Privacy Notice

1. Data Controller Identity & Contact Details

For the purposes of the UK GDPR and the Data Protection Act 2018, the Data Controller responsible for your personal information is:

2. Information We Collect

Depending on whether you visit our website, complete an online enquiry, download a tax checklist, or formally engage our accountancy services, we may collect and process the following categories of data:

• Contact & Identity Data: Full name, email address, telephone number, business/trading name, company registration number, residential address, and postcode.
• Tax & Financial Information: Unique Taxpayer Reference (UTR), National Insurance Number (NINO), VAT registration number, PAYE reference, HMRC Government Gateway user IDs (where authorized), bank statements, dividend vouchers, payroll summaries, invoices, bookkeeping ledgers, and property rental records.
• Statutory Due Diligence (AML Data): Photographic proof of identity (passport or UK photocard driving licence) and proof of address (utility bill or bank statement dated within 3 months) to satisfy UK Anti-Money Laundering legislation.
• Enquiry & Communication Records: Information submitted via website contact forms, WhatsApp communications, email correspondence, and telephone consultation notes.
• Technical & Usage Data: Internet Protocol (IP) address, browser user-agent, operating system, and timestamp data captured automatically by our web hosting infrastructure when accessing our website.

3. Lawful Bases for Processing

Under Article 6 of the UK GDPR, we process your personal data only when there is a recognized lawful basis:

4. Data Processors & Third-Party Recipients

We do not sell, rent, or trade your personal data. We disclose personal data only to trusted recipients who act under contract or statutory authority:

• Netlify, Inc.: Provides our website edge hosting, serverless form processing infrastructure, and Akismet spam detection. When you submit a form on our website, your input data is routed securely via Netlify's European and global infrastructure.
• HM Revenue & Customs (HMRC): Statutory transmission of Self-Assessment returns, Corporation Tax (CT600), VAT Returns, CIS filings, and voluntary Let Property Campaign disclosure schedules.
• Companies House: Statutory submission of limited company accounts, micro-entity balance sheets, and confirmation statements.
• Google Workspace (Google LLC): Enterprise email communication, digital appointment management, and secure cloud storage utilizing TLS encryption in transit and AES-256 encryption at rest.

5. Anti-Money Laundering (AML) & Statutory Reporting Duties

As a professional UK accountancy practice led by an ACCA-qualified accountant, we are subject to stringent legal duties under the Proceeds of Crime Act 2002 (POCA), the Terrorism Act 2000, and the Money Laundering Regulations 2017.

6. International Data Transfers

Some of our third-party technology providers (including Netlify, Inc. and Google LLC) are headquartered in or maintain servers in the United States or other countries outside the United Kingdom and the European Economic Area (EEA).

Whenever personal data is transferred internationally, we ensure that an adequate level of data protection is established by implementing one of the following recognized safeguards:

• Transfers to countries approved by the UK Government as providing an adequate level of data protection.
• Standard contractual clauses incorporating the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs).
• Transfers to certified US entities participating in the UK-US Data Bridge (the UK extension to the EU-US Data Privacy Framework).
• Robust technical encryption in transit (HTTPS / TLS 1.3) and at rest (AES-256).

7. Data Retention Periods

We do not retain your personal data longer than necessary for the purposes for which it was collected and to satisfy statutory, regulatory, and legal obligations:

• Statutory Tax & Accounting Records: Retained for a minimum of 6 years following the end of the relevant tax year or accounting period, in compliance with Section 12B of the Taxes Management Act 1970, VAT regulations, and the Companies Act 2006.
• Anti-Money Laundering (AML) Due Diligence Data: Retained for exactly 5 years after the business relationship ends, pursuant to Regulation 40 of the Money Laundering Regulations 2017. Upon expiry of 5 years, AML identity data is securely deleted unless statutory retention is mandated by law or court order.
• Website Enquiries & Non-Client Leads: Enquiries that do not proceed to a formal engagement are retained for up to 12 months to address follow-up queries, after which they are permanently purged.
• Web Server Technical Logs: Technical logs are retained by our hosting provider according to its applicable retention settings and policies and are not kept by us longer than necessary for security and troubleshooting.

8. Your Data Protection Rights Under UK GDPR

Under Chapter III of the UK GDPR, you have the following enforceable legal rights regarding your personal information:

• Right of Access (Article 15): You have the right to request a copy of the personal data we hold about you (commonly known as a "Subject Access Request" or SAR).
• Right to Rectification (Article 16): You have the right to ask us to correct inaccurate data or complete incomplete information.
• Right to Erasure (Article 17): You may request the deletion of your personal data where there is no compelling legal reason for its continued processing. Please note: Statutory record-keeping obligations under UK tax law and AML regulations override the right to erasure for active accounting files during the mandatory 6-year retention period.
• Right to Restriction of Processing (Article 18): You have the right to request that we temporarily restrict the processing of your personal information under certain circumstances.
• Right to Data Portability (Article 20): You may request that we transfer your digital accounting records directly to you or another professional accountant in a structured, commonly used, and machine-readable format.
• Right to Object (Article 21): You have the right to object to the processing of your personal data where we rely on legitimate interests.
• Rights in Relation to Automated Decision-Making (Article 22): We do not make automated decisions or carry out profiling that produces legal effects concerning you.

To exercise any of these rights, please email us at hello@accountsmadeeasy.co.uk. We respond to all verified requests within one calendar month without fee, unless requests are manifestly unfounded or excessive.

9. Google Fonts & Website Technical Data

Google Fonts

To ensure consistent typography and design, our website uses external web fonts provided by Google LLC through the Google Fonts API (`fonts.googleapis.com` and `fonts.gstatic.com`). When you load a page on our site, your web browser downloads the required web fonts directly from Google servers.

In this process, Google receives your IP address and technical browser information. According to Google, Google Fonts queries are separated from other Google services and no user credentials or cookies are tracked. For more information, consult Google's Privacy Policy.

Cookies & Local Storage

Our website does not deploy third-party advertising cookies, behavioural trackers, or tracking pixels. Only strictly necessary session tokens and temporary browser caching are utilized to render web pages and secure form submissions.

10. Your Right to Lodge a Complaint with the ICO

We take data privacy and regulatory compliance very seriously. If you have any concerns or are dissatisfied with how we handle your personal data, we encourage you to contact us first at hello@accountsmadeeasy.co.uk so that we can resolve the matter promptly.

Under Article 77 of the UK GDPR, you have the statutory right to lodge a formal complaint at any time with the UK independent supervisory authority for data protection: