Purpose

To explain how personal data is collected, used, stored, and protected.

​

Data collected

• Client contact details

• Company and project information

• Identification data where required for AML purposes

• Communications and working papers

• Personal data collected through the company website may include name, email address, company details, and enquiry content submitted through contact forms. This privacy notice applies to visitors to our website and individuals who contact us via our website or other channels. When you contact us through our website, we use this information solely to respond to your enquiry and manage potential business relationships

• Where meetings are recorded (for example, virtual meetings conducted via Microsoft Teams), participants will be informed in advance. Recordings may be used for note-taking, record-keeping, service delivery, quality assurance, or compliance purposes and will be retained only for as long as reasonably necessary.

​

Data retention

We retain personal data only for as long as necessary:

• Prospect/contact data: typically 12–24 months, after which it is periodically reviewed and deleted where no longer required

• Client data: normally seven years from the relevant accounting period, engagement, or matter to which the records relate, or longer where required by law, regulation, insurance requirements, HMRC enquiry, dispute, complaint, claim, or another legitimate business need.

 

Business development and marketing

We may collect and use your personal data where you are a professional contact or representative of an organisation that may benefit from our services.

​

This may include personal data obtained from:

• Publicly available sources (e.g. company websites)

• Professional networking platforms (e.g. LinkedIn)

• Direct interactions such as events, meetings, or introductions

​

We use this data to contact individuals in a targeted and proportionate manner regarding services that may be relevant to their organisation.

​

This processing is carried out under the lawful basis of legitimate interests. We ensure that such processing is limited in scope, appropriate to the context, and respects your rights.

​

You have the right to object to such processing at any time.

 

Lawful bases

​We rely on the following lawful bases depending on the activity:

• Performance of a contract – where we provide services to clients

• Legal obligation – for compliance with HMRC and anti-money laundering requirements

• Legitimate interests – for business development, managing professional relationships, and operating our website

​​

Provision of personal data

Where we process personal data in order to provide services, the provision of certain information is necessary to enter into and perform a contract, and to comply with applicable legal and regulatory obligations (including anti‑money laundering requirements). Failure to provide required information may prevent us from accepting or continuing an engagement.

 

Where personal data is provided for enquiries or business development purposes, this is voluntary. However, failure to provide sufficient information may limit our ability to respond effectively.
 

Data sharing and processors

We may share personal data with:

• HMRC and other authorities where legally required

• Professional advisers (such as our accountant or insurer)

• Technology providers used to operate the business and website, including Microsoft 365 (including Outlook, OneDrive and SharePoint) and Wix.com Ltd as website host and form processor

• Physical correspondence may be received via a UK-based registered office and mail handling provider. Mail received at the registered address is securely stored for collection and is not routinely opened or processed unless specific services are requested

• We may use approved AI-assisted functionality within Microsoft 365, including Microsoft Copilot where available within our authenticated business Microsoft 365 environment, to assist with drafting, summarising, structuring documents, note-taking, administrative support, and internal review. We do not use public or consumer AI tools with client confidential information or personal data. AI-generated output is treated as draft support only and is reviewed by us before being used in client work or communications

​

Cookies and analytics

• Our website uses cookies that are necessary for functionality and may use analytics cookies to understand how the site is used and improve performance

• Non-essential cookies (such as analytics) are only used where you have given consent via our cookies banner

• You can withdraw or change your cookies preferences at any time using the cookies settings controls available on the website

 

Data storage

• Personal data is stored electronically within Microsoft 365 (including Outlook, OneDrive and SharePoint) and may also be processed temporarily through website infrastructure and email systems in the course of enquiry handling

• Local devices used to access business data are encrypted

 

International transfers

• Some of our technology providers may process or store personal data outside the UK

• Where this occurs, we rely on appropriate safeguards in line with applicable data protection legislation, such as adequacy regulations or contractual protections

 

Rights

Individuals have the right to:

• Request access to their personal data

• Request correction of inaccurate personal data

• Request deletion of personal data, subject to legal and regulatory retention requirements

• Data portability

• Not be subject to automated decision-making (where applicable)

• Object to processing

• Restrict processing

• Lodge a complaint with the Information Commissioner’s Office (ICO) (www.ico.org.uk)

​

If you have concerns about how we handle your personal data, please contact us in the first instance using the contact details above. We will investigate and respond to data protection complaints in accordance with applicable data protection legislation.