to your personal data.

7. How Long We Keep Personal Data

We retain personal data only for as long as necessary to provide our services, fulfil the purposes described in this Privacy Policy and comply with applicable legal and regulatory requirements.

The retention period depends on the type of information, the services provided, the purposes for which it is processed and any applicable legal obligations.

Generally, we retain personal data while a customer uses Loomi. When an account is deleted, we delete the account and the data held in it without undue delay, including uploaded files, calculated returns, filing records and messages with our tax team. Deleted data may remain in backups for a short period, normally up to 7 days, before it is permanently removed. We keep billing records, such as invoices, for as long as the law requires. Please download any records you need, such as returns and audit exports, before deleting your account.

Where TAXME LTD processes transaction data on behalf of customers, the return or deletion of that data is governed by our Data Processing Agreement.

You may request deletion of your personal data by contacting hello@loomi.tax, subject to applicable legal requirements and exceptions. You can also delete your account yourself from your profile in the Loomi platform.

8. Your Data Protection Rights

Depending on the circumstances, you have the right to access, correct or request deletion of your personal data, restrict or object to certain processing, request data portability and withdraw consent where applicable.

To exercise your rights, please contact us at hello@loomi.tax. Where we process personal data on behalf of a business customer, we may direct your request to that customer as the responsible data controller.

You may lodge a complaint with the UK Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/. Where EU GDPR applies, you may also contact the relevant EU data protection authority.

9. Cookies, Security and Policy Updates

The Loomi platform uses only the cookies needed to sign you in and keep your session secure; it uses no advertising or analytics cookies. Our website counts visits without cookies. The booking calendar on our website may set its own cookies, which you can accept or decline in the calendar. Our Cookie Policy lists the cookies we use.

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure.

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or data protection practices. Where appropriate, we will notify users of significant changes.