The Business Bookkeeper Ltd understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of our clients and will only collect and use personal data in ways that are described in this Privacy Notice, and in a way that is consistent with our obligations and your rights under the law.

1. Information About Us

The Business Bookkeeper Ltd
Registered in England under company number: 08139683
Registered address: 22 Burley Close, London, SW16 4QQ
Data Protection Contact: Selina Orleans-Foli
Email address: dpo@thebusinessbookkeeper.co.uk

We are a member of the Institute of Accountants and Bookkeepers.

2. What Does This Notice Cover?

This Privacy Notice explains how we use your personal data, how it is collected, how it is held and how it is processed. It also explains your rights under data protection law.

This notice applies to personal data we collect and use in connection with our bookkeeping and related services, enquiries about our services, our website and our business administration.

Where we process personal data on behalf of a client, such as employee information supplied for payroll services, the client will generally be the data controller and we will act as a data processor. In those circumstances, we process the information in accordance with our agreement with the client and applicable data protection law.

3. What is Personal Data?

Personal data is information relating to an identified or identifiable individual. This includes information that can identify you directly, such as your name and contact details, or indirectly, such as identification numbers and other identifiers.

The personal data that we collect and use is described in section 6 below.

4. What Are My Rights?

Under the UK GDPR, you have the following rights, subject to any applicable legal conditions and exemptions:

a) The right to be informed about our collection and use of your personal data.

b) The right of access to the personal data we hold about you.

c) The right to rectification if personal data we hold about you is inaccurate or incomplete.

d) The right to erasure, which allows you to ask us to delete your personal data in certain circumstances.

e) The right to restrict processing of your personal data in certain circumstances.

f) The right to data portability, which allows you to obtain and reuse certain personal data across different services.

g) The right to object to certain uses of your personal data.

h) Rights relating to automated decision-making and profiling, where applicable.

Not all rights apply in every situation. For example, we may be required to retain certain information to comply with our legal or regulatory obligations.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

If you wish to exercise any of these rights, please contact us using the details in section 12.

5. How Do You Collect or Obtain Personal Data?

We may collect personal data in the following ways:

• Directly from you, for example when you complete forms on our website, contact us by phone, email, post or social media, enquire about our services, subscribe to our mailing list, or provide documents and information to us.
  
  
• Through the services we provide, including where you grant us access to accounting software, online storage or other electronic resources.
  
  
• From HMRC and other relevant authorities, where you have authorised us to act on your behalf or where the information is required in connection with the services we provide.
  
  
• From third-party identity verification and screening providers, where necessary to comply with anti-money laundering and other legal obligations. This may include identity and address checks, politically exposed person checks, sanctions screening and information from publicly available sources such as Companies House.
  
  
• From other people or organisations involved in your business, where the information is relevant to the services we provide.

6. What Personal Data Do You Collect?

We may collect some or all of the following personal data, depending on your relationship with us and the services you require:

• Full names, previous or other names, current and previous addresses, marital status, gender, telephone numbers, email addresses, date of birth, business name, job title and profession.
  
  
• Payment information, National Insurance numbers, passport numbers, tax reference numbers and financial details.
  
  
• Information relevant to preparing financial accounts, corporation tax, payroll, VAT and other services you require from us.
  
  
• Information required to carry out identity verification, anti-money laundering checks and other legal or regulatory obligations.
• Information contained in correspondence, documents and records that you provide to us in connection with our services.

We only collect personal data that is relevant to the purposes for which it is required.

7. How Do You Use My Personal Data?

Under the UK GDPR, we must have a lawful basis for using personal data. The lawful basis will depend on the purpose for which the information is being used.

Where we rely on legitimate interests, these may include administering and developing our business, maintaining appropriate business records, communicating with clients and prospective clients, protecting our business and systems, and establishing, exercising or defending legal claims. We consider whether these interests are necessary and balanced against your rights and interests.

Where we rely on consent, you may withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of processing carried out before it was withdrawn.

We will not use your personal data for purposes that are incompatible with those described in this notice without an appropriate lawful basis.

8. How Long Will You Keep My Personal Data?

We will not keep your personal data for longer than is necessary for the purposes for which it was collected, subject to any legal or regulatory requirements.

• Client contact details: For as long as we provide services to you and for 24 months thereafter, unless the information forms part of records that we are required to retain for longer.
  
  
• Enquiries: Where you enquire about our services but do not become a client, we will retain your contact details for 24 months after your last enquiry.
  
  
• Mailing list: We will retain your details for as long as you remain subscribed. You may unsubscribe at any time. We may retain limited information where necessary to record your marketing preferences or comply with legal obligations.
  
  
• Financial, accounting and tax records: We will retain these records for the periods required by applicable law and regulation. The applicable period may vary depending on the type of record and the circumstances.
  
  
• Anti-money laundering records: We will generally retain customer due diligence, identity verification and related records for five years from the end of the business relationship, or for such other period as required or permitted by applicable law.
  
  
• Other business records: We will retain information for as long as reasonably necessary for the relevant purpose, including complying with legal obligations, maintaining appropriate business records and establishing, exercising or defending legal claims.

When personal data is no longer required, we will securely delete or dispose of it, unless we are required or permitted by law to retain it.

9. How and Where Do You Store or Transfer My Personal Data?

We use appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include, where appropriate, access controls, password protection, security software, software updates, secure storage, backups and the secure disposal of information that is no longer required. We also take appropriate steps to ensure that anyone who processes personal data on our behalf is authorised to do so and understands their responsibilities.

We use cloud-based software and storage providers in connection with our services and business administration. Personal data may therefore be stored or accessed in the UK or in other countries, depending on the services used.

Where we make a restricted transfer of personal data outside the UK, we will ensure that the transfer is permitted under applicable UK data protection law. This may include relying on UK adequacy regulations, appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, or another permitted basis where applicable.

We take appropriate steps to assess the protection provided for personal data and to ensure that our arrangements with relevant service providers include appropriate data protection provisions.

Further information about the categories of service providers we use is provided in section 10.

10. Do You Share My Personal Data?

We may share personal data with third parties where this is necessary to provide our services, operate our business, comply with legal or regulatory obligations, or establish, exercise or defend legal claims.

• HMRC and other government or regulatory authorities, where required in connection with the services we provide or our legal obligations.
  
  
• The Institute of Accountants and Bookkeepers, and other relevant supervisory or regulatory bodies, where disclosure is required in connection with our professional or anti-money laundering obligations.
  
  
• The National Crime Agency and other law enforcement authorities, where we are required or permitted by law to report suspected money laundering, terrorist financing or other criminal activity.
  
  
• Professional advisers and insurers, including our professional indemnity insurers, where necessary in connection with advice, insurance, complaints or legal claims.
  
  
• Subcontractors and other service providers who assist us in providing our services, subject to appropriate confidentiality and data protection arrangements.
  
  
• An appointed alternate, where appropriate, to assist with the continuity of our practice in the event of incapacity or death.

Software, cloud storage and IT service providers, including:

• Xero, for accounting and bookkeeping services.
  
  
• Google Workspace, including Gmail, Google Drive, Google Docs and Google Sheets, for email, document management and other business applications.
  
  
• Microsoft 365, including Office applications and SharePoint, for preparing, working with and storing business and client documents.
  
  
• SmartSearch, for identity verification and anti-money laundering checks.
  
  
• AML Complete, for anti-money laundering compliance, risk assessment and client due diligence administration.
  
  
• Apron, for bookkeeping and expense-management services.
  
  
• SodiumHQ, for practice management and client administration.
  
  
• Syft Analytics, for financial reporting and analysis.
  
  
• Better Proposals, for preparing and managing proposals.
  
  
• Xenon, for bookkeeping and accounting-related services.
  
  
• Xama, for client onboarding and compliance-related administration.
  
  
• Sync and Tresorit, for cloud storage.
  
  
• MailerLite, for mailing-list and marketing communications.
  
  
• Calendly and TidyCal, for appointment booking.
  
  
• ChatGPT, Claude and Gemini, for assistance with drafting, reviewing information and supporting general business administration

We may also use other software and service providers where necessary to deliver our services or administer our business. Further information about the providers we use is available on request.

We may also disclose personal data where required by law, a court order or a competent authority.

Where we use third-party service providers to process personal data on our behalf, we take appropriate steps to ensure that suitable data protection arrangements are in place.

We do not sell your personal data.

11. How Can I Access My Personal Data?

If you want to know what personal data we hold about you, you can ask us for details and for a copy of that information. This is known as a subject access request.

You can make a subject access request by contacting us using the details in section 12. We would prefer requests to be made in writing, as this helps us understand and respond to your request.

We may ask you for additional information where necessary to confirm your identity or clarify your request.

There is normally no charge for a subject access request. In certain circumstances, a reasonable fee may be charged or a request may be refused, where permitted by law.

We will respond within the time limits required by applicable data protection law. Where permitted, the time limit may be extended or paused in certain circumstances. We will let you know if this applies.

12. How Do I Contact You?

To contact us about anything to do with your personal data and data protection, including making a subject access request, please use the following details:

For the attention of: Selina Orleans-Foli
Email address: dpo@thebusinessbookkeeper.co.uk
Telephone number: 0207 137 6565
Postal address: The Business Bookkeeper Ltd, 22 Burley Close, London, SW16 4QQ.

If you have concerns about how we use your personal data, please contact us in the first instance so that we can try to resolve them.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. Further information is available at www.ico.org.uk. (Information Commissioner’s Office)

13. Changes to this Privacy Notice

We may update this Privacy Notice from time to time, for example, if the law changes or if we change the way we process personal data.

The latest version will be available on our website at www.thebusinessbookkeeper.co.uk

14. Cookie Policy

This Cookie Policy explains how we use cookies and similar technologies on our website.

What are cookies?

Cookies are small data files that are placed on your computer or mobile device when you visit a website. They are used to help websites function, remember preferences and, where applicable, collect information about how visitors use a website.

How do we use cookies?

We use cookies and similar technologies to support the operation of our website and, where applicable, to understand how visitors use it.

Our website uses Complianz to manage cookie consent. The consent banner allows you to accept, deny or manage your preferences for cookies that require consent.

Types of cookies

• Functional cookies: These support the operation of the website and its essential features.
  
  
• Marketing cookies: These may be used for advertising or tracking visitors for marketing purposes. Where consent is required, these cookies will only be used in accordance with your preferences.
  
  

Website statistics

Our website uses Google Analytics to help us understand how visitors use the website. Complianz identifies Google Analytics as a website-statistics service and records a cookie named _ga.

Managing your preferences

You can manage your cookie preferences using the consent banner on our website. You can also change your browser settings to block or delete cookies, although this may affect how some website features work.

Further information

If you have any questions about our use of cookies, please contact us using the details in section 12.