In the UK, the EEA and Switzerland, Google advertising cookies and Google Analytics are used only with your consent. Calculators work in your browser and there are no user accounts. Contact form messages are stored with our hosting provider, Netlify, and read only by the Editor.
Who we are and how to contact us
UK Tax Drag is published by Finsolve Consulting Limited, a company registered in England and Wales (company number 15562432). Finsolve Consulting Limited is the controller of the personal data described in this notice, under the UK GDPR and the Data Protection Act 2018.
To ask about this notice or to use any of your rights, send a message through the contact form and choose Data or privacy request. The contact form is the way to reach us about privacy.
Advertising (Google AdSense)
This site uses Google AdSense to show display advertising. On pages with ads, Google’s ad script loads with the page so that, where Google’s consent message is in use, Google can show it and then serve ads in line with your choice.
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
- Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet.
- You can opt out of personalised advertising by visiting Google’s Ads Settings. You can also opt out of some other vendors’ use of cookies for personalised advertising at aboutads.info or Your Online Choices.
If you do not consent. Google does not show you personalised ads. If you do not consent to Google storing or accessing information on your device, Google can show only limited ads. Limited ads do not collect, share or use personal data to personalise ads, but data such as your IP address is still used to deliver them, and where the publisher leaves Google’s option switched on they can use cookies and local storage solely to detect invalid traffic, fraud and abuse. Non-personalised ads, which are based on context such as the page you are reading and your general location, still need that consent, because they use cookies for frequency capping, aggregated ad reporting and fighting fraud and abuse.
Google acts as an independent controller of the personal data it collects through AdSense, under the Google Ads Controller-Controller Data Protection Terms. Google explains its use of this data in How Google uses information from sites or apps that use our services and in the Google Privacy Policy. Where ads may and may not appear is set out in the advertising policy.
Your consent choices
Where Google’s consent message is shown (to visitors from the UK, the EEA or Switzerland, on pages with ads), it has the buttons Consent, Do not consent and Manage options, and lists the advertising partners involved and the purposes they use data for.
If Google’s message does not load (for example, when an ad blocker stops Google’s script), or on a page that carries no ads, our own fallback message asks for your choice instead, with the buttons Accept all, Reject all and Manage. It asks separately about Google Analytics and Google advertising cookies. On pages where Google’s message is in use, a choice made earlier in the fallback message is not used.
Changing or withdrawing consent. You can withdraw consent at any time, and it is as easy as giving it. Use the Cookie settings link at the bottom of every page, or the button below: it reopens Google’s message where that message is in use, and the fallback preferences everywhere else. A choice made in the fallback message is remembered for 180 days. Clearing this site’s cookies and site data in your browser also resets your choices. Withdrawing consent does not affect anything that happened before you withdrew it.
Analytics (Google Analytics 4)
We use Google Analytics 4 to see how the site is used, so we can decide what to improve. With your consent it records:
- the pages you view, how far down a page you scroll, and page speed measurements;
- your site searches: the words you type into the search box (the first 80 characters), and the search words in the address of the search results page;
- when you start using a calculator and when a result appears, and actions such as saving a scenario, sharing a link or downloading a PDF;
- clicks on links and buttons, including links to other websites;
- browser and device information and the
_gacookie identifiers listed below.
Page addresses and calculator figures. Calculator events do not include the figures you enter. When a page loads, we send Google Analytics its address without anything after a question mark (?) or hash (#), and the address of the page you came from in the same shortened form; the events our own code sends use the same shortened address. Some calculators, such as the tax calculator, also write your figures into the page address as you change them, so that you can bookmark or share a result. Each time that happens, Google Analytics records a further page view, and those page views can include the full address with your figures, and the address before the change. Those further page views, and the search words taken from the address of the search results page, come from Google Analytics’ enhanced measurement, which is set in our Google Analytics property rather than in the page code, so the shortening above does not apply to them.
When it loads. Google Analytics does not load until analytics is allowed: through Google’s consent message (consent to storing information on your device and to Google as a partner), or through Accept all or the analytics option in the fallback message. The only exception is where Google’s consent message reports that GDPR does not apply to your visit; that does not happen for visitors in the UK, the EEA or Switzerland.
IP addresses. Google states that Google Analytics does not log or store IP addresses from users in the UK, the EU or Switzerland. It uses the IP address briefly to work out an approximate location, such as the city, and then discards it.
Retention. Event-level and user-level data is kept for the retention period set in our Google Analytics property, which for a standard property can be no longer than 14 months. That setting does not apply to standard aggregated reports.
Google acts as our processor for Google Analytics, under Google’s data processing terms. We also use Google Search Console, which reports how the site appears in Google Search; it adds nothing to the pages you visit.
Other services on some pages
When you download a PDF summary, your browser fetches the PDF code library from cdnjs, which is run by Cloudflare. Two pages with charts fetch the Chart.js library from jsDelivr. These services receive the usual connection details, such as your IP address, so that they can deliver the file.
Why we use your data and who receives it
| Purpose | Data | Lawful basis (UK GDPR Article 6) | Who receives it | Where |
|---|---|---|---|---|
| Replying to messages sent through the contact form | Your message, reply email address, enquiry type, the page you sent it from, your name and a URL if you give them, and the time it arrived | Legitimate interests (Article 6(1)(f)): answering your enquiry and keeping a record of corrections and requests | Netlify, Inc., our hosting provider, as our processor | Netlify, Inc. is a US company; messages are held in one Netlify storage region and cached on Netlify’s network |
| Showing ads | Cookie and device identifiers, IP address, browser details, the page you are on and your interactions with ads | Consent (Article 6(1)(a)) for advertising cookies and personalised ads. Google decides its own lawful bases as an independent controller | Google, as an independent controller, and the ad partners named in Google’s consent message | Google LLC and partners, including in the United States |
| Measuring how the site is used | The analytics data listed above | Consent (Article 6(1)(a)) | Google, as our processor for Google Analytics | Google LLC, including in the United States |
| Delivering the website and keeping it secure | Details every browser sends with a request: IP address, page requested, date and time, browser details and referring page | Legitimate interests (Article 6(1)(f)): running a secure, working website | Netlify, Inc., as our processor | Netlify, Inc. is a US company |
| Measuring page speed (Netlify Real User Monitoring) | Page-speed measurements known as Web Vitals (how quickly the page loads and responds to a tap or click, and how much the layout shifts), plus the details every browser sends with a request, such as IP address and browser details. A small script that Netlify adds to each page sends them; it sets no cookies and stores nothing on your device | Legitimate interests (Article 6(1)(f)): keeping the site fast and working on real devices | Netlify, Inc., as our processor; Netlify reports the measurements to us only as totals, not per visitor | Netlify, Inc. is a US company |
| Loading code for PDF downloads and charts | IP address and browser details, sent by your browser when it fetches the code | Legitimate interests (Article 6(1)(f)): making PDF downloads and charts work | cdnjs, run by Cloudflare (when you download a PDF), and jsDelivr (on pages with charts) | Their content delivery networks |
| Remembering your settings and saved work | The on-device storage listed below | This stays in your browser and is not sent to us. Storage that is strictly necessary or that remembers a setting you chose needs no consent under PECR; analytics storage waits for your consent | Nobody | Your device |
We do not sell personal data.
International transfers
Netlify, Inc. and Google LLC are based in the United States, so personal data they handle for this site may be processed there. Both companies are certified under the UK Extension to the EU-U.S. Data Privacy Framework, which UK law recognises as giving adequate protection to personal data sent to certified US organisations. You can check each certification on the Data Privacy Framework List.
Cookies and on-device storage
This table lists the cookies and browser storage (localStorage and sessionStorage) the site uses. Browser storage stays on your device and is not sent to us. Google decides which of its own cookies to set, based on your consent choice; Google’s list of advertising cookies gives the full details.
| Name | Set by | Purpose | How long | Essential or consent |
|---|---|---|---|---|
tdx-consent (cookie) | UK Tax Drag | Remembers your choice in the fallback consent message | 180 days | Essential |
tdx-consent-json | UK Tax Drag | A copy of the same choice | 180 days, then deleted and you are asked again | Essential |
tdx-theme, tdxTheme | UK Tax Drag | Remember light or dark theme | Until you clear site data | Essential (a setting you chose) |
tdx-scenarios-v1, tdx-profile | UK Tax Drag | Saved calculator scenarios and the figures you save in My Tax Drag | Until you delete them or clear site data | Essential (saved only when you choose to save) |
tdx_recent_v1, tdx_favs_v1 | UK Tax Drag | Pages you open from the Find a tool panel, listed there as recently used, and tools you pin with its star button. Nothing is saved until you use the panel | Until you clear site data | Essential (saved only when you use the finder) |
tdx_etf_workspaces_v1, tdx_annual_review_checks, tdx-last-decision-centre-card, tdxp-skip-prefill (sessionStorage) | UK Tax Drag | Saved ETF workspaces, checklist ticks, the last decision card you opened, and a note not to prefill a form again in this tab | Until you clear site data; sessionStorage until you close the tab | Functional; never leaves your device |
tdx-monthly-money-checklist, tdx-household-bills, tdx-credit-score-checks, tdx-bank-switch-tracker, tdx-iht-gifts-v1, tdx-cgt-f5-v1 | UK Tax Drag | What you enter in the monthly money checklist, the household bills audit, the credit score checks, the bank switching tracker and the gift tracker, and the events in the options capital gains tax calculator if you tick Remember on this device | Until you delete them or clear site data | Functional; never leaves your device |
tdx-sync-token | UK Tax Drag | Would keep a device signed in to scenario sync. It is written only when a page is opened from a sync sign-in link | Not set in normal use: scenario sync is switched off, so the site sends no sign-in links | Essential |
tdx_analytics_buffer, tdx_session_id | UK Tax Drag | A local copy of recent analytics events and a random id used to group them | Until you clear site data; deleted if you withdraw analytics consent | Consent (analytics) |
_ga, _ga_<container-id> (cookies) | Google Analytics | Distinguish visitors and keep session state | 2 years | Consent (analytics) |
__gads, __gpi (cookies) | Google (AdSense) | Showing ads, and security | 13 months | Consent (advertising) |
__eoi (cookie) | Google (AdSense) | Security | 6 months | Set by Google according to your choice |
IDE (cookie on doubleclick.net) | Showing ads, including personalised ads where you have consented, and security | 13 months in the UK and EEA; 24 months elsewhere | Consent (advertising) | |
FCCDCF (cookie) | Google’s consent message | Stores your consent choices (Google lists its purpose as functionality) | 13 months | Needed to record your choice |
FCNEC (cookie) | Google’s consent message | Google lists its purpose as analytics for the consent message | 365 days | Set by Google according to your choice |
google_auto_fc_cmp_setting (localStorage) | Google (the AdSense script) | Written by Google’s ad script when a page with ads loads, before any choice is made. Google does not publish what it is for | No expiry date: until you clear site data | Written before you choose; your choice does not remove it |
If you consent, other advertising partners named in Google’s consent message may also set cookies. You can delete cookies and site data at any time in your browser settings.
Contact form
When you send a message, we store your message, your reply email address, the enquiry type you chose, the page you sent it from, your name and a URL if you give them, and the time it arrived. It is stored with our hosting provider, Netlify, as our processor, and read only by the Editor. Your IP address is used briefly, in memory, to limit repeated submissions and is not stored with your message. We do not pass your message to anyone else. There is no newsletter, and we do not add you to any mailing list.
We delete a message once it has been dealt with and is no longer needed, and we keep none for longer than 24 months. You can ask us to delete yours sooner.
How long data is kept
- Contact form messages — deleted once dealt with, and never kept for longer than 24 months.
- Google Analytics — for the retention period set in our property (no longer than 14 months for a standard property); standard aggregated reports are not affected by that setting.
- Google advertising data — Google decides how long it keeps the data it collects as an independent controller; cookie durations are in the table above.
- Server logs — for as long as Netlify’s standard logging keeps them.
- On-device storage — as shown in the table above; you can clear it at any time.
Your rights
Under UK data protection law you have the right to be informed about how your data is used, and rights of access, rectification, erasure, restriction, data portability and objection, including the right to object to processing based on legitimate interests. Where we rely on consent, you have the right to withdraw consent at any time. To use any of these rights, send a message through the contact form and choose Data or privacy request. We may ask for information to confirm who you are. We respond within one month, or tell you within that month if a complex request needs up to two more months.
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on its helpline, 0303 123 1113.
Children
UK Tax Drag is written for adults. It is not directed at children, and we do not knowingly collect personal data from children. If you think a child has sent us personal data through the contact form, tell us and we will delete it.
Changes to this notice
We update this notice when the way the site uses personal data changes. The date in the byline at the top of the page shows when it was last reviewed.
Related standards
See the advertising policy, the how we make money page, the editorial policy and the methodology page for how advertising, funding, content quality and source handling work across the site.