Legal
Contact and identity details you give us (name, email, phone); company details for the services (company number, UTR, VAT number, payroll headcount); financial records you share with us so we can perform bookkeeping, VAT, payroll and filing work; identity verification records we are required to hold as an AML-supervised firm; and payment records held by Stripe (we never see your full card number).
To deliver the services (performance of contract); to meet legal obligations including AML verification and HMRC/Companies House filings (legal obligation); and to respond to enquiries and improve the service (legitimate interests).
We share data only with processors who help us run the service, under written contracts: our website host, our card payment provider (Stripe), our accounting software provider (Xero), and subcontracted providers who assist with bookkeeping, the preparation of accounts and returns, and the submission of filings. Providers who submit filings or deal with HMRC or Companies House on your behalf are based in the UK; providers who assist only with bookkeeping or preparation may be located outside the UK, in which case the transfer safeguards in section 4 apply. We also disclose data to HMRC and Companies House where that is the service you have asked us to perform, and to law enforcement or supervisory bodies where the law requires it. We never sell your data.
Data is stored on servers within the UK or European Economic Area wherever possible. Where a processor transfers data outside the UK, we rely on adequacy regulations or the UK International Data Transfer Addendum. Client records are kept for at least six years after the end of the engagement to meet HMRC and AML retention requirements, then securely deleted.
Data is encrypted in transit and at rest, access is limited to those who need it, and our subcontractors are bound by written confidentiality and data-processing agreements.
You can ask for a copy of your data, ask us to correct or delete it (subject to our legal retention duties), object to or restrict processing, and complain to the Information Commissioner's Office (ico.org.uk). We are registered with the ICO as a data controller.
For anything in this policy, email us and we'll respond within one month.