BrightLedger Accounting provides tax, accounting and related business support to individuals, landlords, sole traders and businesses in the UK. This policy explains how we handle personal information when you visit our website, make an enquiry or become a client.
Concept document: written as a realistic UK accountancy-practice policy for this DeltyWeb website concept. Before a live launch, the legal entity name, registered address, ICO details, AML supervisor, service providers and exact retention schedule must be confirmed.
1. Who we are and who controls your data
For the purposes of UK data protection law, BrightLedger Accounting is the controller of personal information used for our own business and professional-services purposes.
2. Personal information we may collect
The information we need depends on the service you ask us to provide. It may include:
- name, address, telephone number, email address and date of birth;
- tax identifiers such as UTR, National Insurance number and company or partnership details;
- identity and verification information, including copies or details from identity documents where required;
- income, expenditure, bank, bookkeeping, accounting, payroll, pension, property and tax information;
- information about directors, shareholders, employees, contractors, beneficiaries or other connected persons where relevant to the work;
- correspondence with you, HMRC, Companies House and other authorised parties;
- website enquiry information, IP address, security logs and consent or preference records.
3. Where we obtain information
Most information comes directly from you. With your authority, or where the law permits or requires it, information may also come from HMRC, Companies House, previous accountants or advisers, payroll or bookkeeping systems, banks or financial institutions, identity-verification providers, your employees or business contacts, and publicly available registers.
4. How and why we use personal information
| Purpose | Typical legal basis |
|---|
| Responding to enquiries, preparing proposals and taking steps before an engagement. | Steps at your request before entering a contract and legitimate interests in managing enquiries. |
| Providing accounting, tax, payroll, bookkeeping or advisory services under an agreed engagement. | Performance of a contract and, where relevant, legal obligations. |
| Client verification, anti-money-laundering checks, record keeping and regulatory compliance. | Legal obligation. |
| Practice administration, quality control, security, fraud prevention, debt recovery and defending legal claims. | Legitimate interests and/or legal obligation. |
| Optional marketing and non-essential website technologies. | Consent where consent is required. |
5. Anti-money-laundering and identity checks
Accountancy practices may be required to carry out customer due diligence, understand the nature of a client relationship, keep verification records and monitor for unusual or suspicious activity. Where these rules apply, we may request evidence of identity, address, ownership, control, source of funds or other information needed to meet our legal and professional obligations.
Where the law requires a report or disclosure to a competent authority, restrictions may apply to what we are permitted to tell you about that report.
6. Who we may share information with
We do not sell personal information. Where necessary and lawful, we may share relevant information with:
- HMRC, Companies House and other public authorities;
- our AML supervisory body, professional body, insurers, auditors or quality reviewers where applicable;
- identity-verification, payroll, bookkeeping, accounting, document-storage, email, hosting and IT-security providers acting under appropriate arrangements;
- banks, pension providers, software platforms or other organisations you ask us to work with;
- lawyers, debt-recovery advisers, law-enforcement bodies or courts where necessary.
If a supplier processes information outside the UK, the live practice must confirm the transfer mechanism and safeguards used before this policy is published.
7. How long we keep information
We keep information only for as long as reasonably necessary for the purpose for which it was collected and to meet tax, company, anti-money-laundering, insurance, professional and legal requirements. Different records have different retention periods. Where the Money Laundering Regulations apply, customer due-diligence records are generally retained for the required statutory period after the business relationship ends, subject to applicable exceptions and updated legal requirements.
8. Security
We use proportionate technical and organisational measures designed to protect client and website information. These may include access controls, multi-factor authentication, encrypted connections, device and account security, backups, secure document exchange, staff access restrictions and supplier due diligence. No internet-based system can be guaranteed to be completely secure.
9. Your data protection rights
Depending on the circumstances, UK data protection law may give you rights to access personal information, correct inaccurate information, request erasure or restriction, object to certain processing, request portability, and withdraw consent where processing is based on consent. Some rights are subject to legal exemptions, including duties to retain records.
AccessRectificationErasureRestrictionObjectionPortability
