Privacy Policy

1Who we are

1.1LOYALS Accountants & Business Consultants (“LOYALS”, “we”, “us” and “our”) is a trading name used by an accountancy and business consultancy firm based in London. This Privacy Policy explains how we collect, use, store and protect personal data, and the rights you have over it.

1.2For personal data we collect about clients, prospective clients, website visitors, suppliers and other contacts for our own purposes, the controller is the LOYALS company you deal with. For clients, that is the company named in your Letter of Engagement. For website visitors and enquiries, it is the LOYALS company that runs the website. You can ask us at any time for the name and details of the company that is the controller of your data, and we will tell you.

1.3When we handle personal data on behalf of a client, such as payroll records for the client's own employees, the client is the controller and we act as its processor, on the terms in our Terms of Business.

1.4You can contact us about your data at kris.nick@loyals.uk, on 07450 258 975, or by post at 39-41 North Road, King's Cross, London N7 9DP.

1.5We are registered with the Information Commissioner's Office (ICO) as required under UK data protection law, and our registration reference is available on request. Your Letter of Engagement states the full legal name of the company that is the controller of your data.

2What data we collect

2.1Clients and prospective clients. We collect:

• identity data, such as your name, date of birth, National Insurance number, company registration details, and the identity and address documents you give us for our checks;
• contact data, such as your address, email address and telephone numbers;
• financial data, such as bank account details, income, expense receipts, invoices, VAT, CIS, payroll and tax information;
• business data, such as company structure, directors, employees, activities and turnover;
• communication data, such as records of calls, emails, WhatsApp messages and meetings;
• engagement data, such as your Letter of Engagement, instructions and authorisations; and
• portal data, such as log-in and activity records in your LOYALS bookkeeping portal.

2.2Website visitors. We collect:

• technical data, such as your IP address, browser type, device and operating system;
• usage data, such as the pages you visit, how long you stay and where you came from;
• cookie data, collected through cookies and similar technologies (see section 9); and
• form data, which is what you give us through contact forms, call booking forms or sign-ups.

2.3Business contacts and suppliers. We collect contact details such as name, job title, company, email and telephone number, together with records of our dealings, contracts, invoices and payments.

2.4In limited circumstances we may process special category data, for example health information for sick pay calculations, or data about criminal convictions where it is needed for regulatory checks. We process it only where we have your explicit consent or where it is necessary for legal compliance, and we apply extra care to it.

2.5If you give us personal data about other people, such as your employees, please make sure you are entitled to do so and that they know we process it on your behalf.

2.6We may also receive personal data from other sources, such as Companies House and HMRC records, your previous accountant when you move to us, electronic identity verification providers, bank or software feeds you connect to your portal, and people who refer you to us.

3How we use your data

3.1Accounting and professional services. We use personal data to:

• prepare and file accounts, tax returns, VAT returns, CIS returns and payroll;
• give business advice and support;
• manage invoices and payments, and support debt recovery;
• deal with HMRC, Companies House and other authorities on your behalf.

3.2Looking after our relationship with you. We use it to:

• communicate with you about our services, your account and important updates;
• answer your questions and give you support;
• manage your Letter of Engagement, take payment and keep financial records.

3.3Marketing and introductions. We use it to:

• send you information about our services that may interest you, only where you have agreed or the law allows;
• introduce you to other businesses we work with, only if you ask us to or agree;
• ask for reviews and testimonials, with your permission;
• improve our services using your feedback.

3.4Our website. We use it to run and improve the website, understand how visitors use it, measure our marketing and detect or prevent fraud and security problems.

3.5Legal and compliance. We use it to meet our legal duties, including identity checks under our anti-money laundering policy, to establish, exercise or defend legal claims, and to keep professional indemnity insurance in place.

4Our lawful basis for using your data

4.1Under UK GDPR we must have a lawful basis for using your personal data. We rely on these:

4.2For professional services we normally rely on contract or legal obligation rather than consent. You cannot opt out of processing that is necessary to provide the services you have asked for or to meet a legal duty, although you can choose to stop using our services. Providing identity, contact and financial information is a requirement of our contract with you and, for identity checks, a legal requirement. If you do not provide it, we cannot take you on or continue to act for you.

5Who we share data with

5.1We share personal data only where it is needed for the purposes in this policy, and with appropriate safeguards. The recipients are:

• Government and public bodies: HMRC for tax, VAT, CIS and payroll submissions, Companies House for accounts and confirmation statements, The Pensions Regulator for auto-enrolment declarations, and the National Crime Agency where the law requires us to report a suspicion;
• Our team and associates: the accountants and finance professionals who work with us, including associates on a contracted basis, who are bound by written duties of confidentiality and data protection;
• Service providers: cloud accounting and payroll software such as Xero or QuickBooks, our LOYALS bookkeeping portal and its hosting, email and communication tools, e-signature and electronic identity verification providers, IT support and security, banks and payment providers;
• Advisers and insurers: legal advisers where a matter needs one, and our professional indemnity insurers if there is a claim or a possible claim; and
• Anyone else you ask us to share with, or the law, a court or a regulator requires us to.

5.2Where a provider processes personal data on our behalf, we require a written data processing agreement that protects the data to the standard UK GDPR requires.

5.3We will never sell your personal data.

6How long we keep your data

6.1We keep personal data only for as long as we need it for the purposes it was collected for, or as the law requires. Our usual periods are:

6.2UK tax law requires businesses and their advisers to keep financial records for at least six years, and the anti-money laundering rules require us to keep identity checking records for five years after a relationship ends. Professional indemnity insurance and possible legal claims are further reasons to keep records for these periods. After the period ends we delete or securely destroy the data we no longer need.

7Your data protection rights

7.1Under UK GDPR and the Data Protection Act 2018 you have the right to:

• be informed about how we use your data, which this policy does;
• access the personal data we hold about you, known as a subject access request;
• have inaccurate or incomplete data corrected;
• ask us to erase your data in certain circumstances, although this is limited where we must keep it by law, such as the six year rule for financial records, and we will explain if we cannot delete something;
• restrict how we use your data in certain situations;
• receive your data in a portable format where we use it on the basis of consent or contract;
• object to processing based on legitimate interests or used for direct marketing;
• withdraw your consent at any time where we rely on it; and
• not be subject to a decision based only on automated processing that has legal or similarly significant effects. We do not make decisions of that kind.

7.2To use any of these rights, contact us using the details in section 12. We will reply within one month. If your request is complex we may extend that by up to two further months, and we will tell you if so. There is no charge unless a request is manifestly unfounded or excessive. Where we need you to clarify a request, the time limit pauses until you do, and we carry out reasonable and proportionate searches.

8How we protect your data

8.1We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or loss. They include:

• encryption of data in transit between your device and our website and systems;
• secure cloud storage with the encryption provided by our providers;
• access limited to the people who need the data for their work, with multi-factor authentication on our key systems where the provider offers it;
• backups and security software kept up to date by our providers and IT support;
• confidentiality and data protection duties for our team and associates, and data protection training;
• secure storage of paper records, and secure disposal of paper and devices; and
• a procedure for detecting, reporting and responding to personal data breaches.

8.2If a breach is likely to put your rights and freedoms at risk, we will report it to the ICO within 72 hours as the law requires, tell the people affected without undue delay where the risk to them is high, contain it, and put measures in place to stop it happening again.

8.3Security is shared. Please use strong, unique passwords for your portal, do not share your log-in details, and be careful with emails that ask for sensitive information. We will never ask you to move money to a new bank account on the strength of an email or message alone. Tell us at once if you notice anything suspicious.

9Cookies and website analytics

9.1Our website uses cookies and similar technologies to make it work and, where you allow them through our cookie banner, to understand how visitors use it and to measure our advertising. Cookies are small text files stored on your device when you visit a website. The cookies we use are:

9.2Where you allow it, we use Google Analytics to understand which pages are useful and to improve the website. It collects information such as the pages you visit and for how long, the website you came from, your browser and device type, and your approximate location at country and city level. For more on how Google uses data, see Google's Privacy Policy.

9.3Most browsers accept cookies automatically, but you can change your browser settings to block or delete them, although parts of the website may then not work as well. You can also opt out of Google Analytics with the Google Analytics Opt-out Browser Add-on.

9.4Our Website Terms & Conditions cover use of the website.

10Transfers outside the UK

10.1We are based in the UK and mainly process data here. Some of our providers, for example large cloud and email providers, may process data outside the UK, including in the United States.

10.2When personal data is transferred outside the UK, we make sure it is protected by an adequacy decision for the destination (including the UK Extension to the EU-US Data Privacy Framework for certified US providers), by the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses, or by another safeguard that UK GDPR allows. If you would like more information about a particular transfer, please ask us.

11Changes to this policy

11.1We may update this policy to reflect changes in our practices, the law or our services. When we do, we will change the date and version at the foot of this page. For clients, we will tell you by email or through your portal where a change is significant, and where the law requires your renewed consent we will ask for it.

11.2If you would like to see an earlier version of this policy, ask us and we will provide it.

12Contact us and complaints

12.1If you have a question about this policy, want to use your rights or have a concern about how we handle your personal data, contact us at kris.nick@loyals.uk or on 07450 258 975, or write to 39-41 North Road, King's Cross, London N7 9DP. We are available Monday to Saturday, 10am to 7pm.

12.2If you have a complaint about how we have handled your personal data, please tell us first so that we can put things right. You can complain by email to kris.nick@loyals.uk, by phone, by post, or through the online form on our website. We will acknowledge your complaint within 30 days, as the law requires, and in practice within three working days under our Complaints Procedure, and we will tell you the outcome without undue delay. The same procedure covers complaints about our service more generally.

12.3You also have the right to complain to the UK data protection authority, the Information Commissioner's Office (ICO), whose helpline is 0303 123 1113 and whose address is Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.