Client privacy notice

Who we are

Accounting Agents Ltd is a limited company registered in England, company number 13139873. Our registered office is 90 New Road Side, Horsforth, Leeds, England, LS18 4QB.

We are the controller of the personal data described in this notice, except for payroll data about your employees, where we act on your behalf (see Payroll and your employees below).

We are registered with the Information Commission (ICO), registration number ZB373617.

You can contact our Data Protection Lead about anything in this notice by email at info@accountingagents.co.uk, by phone on 0113 833 4233, or by post at our registered office.

What information we collect

Depending on the services we provide, we may hold:

• Contact and identity details: name, title, address, email, phone number, date of birth, nationality, and copies of identity documents.
• Identity check results: the identity documents and proof of address you show us or send through our secure client portal, what we recorded about them, and the results of our sanctions, politically exposed person (PEP) and adverse media searches. Once our online ID check is live, this will also include the photo ID and selfie you provide through it, and its result.
• Tax and business details: National Insurance number, Unique Taxpayer Reference, company number, VAT and PAYE references, company authentication code, HMRC and Companies House codes, details of your business, its owners and officers, and information from Companies House.
• Financial information: income, expenses, bank statements, invoices, receipts, assets, loans, pensions and other records you give us to prepare accounts and returns.
• Payroll information: your employees' names, addresses, dates of birth, National Insurance numbers, pay, tax codes, pension details, and in some cases statutory sick pay or parental leave details.
• Payment details: your Direct Debit mandate details and payment history. Your bank details are held by our Direct Debit provider.
• Correspondence and records of our work: emails, messages in the client portal, notes of calls and meetings, files you upload, and records of the work we do for you.
• Quote and proposal information: the answers you give in our website quote tool, the quote, the proposal, and the record of your online acceptance (your name, position, the time, your IP address, and a fingerprint of the document you accepted).
• Portal and security information: your portal sign-in details, the times you sign in, and your browser and IP address, which we keep for security. If you use our app, this also includes the notification address of each phone where you turn notifications on, and the public half of the security key each phone makes if you turn on Face ID or fingerprint sign-in (see Our app below).
• Marketing preferences: whether you want to hear from us about news and offers.

We do not ask for information about your health, religion, ethnicity or similar sensitive matters. If you tell us about them (for example to explain why a return was late), we only record what we need to help you. Once our online ID check is live, the selfie it uses will involve biometric data. The section on identity checks below explains how we will handle it.

Where we get it from

Most of it comes from you, through our website quote tool, the client portal, email and phone calls. We also get information from:

• Companies House (company details, officers and people with significant control);
• HMRC, once you have authorised us as your agent;
• your previous accountant, when we take over from them;
• sanctions lists and lists of politically exposed persons that we search, directly or through our screening service;
• once our online ID check is live, our ID verification provider;
• your bank, payroll or software providers where you connect them to us or ask them to send us records;
• other people you ask to deal with us on your behalf.

Why we use it and our lawful basis

• Giving you a quote and sending a proposal, because you asked us to. Lawful basis: steps at your request before entering a contract.
• Following up a quote you asked for, to answer your questions and see if you want to go ahead. Lawful basis: our legitimate interests in responding to enquiries.
• Providing the services in our engagement letter, including filing with HMRC and Companies House. Lawful basis: contract, and our legal obligations.
• Checking your identity, screening against sanctions and PEP lists, assessing money laundering risk and keeping these records, because the law requires it. Lawful basis: legal obligation under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
• Reporting suspicions of money laundering to the National Crime Agency, because the law requires it. Lawful basis: legal obligation under the Proceeds of Crime Act 2002 and the Terrorism Act 2000.
• Collecting fees by Direct Debit and keeping accounting records. Lawful basis: contract and legal obligation.
• Keeping records of our work, chasing information, sending reminders, reviewing fees each year and handling complaints, to run the firm properly. Lawful basis: legitimate interests, and our professional obligations.
• Keeping our systems secure, including sign-in records and audit logs. Lawful basis: legitimate interests.
• Letting our continuity firm look after your affairs if we become unable to act, so your deadlines are met. Lawful basis: our legitimate interests, and yours, in your affairs being looked after.
• Sending you news and marketing emails. Lawful basis: your consent, or for existing clients the "soft opt-in" under the Privacy and Electronic Communications Regulations; for limited companies, our legitimate interests. You can opt out at any time.

If you do not give us information we need by law (for example for the ID check) or under our contract, we may not be able to act for you.

Identity checks and anti-money laundering

Before we start work, the law requires us to verify who you are and who owns and controls your business.

• How we check your identity now: we check your identity from documents. A member of our team sees your photo ID and, where needed, proof of address. You can show them to us, or send copies through our secure client portal or a secure link we send you. Please don't send them by ordinary email.
• Our online ID check (once it is live): we plan to offer a certified online ID check run by our ID verification provider, reached by a secure link. You will take a photo of your photo ID and a selfie. The provider will check the document is genuine and compare your face with the photo on it. This comparison uses biometric data, which the law treats as a special category of personal data. We will rely on the condition the law allows for this, which we will set out here before the check goes live. You can always ask us for another way to check your identity that does not use a selfie.
• Your name and date of birth are checked against sanctions lists and lists of politically exposed persons, and may be checked for adverse media. This can involve information about alleged or proven offences. We use it only for our anti-money laundering duties.
• We use a specialist screening service, based in the European Union, to check whether you are a politically exposed person or subject to sanctions. It receives only your name, date of birth and nationality (for a business, its name and country), and acts only on our instructions. A person at our firm decides every possible match.
• A person at our firm assesses the money laundering risk, and our practice system works out a risk rating from that assessment. A person approves every new client. Medium and high risk clients are always approved by our Money Laundering Reporting Officer or their deputy. We never refuse to act for you based on an automated result alone: if a check is unclear, a person looks at it and contacts you.
• Each year we ask you to confirm your details are still correct, and we check the sanctions and PEP lists again. We review our wider checks every one to three years, depending on the risk, and sooner if your circumstances change. We ask for a new ID check only when something changes, for example a new owner or director.

We keep anti-money laundering records for five years after our relationship ends, as the law requires, and then delete them unless we must keep them longer for legal proceedings.

The law may prevent us from telling you if we have made a report to the National Crime Agency.

Payroll and your employees

When we run payroll for you, you are the controller of your employees' data and we act as your processor. We only use their data to run your payroll and file with HMRC and pension providers on your instructions, as set out in the data processing terms in our engagement letter. You are responsible for telling your employees how their data is used, and you may share this notice with them. If one of your employees asks us about their data, we will pass the request to you and help you respond.

The changes you send us for each pay period through the client portal or our app are held in our practice system, The Hive, so that we can run your payroll. Your employees' National Insurance numbers and bank details are held there encrypted.

Website quotes

If you ask for a quote on our website, your contact details, your answers and the quote are sent securely to our practice system so that we can follow up with you. If you do not become a client, they are deleted automatically 12 months after your request. If you do become a client, they form part of your client record.

The client portal

You sign in to our client portal with your email, a password and a one-time code we email to you. Through the portal you can see your jobs and deadlines, answer our requests, upload documents, read and send messages, see invoices, confirm your details each year and change your marketing preference. The portal uses essential cookies to keep you signed in securely. Files you upload are scanned for malware before they are stored. We email you when someone signs in to your portal account, so you can tell us straight away if it was not you.

Our app

Our app, Accounting Agents, is our client portal on your phone, from the App Store or Google Play. You sign in with the same email, password and one-time code, and you see the same information as in the portal. Everything this notice says about the client portal applies to the app too.

The app collects the same information you give us through the portal, such as messages, documents, approvals, payroll changes and your details. It also uses these features of your phone, each only if you choose to:

• Camera and photos: the app takes a photo only when you take one, for example of a receipt with the camera or the document scanner, or when you choose a photo or file to send us. A receipt waiting to be sent stays on your phone until it is sent, even without a signal. Once sent, it is kept with your other records.
• Notifications: if you turn them on, your phone gives the app a notification address, which we keep encrypted so we can tell you when we message you or need something. Apple (on iPhone) and Google (on Android) deliver the notifications for us, acting as our processors for that purpose only. Notifications never contain your name or the content of a message: they say something like "New message from Accounting Agents", and you open the app to read it.
• Face ID or fingerprint: if you turn on the app lock, your phone checks your face or fingerprint itself. Your face or fingerprint never leaves your phone, and we never receive it. Your phone makes a security key that stays locked inside it. We hold only the public half of that key, which lets us check that a sign-in came from your phone and cannot be used to sign in on its own.

The app does not track you. It has no advertising and no analytics or advertising tools, and it does not use your location or your contacts. The only outside services built into it are Apple's and Google's own notification services. We never use information from the app for advertising, and we never sell it. Like the portal, the app keeps you signed in with an essential cookie that stays inside the app, and we keep sign-in times and IP addresses for security.

You can switch things off at any time. Turn notifications or camera access off in your phone's settings. Turn the Face ID or fingerprint lock off in the app under Your details. Choose Sign out of this device, also under Your details, to remove from that phone its security key, its notifications, any receipts waiting to be sent, and the app's settings.

To close your portal and app account, open Your details in the app or the portal and choose Close your portal account, or contact us. Our page at www.accountingagents.co.uk/delete-account explains what we delete, what the law requires us to keep, and for how long.

Emails we send

Some of our emails are sent automatically by our practice system, for example reminders about deadlines and requests for records. They may contain a small image that tells us whether the email was opened. This helps us decide whether to call you instead of sending another reminder. No third party is involved.

Who we share it with

We share your information only where we need to:

• HMRC, Companies House and other government bodies, when we file for you or the law requires it.
• The National Crime Agency, if the law requires us to report.
• Your previous or next accountant, for professional clearance when you change accountant.
• Our professional body and anti-money laundering supervisor, the AAT (Association of Accounting Technicians), our insurers, and our legal and professional advisers, where needed.
• Our continuity firm, Melon Accountants Ltd, only if we become unable to act (for example because of the death or serious illness of a person responsible for your affairs). It may then see your records only as far as it needs to protect your affairs, meet urgent deadlines and contact you.
• Our suppliers, who process data for us under contract and only on our instructions: hosting for our practice system and client portal on a server in the United Kingdom; email, calendar and document storage; accounting, bookkeeping, payroll and tax filing software; once our online ID check is live, our ID verification provider; a specialist screening service, based in the European Union, for politically exposed person and sanctions checks; our Direct Debit provider; website hosting and email delivery for our quote tool; security services and encrypted backup storage; and, if we switch them on, AI tools built into our practice system that help us draft and summarise, under business terms that do not allow the provider to train its models on your data; and an AI service (Anthropic, or Google Gemini in its London region, depending on which we use for this feature), which may read the receipts and invoices you send us, under contract, to pick out the supplier, date, amounts and VAT. Our staff review the results, and your data is not used to train its models.

We keep a full list of our suppliers and can send it to you on request. We never sell your information, and we will not share it with anyone for their own marketing without your express consent.

International transfers

Our practice system and client portal are hosted on a server in the United Kingdom. Some of our suppliers store or access data outside the UK, for example in the European Economic Area or the United States. When that happens we make sure your data is protected by one of the safeguards UK law recognises: the country has been approved by the UK Government as providing adequate protection (for US companies, this includes those certified under the UK Extension to the EU-US Data Privacy Framework), or the supplier has signed contracts approved for use in the UK, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

• Client records, correspondence and working papers: for our relationship, then six years after it ends.
• Invoices and payment records: seven years.
• Identity checks and other anti-money laundering records: five years after our relationship ends.
• Website quotes that do not lead to an engagement: 12 months from your request.
• Portal sign-in attempts: seven days.
• Notification addresses and phone security keys from our app: until you turn the feature off, choose Sign out of this device, or your portal account is closed.
• Marketing campaign records: two years after sending.

We may keep information longer if there is a legal claim, a regulatory investigation, or a law that requires it. Our full record retention schedule is available on request. Deleted information can remain in our encrypted backups for up to about 90 days, until those backups are automatically deleted.

How we protect it

Our staff sign in to our systems with strong passwords and two-step verification. Access is limited by role, so people only see what they need. Sensitive details such as authentication codes, identity check records, and your employees' National Insurance numbers and bank details are encrypted. Every file is scanned for malware, and sensitive actions are recorded in an audit trail. We take daily backups, keep encrypted copies off the server, and test that we can restore them. Our staff are trained in data protection and security every year.

Please do not send us passwords or identity documents by ordinary email. Use the client portal instead.

Your rights

You have the right to:

• ask for a copy of the information we hold about you (a subject access request);
• ask us to correct information that is wrong or incomplete;
• ask us to delete information, where we no longer have a reason or a legal duty to keep it;
• ask us to restrict how we use it, or object to how we use it, including at any time to direct marketing;
• ask for information you gave us in a format you can take elsewhere;
• withdraw your consent, where we rely on it, without affecting what we did before;
• not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you. Our onboarding does not make decisions like this without a person involved.

To use any of these rights, email info@accountingagents.co.uk or write to us. There is no fee in most cases. We may ask you to confirm your identity before we act. We will respond within one month, or tell you within that month if we need up to two more months because the request is complex.

Complaints

If you are unhappy with how we have used your information, please contact our Data Protection Lead first so we can try to put it right. You also have the right to complain to the Information Commission: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, phone 0303 123 1113, www.ico.org.uk/make-a-complaint.

Changes to this notice

We review this notice every year and will tell you about any significant change, for example by email or through the client portal. The date at the top shows when it was last updated.