TCS Ltd — Privacy Policy

For tcs.gg and TCS Central (central.tcs.gg)

Last updated 7 November 2026

At a glance

  • TCS Ltd is responsible for the personal data described in this policy. Contact Tim Chilestone, tim@tcs.gg.

  • This policy covers our website, tcs.gg, and TCS Central, our practice management application at central.tcs.gg.

  • TCS Central is used only by staff of TCS Ltd and other Springtide Group companies. It connects to Microsoft 365, Google, Sage, Xero and QuickBooks Online only with permission, and only to deliver our services.

  • We never sell personal data, never use it for advertising, and never use data from connected services to train general AI models.

  • If you are our client, our full Privacy Notice explains how we handle your data as a client. It forms part of our engagement with you.

1. Who we are

TCS Ltd ("we", "us", "our") is a bookkeeping and accountancy practice registered in Guernsey with number 66025, whose registered office is Victoria House, 29–31 High Street, St Peter Port, Guernsey GY1 2JX. We are registered with the Office of the Data Protection Authority (ODPA), number DPA2115. We are a member of the Springtide Group; our parent company is Springtide Group Limited.

Our data protection lead is Tim Chilestone:

  • Email: tim@tcs.gg

  • Post: TCS Ltd, FREEPOST GU237, St Peter Port, Guernsey GY1 5SS

  • Telephone: 01481 714145

We comply with the Data Protection (Bailiwick of Guernsey) Law, 2017 and, where it applies, the UK General Data Protection Regulation and the Data Protection Act 2018, as amended.

2. Our website, tcs.gg

What we collect

Where it comes fromWhat we collectEnquiry and quote formsYour name, email address, telephone number, business name and anything you tell us in your messageOnline sign-up and client portalYour log-in details and the information you enter when you start onboardingYour visit, through cookiesIP address, browser and device type, pages visited, time on the site and the referring siteOur cookie bannerThe choice you make about cookies

How we use it and why we are allowed to

What we use it forLawful basisReplying to enquiries and preparing quotesSteps you ask us to take before a contract; legitimate interestsOnboarding and client portal accessSteps before a contract; contractKeeping the website and portal secureLegitimate interestsAnalytics, to understand how the website is usedConsentRemembering your cookie choiceLegitimate interests

Cookies

We set strictly necessary cookies so that the website and portal work. We only set analytics cookies if you agree through our cookie banner. You can change your choice at any time through the cookie settings link in the website footer.

Cookie typePurposeLastsNeeds your consentStrictly necessaryKeep the site secure, remember your cookie choice, keep you logged in to the portalSession to 12 monthsNoAnalytics (Google Analytics)Count visits and see how visitors use the siteUp to 2 yearsYes

3. TCS Central, central.tcs.gg

Who uses it

TCS Central is our internal practice management application. Only authorised staff of TCS Ltd and other Springtide Group companies can sign in. It is not available to the public, and clients do not log in to it.

What it holds

DataExamplesUser account dataStaff name, work email address, role, permissions, and the identifier from Microsoft or Google sign-inUsage and security dataSign-in times, IP address, device and browser, and records of actions taken in the applicationClient recordsClient and contact details, engagement details, jobs, deadlines, time records and working papersData from connected servicesThe data described in the table below

Connected services

Central connects to the services below through their official APIs. A connection is only made when an authorised user signs in or a person entitled to do so grants permission on the provider's own consent screen. Central can only access what that permission covers.

ServiceWhat Central can accessWhyMicrosoft 365 (Microsoft Entra ID sign-in and Microsoft Graph)The user's name, work email address and profile; and, where the user enables it, the files, emails and calendar items they authoriseTo sign staff in securely, and to link documents and correspondence to the right client recordGoogle (Google sign-in and Google APIs)The user's name, email address and profile picture; and, where the user enables it, the Google Drive, Gmail or Calendar data they authoriseTo sign staff in securely, and to link documents and correspondence to the right client recordSage, Xero and QuickBooks OnlineFor each connected company: company details, chart of accounts, customers and suppliers, invoices, bills, payments, bank transactions, journals and reportsTo deliver bookkeeping, accounts, payroll and reporting services to the client that owns the company file

We use data from connected services only to provide the features of Central to our staff and to deliver services to our clients. We do not use it for any other purpose.

Google user data

TCS Central's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • we use Google user data only to provide and improve the features of Central that the user can see and use;

  • we do not transfer it to others, except as needed to provide those features, to comply with the law, or as part of a merger or sale of our business with notice to users;

  • we do not use it for advertising, and we do not sell it;

  • we do not use it to develop, improve or train generalised artificial intelligence or machine learning models;

  • our people do not read it unless the user has agreed, it is needed for security or to investigate abuse, it is needed to comply with the law, or it has been aggregated and anonymised for internal operations.

Who decides how the data is used

For TCS's own clients, TCS Ltd is the controller of the data in Central. Where staff of another Springtide Group company use Central for that company's clients, that company is the controller and TCS Ltd acts on its instructions as its processor.

Disconnecting a service

A connected service can be disconnected at any time, from that provider's own settings (for example the connected apps page in Xero, QuickBooks Online, Sage, Microsoft or Google) or by asking us. When a connection ends, Central stops accessing that service and we delete the access tokens for it.

4. Who we share personal data with

We share personal data only where we need to, and require everyone who handles it for us to keep it confidential and secure.

  • Hosting and infrastructure. Lovable (application hosting) and Supabase (database, authentication and file storage) for TCS Central; our website host.

  • Connected service providers. Microsoft, Google, Sage, Xero and Intuit receive the requests Central makes to their services, under their own terms and privacy policies.

  • Springtide Group. Springtide Group Limited, our parent company, which administers our systems on our behalf as our processor; and other Group companies only where their staff work on their own clients in Central, or where we subcontract work to them and have told the client.

  • AI tools. We use AI tools, including Claude (Anthropic) on a business plan, to help prepare and check our work. These run under business terms that do not allow the provider to train its models on our data. We do not send data received from Google APIs to AI tools except to provide a feature the user has asked for.

  • Analytics. Google, which provides analytics for our website.

  • Advisers and authorities. Our professional advisers and insurers, and regulators, tax authorities, the police or courts where the law requires.

We never sell personal data.

5. Transfers outside the Bailiwick of Guernsey

TCS Central's data is hosted by Supabase in London, in the United Kingdom, which Guernsey recognises as giving adequate protection. Some of our other providers store or access data in the United Kingdom, the European Economic Area and the United States. We only transfer personal data outside the Bailiwick where the destination is recognised as giving adequate protection, where the provider has agreed approved safeguards such as standard data protection clauses, or where another condition allowed by law applies. You can ask us which safeguard applies to a particular provider.

6. How long we keep it

DataHow long we keep itWebsite enquiries that do not lead to an engagement1 year from our last contactAnalytics dataNo longer than 14 monthsCentral user accountsUntil the user's access ends, then deleted within 3 monthsCentral usage and security records2 yearsAccess tokens for connected servicesUntil the connection ends, then deletedData received from Google APIsDeleted within 30 days of the connection ending or of a deletion request, unless the law requires us to keep itClient records, including data from Sage, Xero and QuickBooks OnlineAs set out in our full Privacy Notice, usually 7 years after our relationship ends

7. Keeping data secure

We protect personal data with access controls and role-based permissions, multi-factor authentication, encryption in transit and at rest, and confidentiality obligations on everyone who works for us. Access tokens for connected services are stored securely and never shown to users. We do not store passwords for Microsoft, Google, Sage, Xero or QuickBooks Online accounts.

If we have a data breach affecting you, we will tell you and the ODPA (or the ICO, where UK law applies) where the law requires.

8. Your rights

You have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to our use of it, to receive data you gave us in a portable format, and to withdraw consent at any time where we rely on it.

To use any of these rights, or to ask us to delete data received from a connected service, contact Tim Chilestone using the details in section 1. We will respond within one month, or within three months for complex requests, telling you within the first month if we need longer. We do not normally charge a fee.

9. Complaints

Please contact us first using the details in section 1. We will acknowledge your complaint within 5 working days and give you a full response as quickly as we can. You may then complain to the regulator:

Where you areRegulatorBailiwick of Guernsey, or anywhere our processing is subject to Guernsey lawOffice of the Data Protection Authority, Block A, Lefebvre Court, Lefebvre Street, St Peter Port, Guernsey GY1 2JP · enquiries@odpa.gg · www.odpa.ggUnited KingdomInformation Commission's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · ico.org.uk

10. Changes to this policy

We may update this policy from time to time. The version on tcs.gg is the current one. If we change how TCS Central uses data from connected services, we will update this policy before the change takes effect.

Microsoft, Microsoft 365 and Microsoft Entra are trademarks of Microsoft Corporation. Google and Gmail are trademarks of Google LLC. Sage is a trademark of The Sage Group plc. Xero is a trademark of Xero Limited. QuickBooks is a trademark of Intuit Inc. TCS Central is not made, endorsed or sponsored by any of them.