1. Introduction
Clean Accounts Ltd ("we", "us", "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with:
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Privacy and Electronic Communications Regulations (PECR)
Data Controller: CLEAN ACCOUNTS LTD
Company Number: 14124645
Contact: info@cleanaccounts.co.uk
2. Information We Collect
Personal Information
We collect the following types of personal data:
- Contact Details: Name, email address, phone number, business address
- Business Information: Company name, registration number, VAT number, industry sector
- Financial Information: Bank details, invoices, receipts, payroll data, tax records
- Identification Documents: Passport, driving license, utility bills (for verification purposes)
- Communication Data: Emails, phone calls, messages, meeting notes
Technical Information
When you visit our website, we automatically collect:
- IP address and device information
- Browser type and version
- Pages visited and time spent on pages
- Referring website and exit pages
- Cookie data (see our Cookies Policy)
3. How We Use Your Information
We use your personal data for the following purposes:
Service Delivery (Contract Performance)
- Providing accounting, bookkeeping, and tax services
- Preparing and filing tax returns and accounts
- Payroll processing and pension administration
- VAT returns and Making Tax Digital compliance
- Company secretarial services
Legal Obligations
- Compliance with HMRC requirements
- Companies House filings
- Anti-money laundering checks
- Professional regulatory requirements
- Record retention as required by law
Legitimate Interests
- Client relationship management
- Business development and marketing (with your consent)
- Website analytics and improvement
- Fraud prevention and security
- Internal record keeping
Consent
- Email marketing communications (you can opt-out at any time)
- Non-essential cookies (see Cookies Policy)
- Third-party data sharing where not legally required
4. Who We Share Your Data With
We may share your information with:
Essential Service Providers
- HMRC: For tax returns, VAT submissions, payroll reporting
- Companies House: For company filings and annual returns
- Pension Providers: For auto-enrollment compliance
- Banks: For payment processing and verification
Professional Service Providers
- Cloud Accounting Software: Xero, QuickBooks, FreeAgent (with your consent)
- IT and Cloud Storage Providers: Secure data hosting and backup
- Professional Advisers: Lawyers, auditors, professional indemnity insurers (as needed)
- Payment Processors: Stripe, GoCardless (for invoicing and Direct Debits)
Legal Requirements
We may disclose your information when required by law, court order, or regulatory authority.
Important: We never sell your personal data to third parties for marketing purposes.
5. Data Security
We implement robust security measures to protect your data:
- Encryption: SSL/TLS encryption for data transmission
- Access Controls: Role-based access and two-factor authentication
- Secure Storage: UK-based cloud servers with encryption at rest
- Regular Backups: Automated backups with secure off-site storage
- Staff Training: Regular data protection and security awareness training
- Secure Disposal: Secure deletion or shredding of paper records
While we take all reasonable precautions, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your data.
6. Data Retention
We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy and to comply with legal obligations:
- Active Clients: Throughout our engagement and for 6 years after cessation (HMRC requirement)
- Tax Records: Minimum 6 years from the end of the relevant tax year
- Company Records: As required by Companies House (typically 6-10 years)
- Payroll Records: 6 years from the end of the tax year
- Marketing Data: Until you withdraw consent or for 3 years of inactivity
- Website Analytics: Typically 26 months (Google Analytics)
After the retention period expires, we securely delete or anonymize your data.
7. Your Rights
Under UK GDPR, you have the following rights:
Right of Access
You can request a copy of the personal data we hold about you (Subject Access Request).
Right to Rectification
You can ask us to correct inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten")
You can request deletion of your data, subject to legal retention requirements.
Right to Restrict Processing
You can ask us to limit how we use your data in certain circumstances.
Right to Data Portability
You can request your data in a structured, machine-readable format.
Right to Object
You can object to processing based on legitimate interests or direct marketing.
Right to Withdraw Consent
Where we rely on consent, you can withdraw it at any time.
Automated Decision-Making
We do not use automated decision-making or profiling that produces legal or significant effects.
To exercise your rights, contact us at: info@cleanaccounts.co.uk
We will respond to your request within one month. If your request is complex, we may extend this by two additional months with notification.
8. International Data Transfers
We primarily store and process data within the UK. If we transfer data outside the UK, we ensure:
- The recipient country has adequate data protection laws, or
- Appropriate safeguards are in place (e.g., Standard Contractual Clauses)
Some third-party services (e.g., cloud accounting software) may process data in the EU or other approved jurisdictions.
9. Cookies and Tracking
Our website uses cookies to improve your experience. For detailed information about cookies, see our Cookies Policy.
You can manage cookie preferences through our cookie consent banner or your browser settings.
10. Marketing Communications
We may send you marketing emails about our services, tax tips, and business advice if:
- You have given explicit consent, or
- You are an existing client and we have legitimate interest (soft opt-in)
You can opt-out at any time by:
Opting out of marketing does not affect service-related communications (e.g., invoices, deadline reminders).
11. Children's Privacy
Our services are not directed at individuals under 18. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us immediately.
12. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes by:
- Updating the "Last Updated" date at the top of this page
- Emailing active clients about significant changes
- Posting a notice on our website
Continued use of our services after changes constitutes acceptance of the updated policy.
13. Complaints and Regulatory Authority
If you have concerns about how we handle your data, please contact us first:
Email: info@cleanaccounts.co.uk
If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority:
Information Commissioner's Office (ICO)
Website: www.ico.org.uk
Phone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF