Privacy notice
GainPal collects as little about you as possible, keeps it for as short a time as possible, and never sells it or shares it for marketing.
Last updated: 22 October 2026
Who we are
GainPal is a trading name of Sunny [Surname], a sole trader based in the UK. Sunny is the data controller for the personal data described here.
Contact: [email protected]. Address for documents: [business address]. ICO registration number: [pending].
What we collect and why
| When | What we collect | Why, and our lawful basis |
|---|---|---|
| You fill in one of our forms (free check, Report Review request or contact) | Your email, first name if given, and answers about your crypto activity (tax years, number and names of exchanges and wallets, types of activity). We ask you not to include wallet addresses or files. | To reply with a quote and answer your questions. Taking steps at your request before a contract. |
| You ask for our partner terms (accountants) | Your name, firm name and email. | To email you our partner terms and pricing: taking steps at your request. If you tick the box, occasional updates about the partner programme: consent, which you can withdraw at any time using the unsubscribe link. |
| You book a call | Name, email and the time you choose. | To hold the call. Taking steps at your request before a contract. |
| You become a client | Exchange export files and public wallet addresses you send us, plus your contact and billing details. | To reconcile your records and prepare your report. Performance of our contract with you. |
| We must keep records by law | Invoices, engagement records and, where required, identity checks. | To meet tax and anti-money-laundering record-keeping duties. Legal obligation. |
| You visit this website | Anonymous visit counts only. No cookies, no tracking, no advertising. | To understand how many people use the site. Legitimate interests. |
We never ask for passwords, API keys or seed phrases. If you choose a Private Session, we work on your own computer over an end-to-end encrypted screen-share that is never recorded, and receive no transaction files at all.
Clients referred through an accountant
If you are a client of one of our partner accountancy firms, the firm is the data controller and we process your data only on its instructions, usually under a reference code rather than your name. The firm's own privacy notice applies.
Who we share it with
- Tally (form provider, Belgium), which stores form answers.
- Calendly (booking provider, USA), only if you book a call.
- [Partner-terms form / mailing-list provider: to confirm], only if you ask for our partner terms.
- Our email provider, to send and receive messages.
- Cloudflare, which hosts this website and provides cookieless visit counts.
- A partner accountant, only if you ask us to introduce you.
- Authorities, only where the law requires it.
We do not use cloud storage or any other third party to process your crypto records. Where a provider stores data outside the UK, it does so under legally recognised safeguards.
How long we keep it
- Enquiries that don't go ahead: deleted within 12 months.
- Partner-terms requests: deleted within 12 months unless we start working together or you opted in to updates; if you opted in, until you unsubscribe.
- Your crypto files and working data: deleted when your report is delivered and accepted.
- Your final report, invoices and engagement records: kept for 6 years, as tax rules require, then deleted.
- Identity checks, where required: kept for 5 years after our work ends, as anti-money-laundering rules require.
How we protect it
Files arrive by encrypted transfer, are handled on an encrypted computer protected by two-factor sign-in, are labelled by reference code rather than name where possible, and are never kept in cloud storage. The encrypted transfer service holds files only until we download them.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Email [email protected] and we will reply within one month. We make no decisions about you by automated means.
If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes
We will update this notice if how we use data changes, and show the date of the latest version at the top.