Privacy notice

shan.tax consulting is a trading name of Excessone Limited, registered in England and Wales, company number 08822351. Registered office: 124 City Road, London EC1V 2NX.

Excessone Limited is the “controller” of the personal information described in this notice. That is the legal term for the organisation that decides why and how personal information is used, and the one answerable to you and to the regulator for it. The business is run by its director, Shan Sun.

What this notice covers

This notice covers this website: visiting it, subscribing to the newsletter, booking an introductory call, emailing us, and pitching a guest appearance to the podcast.

Two things are not covered here, deliberately:

Calls with us. If you book a call, our privacy notice for calls covers how the call is handled, including recording and note-taking; it is also linked from the booking invitation.
Working with us. If we start working together, we will give you a privacy notice for clients at that point, covering the information we handle during an engagement.

Contact details

Post: Excessone Limited, 124 City Road, London EC1V 2NX
Email: contact@shan.tax

What information we collect, and why

Listening to the podcast. Episode audio is hosted by Spotify for Creators, formerly Anchor. Nothing is requested from Spotify until you press play; if you do, your IP address and browser details go to Spotify in order to stream the episode.

Visiting the site. The site is hosted on GitHub Pages, a service of GitHub, Inc. Like any web host, GitHub records the IP address of each request in its server logs for security purposes; we do not receive or keep those logs. Our visitor statistics come from Cloudflare Web Analytics, a privacy-focused service: it counts page views, referrers and countries in aggregate, sets no cookies, stores nothing on your device, and does not track individual visitors across pages or sites.

The newsletter. If you subscribe, we collect your email address, a record of your subscription, and whether you later unsubscribe. The signup form and mailing list are run for us by MailerLite. Every email includes an unsubscribe link.

Booking an introductory call. The “book a call” buttons take you to a Google Calendar appointment page. The name, email address and anything else you enter there go into our calendar, which runs on our Google Workspace account.

Emailing us. If you email contact@shan.tax, we hold your message and our reply in our email account, which also runs on Google Workspace.

Podcast guest pitches. The pitch form on the podcast page collects your name, role and organisation, email address, your proposed topic, and an optional link. The form is relayed to us by Formspree. Your details are used only to assess and reply to the pitch. Please do not include confidential client or taxpayer information in the form.

We do not collect any special category information (the more sensitive kinds, such as health or ethnicity data) through this site, and the site is written for a professional audience, not for children.

Our lawful bases

UK data protection law requires a “lawful basis” for each use of personal information: a justification from a fixed legal list. Ours are:

Consent, for the newsletter. You can withdraw it at any time by using the unsubscribe link or by emailing us, and we will stop immediately.
Contract, where your enquiry or booking is a step towards engaging us: the law allows us to use your information to take the steps you have asked for before a contract is signed.
Legitimate interests, for everything else: keeping the site secure, understanding in aggregate how it is used so we can improve it, answering enquiries and podcast pitches, and handling complaints. “Legitimate interests” means we may use information where there is a real benefit, we use no more than we need, and the use would not surprise you or cause you unwarranted harm. You have the right to object to any use made on this basis.

Where we get information from

Directly from you, and, when you visit the site, from the technical information your browser sends automatically (handled by our host and our analytics service as described above).

How long we keep information

Enquiry emails and booking details: 12 months from our last contact, unless we start working together, in which case the client privacy notice applies from that point.
Newsletter: for as long as you are subscribed. When you unsubscribe we keep only a minimal record of the unsubscribe itself, so we do not email you again by mistake.
Podcast pitches: 6 months after we reply.
Records of data protection requests and complaints: 6 years, because that is the period within which a related legal claim could still be brought.
Visitor statistics: kept indefinitely, but only as aggregate numbers that identify nobody.

We use a small number of service providers, each acting as our “processor”: a company that handles personal information only on our instructions, under a contract that data protection law requires. They are: GitHub, Inc. (website hosting), Cloudflare, Inc. (visitor statistics), UAB MailerLite (newsletter), Google (email, calendar and bookings, under Google Workspace), Formspree, Inc. (the podcast pitch form) and Spotify AB (podcast audio hosting).

We do not sell personal information, we run no advertising, and we share information with no one else unless the law requires it.

Some of these providers process information outside the UK. GitHub, Cloudflare, Google and Formspree are US companies. MailerLite and Spotify are based in the EU, which UK law treats as providing adequate protection, and both use some sub-processors in the United States (Spotify streams episode audio through a US content delivery network). Where information leaves the UK, it is covered either by the UK Government’s adequacy decisions (including the UK-US “data bridge”) or by contract terms approved for international transfers (the ICO’s addendum to the EU standard contractual clauses), as set out in each provider’s data processing terms.

Cookies

This site is built to work without cookies. It sets no analytics or advertising cookies. If you switch between light and dark mode, your browser stores that preference on your own device; it is never sent to us.

Your rights

You have the right to ask us for a copy of your personal information (access); to correct it (rectification); to delete it (erasure); to limit how we use it (restriction); to object to our use of it (objection); to receive the information you gave us in a reusable form (portability); and, where we rely on consent, to withdraw it at any time. Some rights apply only in some situations, but asking costs nothing: contact us using the details above and we will respond within one month.

How to complain

If you are unhappy with how we have used your personal information, please tell us, by email or post using the contact details above. We will acknowledge your complaint within 30 days and tell you what we have done or will do about it.

You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office, whether or not you complain to us first:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline: 0303 123 1113. Online: https://www.ico.org.uk/make-a-complaint.

Changes to this notice

When this notice changes, the new version appears on this page with a new date. If a change materially affects newsletter subscribers, we will also mention it by email.

Last updated: 1 September 2026.