Privacy Policy
Last updated: 20 October 2026
This policy explains what personal data Levy Desk collects, how we use it, who we share it with, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).
1. Who we are
Levy Desk is a trading name operated as a sole trader in the United Kingdom.
We are the data controller for personal data processed through levydesk.co.uk. For data protection enquiries, contact us at privacy@levydesk.co.uk.
2. What data we collect
| Category | Examples | Why |
|---|---|---|
| Account data | Email address, name | Authentication and account management |
| Booking data | Check-in/out dates, guest counts, gross income, booking source | Calculating visitor levies and producing returns |
| Property data | Property name, address, postcode, council, accommodation type | Applying the correct levy rules per council |
| Workspace data | Business name, VAT number, plan tier | Account and billing management |
| Payment data | Billing name, last 4 digits of card, subscription status | Processing subscription payments via Stripe |
| Usage data | Pages visited, actions taken, approximate location (country/region) | Improving the product via Google Analytics |
We do not collect or store full payment card numbers. Card processing is handled entirely by Stripe.
3. Lawful basis for processing
We process your personal data on the following legal bases under UK GDPR:
- Contract performance — processing your booking and property data to provide the levy calculation and return-filing service you signed up for.
- Legitimate interests — product analytics (Google Analytics, aggregated and anonymised) and transactional email reminders about filing deadlines. We have assessed that these interests are not overridden by your rights.
- Legal obligation — retaining financial records for the periods required by HMRC and UK tax law.
4. How we use your data
- Authenticating you via magic link email
- Calculating visitor levy amounts for each booking
- Generating quarterly return packs (PDF and CSV)
- Sending filing deadline reminders and nil-return notifications
- Processing subscription payments
- Displaying aggregated usage in your workspace audit log
- Improving the product using anonymised analytics
We do not sell your data. We do not use your data for advertising.
5. Third parties we share data with
Stripe — Payment processing
Processes subscription payments. Card data is stored and processed by Stripe under their own privacy policy. Stripe is certified to PCI DSS Level 1.
Supabase / Neon — Database hosting
Your account, booking, property, and return data is stored in a managed PostgreSQL database. Data is stored in the EU.
Resend — Transactional email
Sends magic-link sign-in emails and filing reminders. Only your email address and the content of the email are shared.
Vercel — Hosting and compute
Hosts and runs the Levy Desk application. Request logs may include your IP address. Data is processed in the EU/UK.
Google Analytics — Usage analytics
Collects anonymised page-view and interaction data. IP addresses are anonymised. You can opt out via the Google Analytics opt-out browser add-on.
All third-party processors have been assessed to provide adequate data protection. Where transfers outside the UK/EEA occur, they are covered by UK adequacy regulations or standard contractual clauses.
6. How long we keep your data
| Data type | Retention period |
|---|---|
| Account and workspace data | Retained while your account is active. Deleted within 30 days of a verified account closure request. |
| Booking and levy calculation data | 6 years from the date of the booking (HMRC record-keeping requirement for tax records). Deleted on account closure after this period. |
| Payment and billing data | 7 years (legal requirement). Payment card data is retained by Stripe under their own policy. |
| Analytics data | 26 months (Google Analytics default, anonymised). |
7. Your rights
Under UK GDPR you have the following rights. To exercise any of them, email privacy@levydesk.co.uk. We will respond within one calendar month.
- Right of access — request a copy of all personal data we hold about you.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure — ask us to delete your data, subject to legal retention requirements (e.g. tax records).
- Right to restrict processing — ask us to pause processing while a dispute is resolved.
- Right to data portability — receive your booking and return data in a machine-readable format (CSV).
- Right to object — object to processing based on legitimate interests, including analytics.
If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
8. Cookies
Levy Desk uses a session cookie to keep you signed in (a JSON Web Token stored as an httpOnly cookie). This is strictly necessary for the service to function and does not require consent.
Google Analytics uses cookies to distinguish unique visitors. These are analytics cookies. You can block them using your browser settings or a browser extension. We do not use advertising or tracking cookies.
9. Changes to this policy
We may update this policy when our data practices change or when required by law. Material changes will be notified by email to registered users. The "last updated" date at the top of this page reflects the most recent revision.
10. Contact us
For any data protection questions or to exercise your rights:
Email: privacy@levydesk.co.uk