Legal
What personal data FileMyLtd uses, why, and the rights you have over it.
Last updated 6 November 2026
Who is responsible for your data
Cyber Spark IT Services Ltd (company number 14891489, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ) is the controller of personal data processed through FileMyLtd. Contact: hello@filemyltd.co.uk.
What we collect
- Account details: your name, email address, password (stored as a one-way hash) and two-factor settings.
- Company information: data from the public Companies House register, figures you enter for your accounts and tax return, and your company's UTR (stored encrypted).
- Filing records: what was submitted to Companies House and HMRC, and their responses.
- Technical data: security logs such as sign-in times and IP addresses, used to protect accounts.
- Contact form messages: your name, email address, optional company name and message, sent to our inbox so we can reply.
- Website analytics, only if you accept: pages visited, approximate location and device type, collected by Google Analytics.
We don't store your HMRC online login or use your data for advertising. See the cookie policy.
Why we use it, and the lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Running your account and preparing and sending filings you approve | Contract |
| Deadline reminders by email | Contract (you can turn them off) |
| Keeping records of filings | Legal obligation and legitimate interests |
| Security, fraud and abuse prevention | Legitimate interests |
| Answering contact form messages | Legitimate interests |
| Website analytics (Google Analytics) | Consent, which you can withdraw at any time |
Who we share it with
- Companies House and HMRC, when you submit a filing.
- Cloudflare, which hosts the service, stores data in its EU jurisdiction, sends our email and runs Turnstile, the check that stops spam on forms, under a data processing agreement.
- Google, for Google Analytics, only if you accept analytics cookies.
We don't sell personal data. If data is processed outside the UK, it is protected by UK adequacy regulations or the UK International Data Transfer Addendum.
How long we keep it
Account data is kept while your account is open. Filing records are kept for six years after the end of the period they relate to, matching record-keeping rules for companies, and then deleted. Security logs are kept for a short period unless needed to investigate an incident.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Email hello@filemyltd.co.uk. You can also complain to the Information Commissioner's Office at ico.org.uk.