Privacy Notice

This notice explains what personal data Axion London Limited collects when you visit our website, use the Kontala service or interact with our API; how and why we use that data; who we share it with; how long we keep it; and the rights you have over it. It applies to website visitors, account holders, the people they invite (such as accountants and agents) and anyone who contacts us.

Please read this notice carefully. If anything is unclear, or if you would like to exercise any of your rights, you can reach our privacy team at privacy@kontala.com.

Kontala is a product of Axion London Limited (“Axion London”, “Kontala”, “we”, “us” or “our”), a company registered in England and Wales under company number 17153114, with its registered office at 124 City Road, London, EC1V 2NX.

Axion London Limited is an independent private company. It is not owned by, and does not form part of, any wider group of companies. We do not have a parent company, subsidiaries or affiliated group companies with whom your personal data is shared.

Kontala is an online VAT and Making Tax Digital (MTD) compliance platform for UK small businesses, freelancers and their accountants. For the purposes of UK data protection law — including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 — Axion London Limited is the “data controller” responsible for the personal data we collect and process about you through our website, the Kontala service, our API and any related communications.

We are registered with the Information Commissioner’s Office (ICO) under registration number ZC194068. If you have any questions about this notice or about how we handle your personal data, please contact us at privacy@kontala.com.

We collect and process the following categories of personal data.

We do not generally seek to collect “special category” data (such as information about your health, race or beliefs). Where you choose to tell us about a vulnerability or an additional support need, we will use that information only to provide you with appropriate support, and we rely on your explicit consent or, where applicable, the substantial public interest basis to do so.

We will only use your personal data when the law allows us to. Most commonly, we rely on one or more of the legal bases set out below. In practice a single activity may be supported by more than one legal basis.

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms and concluded that our processing does not override them. You can ask us for more information about this assessment at any time.

If you choose to connect a bank account to Kontala, we will access your bank account data (including transaction history, account balances, and account identifiers) via Open Banking. This functionality is provided through our Open Banking provider, Yapily Connect Ltd (FRN 827001), authorised and regulated by the Financial Conduct Authority.

We will only send you marketing communications where you have agreed to receive them or where we are otherwise permitted to do so by law. You can opt out at any time by using the unsubscribe link in any marketing email or by contacting us. We will never share your information with third parties for their own marketing purposes without your permission.

We do not sell your personal data. We share it only in the following circumstances:

• With people you ask us to — for example, if you choose to give your accountant, agent or bank access to your data, we will share it as you have instructed.
• With HMRC — where necessary to file your MTD VAT returns and help you meet your tax obligations.
• With our service providers — trusted suppliers and sub-processors who help us run the service (for example hosting, payment processing, identity verification, fraud prevention, communications and customer support). They may only process your data on our instructions and under a written contract that requires them to keep it secure.
• Yapily Connect Ltd — Open Banking infrastructure provider. Facilitates read-only connections to your bank accounts to enable transaction data import. FRN 827001. yapily.com
• Where the law requires it — with regulators, courts, law-enforcement and fraud-prevention agencies where we are legally obliged or permitted to share.
• In connection with a business transaction — if we reorganise, sell or transfer all or part of our business, we may share your data with the party involved, subject to appropriate confidentiality protections.

Because Axion London Limited is an independent company that is not part of any group, we do not share your personal data with any parent company, subsidiary or affiliated group company.

We are based in the United Kingdom and we aim to store and process your personal data within the UK or the European Economic Area (EEA). Where we need to transfer your personal data to a country outside the UK, we will only do so where one of the following safeguards is in place:

• the UK Government has decided that the country or organisation provides an adequate level of protection for personal data;
• the transfer is covered by an approved transfer mechanism, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
• the transfer has otherwise been authorised by the relevant data protection authority.

You can ask us for more information about the safeguards we use.

We keep your personal data only for as long as we need it for the purposes set out in this notice and to meet our legal, accounting and regulatory obligations. Tax and accounting records, for example, are generally retained for at least six years to comply with UK law.

The table below sets out our standard retention periods for account data held within the Kontala service:

Records held outside the Kontala application are kept in line with our internal retention schedules. Customer support records are kept for up to five years, but may be deleted sooner if your account is deleted. If you have signed up to marketing communications, deleting your account will not automatically cancel your marketing preferences; we will delete your contact details from our marketing system after two years of inactivity. At the end of the applicable retention period we will securely delete or anonymise your personal data.

Under UK data protection law you have a number of rights over your personal data:

• Right of access — to be told whether we hold personal data about you and to receive a copy of it.
• Right to rectification — to have inaccurate personal data corrected and incomplete data completed.
• Right to erasure — to ask us to delete your personal data in certain circumstances. You can also delete your own data using the reset-data and delete-account features in the service.
• Right to restrict processing — to ask us to limit how we use your personal data in certain circumstances.
• Right to data portability — to receive certain personal data in a structured, commonly used, machine-readable format and to have it transferred to another provider.
• Right to object — to object to our processing where we rely on legitimate interests, and to object to direct marketing at any time.
• Right to withdraw consent — where we rely on your consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out before you withdrew it.

You can exercise any of these rights by contacting us at privacy@kontala.com. We will respond within one month, although we may extend this by a further two months for complex requests, in which case we will let you know. Exercising these rights is normally free of charge.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Some features of the service use automation to suggest transaction categories or to flag items for your review, but a person remains responsible for the decisions that matter. If this changes, we will update this notice and tell you about the logic involved and the rights available to you.

Cookies are small files placed on your device that help us recognise you, remember your preferences and understand how our website and service are used. We use cookies to keep the service secure, to keep you signed in, to remember your settings and, where you have agreed, to measure and improve our website.

You can manage or disable cookies through your browser settings. Please note that disabling essential cookies may affect the availability or functionality of the Kontala service.

We take the security of your personal and financial data seriously. We use appropriate, industry-standard technical and organisational measures — including encryption in transit and at rest, access controls and ongoing monitoring — to protect your data against unauthorised access, alteration, disclosure or loss.

Where you have a password to access the service, you are responsible for keeping it confidential, and we ask that you do not share it with anyone. Although we work hard to protect your data, no method of transmission over the internet is completely secure, and we cannot guarantee the absolute security of data transmitted to us.

We may update this notice from time to time to reflect changes in our business, our practices or the law. When we make a significant change we will let you know by email or through an in-app notification, and we will update the “Last updated” date at the top of this page. We encourage you to review this notice periodically.

If you have any questions, concerns or requests relating to this notice or your personal data, please contact:

If you have a complaint about how we handle your personal data, please contact us first so that we can try to put things right. We will acknowledge your complaint and aim to respond without undue delay and within one month.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. You can also contact the ICO without complaining to us first, although we would appreciate the chance to address your concerns.