Privacy Policy

Kays Accountants Ltd privacy notice

This notice explains what personal information Kays Accountants Ltd holds, why we hold it, and what your rights are.

Privacy notice at a glance

  • What we collect: the details we need to do your accounts, tax returns, payroll and company work, plus the identity checks the law requires.
  • Why: to provide the services you have asked for, and to meet our legal duties, for example to HMRC and under anti-money laundering law.
  • Who sees it: HMRC, Companies House and other bodies where the law requires it, our professional body, and the software companies we use to do the work. We never sell your information.
  • How long we keep it: usually 7 years after we stop acting for you. Identity check records are kept for 5 years. There is a full table below.
  • Your rights: you can ask to see your information, correct it, or ask us to delete it. Some legal duties may mean we cannot delete everything straight away.
  • Questions or complaints: email michael@kaysaccountants.uk. We will acknowledge complaints within 30 days.

Who we are and how to contact us

Kays Accountants Ltd is responsible for your personal information. In data protection law this makes us the “controller”.

  • Company: Kays Accountants Ltd, registered in England and Wales, company number 06808167
  • Address: New Maxdov House, 130 Bury New Road, Prestwich, Manchester, M25 0AA
  • Regulator: an ACCA practice — ACCA firm registration number 6191426
  • ICO registration number: ZA548544
  • Data protection contact: Michael Kay, Director
  • Email: michael@kaysaccountants.uk
  • Phone: 07799 481396

We are a small firm, so we are not legally required to appoint a Data Protection Officer. Michael Kay leads on data protection.

Whose information this notice covers

  • Clients: individuals, sole traders, partners and landlords we act for
  • People connected to our business clients: directors, company secretaries, shareholders, partners, trustees and anyone who ultimately owns or controls the business
  • People who contact us or book a consultation, whether or not they go on to become clients
  • Visitors to our website

If we run payroll for your business: we process your employees’ information on your behalf and only on your instructions. In data protection terms you are the controller and we are your “processor”. As the employer, you need to give your staff your own privacy notice. Our engagement letter sets out our processor terms.

What information we collect

What we hold depends on the services you use. It may include:

  • Identity and contact details: name, address, email, phone number, date of birth, gender, marital status, occupation
  • Identity documents: passport, driving licence, proof of address, and the results of our identity checks
  • Tax and government references: National Insurance number, Unique Taxpayer Reference (UTR), company and VAT numbers, HMRC agent authorisations
  • Financial information: income, expenses, bank statements, investments, property, pensions, loans and other information needed for your accounts and tax returns
  • Business information: sales, purchases, transactions, payroll records, and details of the people who own or run the business
  • Payment details: bank details for fees paid by bank transfer or direct debit (collected through GoCardless)
  • Records of our dealings with you: emails, letters, meeting notes and engagement letters

Sensitive information

Some information gets extra protection in law. We only collect it where we need to:

  • Health information: for example, where it affects a tax relief or allowance, or appears in payroll records such as sick pay or maternity pay
  • Information about criminal offences: our anti-money laundering checks search sanctions lists, lists of people in prominent public positions (“politically exposed persons”) and news reports. These checks can sometimes reveal information about criminal allegations or convictions.

We handle this information under the conditions set out in the Data Protection Act 2018, Schedule 1. We are putting in place an Appropriate Policy Document that sets out how we protect this information and how long we keep it.

Where we get your information from

Most of it comes directly from you. We also get information from:

  • HMRC: your tax records, once you have authorised us as your agent
  • Companies House: company, director and shareholder details on the public register
  • Identity and screening providers: our electronic identity, sanctions and politically exposed persons checks (currently EDD-Pro)
  • Your bank or bookkeeping software: for example, bank feeds into Xero that you have set up
  • Your previous accountant: handover information when you move to us
  • The business we act for: where you are a director, shareholder or employee of a business client
  • People who refer you to us: basic contact details, if someone recommends us to you
  • Regulators and public bodies: where the law requires them to share information with us

Why we use your information and our legal reasons

The law only lets us use your information if we have a valid reason, called a “lawful basis”. The table shows the reason we rely on for each thing we do.

What we use it for Lawful basis What this means for you
Doing the work you have asked for: accounts, tax returns, VAT, payroll, company secretarial Contract We need it to do the job.
Filing returns with HMRC and Companies House, and keeping the records the law requires Legal obligation Required by law.
Checking your identity and carrying out anti-money laundering checks Legal obligation (Money Laundering Regulations 2017) Required by law. We cannot act for you without these checks.
Handling criminal offence information that comes up in those checks Substantial public interest: preventing or detecting unlawful acts We apply extra safeguards to this information.
Health information you give us to claim a tax relief Your explicit consent You can withdraw consent at any time. This may affect the relief we can claim.
Co-operating with our regulator (ACCA) and our professional indemnity insurers Legal obligation and legitimate interests Needed to keep our practising status and insurance.
Keeping your file after we stop acting for you Legal obligation and legitimate interests So we can answer HMRC enquiries and deal with any claims.
Sending invoices and collecting unpaid fees Contract and legitimate interests Needed to run the business.
Replying to enquiries and holding free consultations Legitimate interests So we can answer you and quote for work.
Sending existing clients tax updates and news about our services Legitimate interests You can opt out at any time using the link in each email.
Introducing you to other businesses through our business introductions service Your consent We only share your details with your agreement. You can withdraw it at any time.

“Legitimate interests” means we have a genuine business reason that does not override your rights. Where we rely on it, you can object, and we will stop unless we have a strong reason to carry on.

Who we share your information with

We never sell your information. We only share it where we need to:

Who Why
HMRC and Companies House To file your returns and company documents
ACCA (our professional body) ACCA inspects client files as part of its regular monitoring of accountancy firms
National Crime Agency and other law enforcement bodies Only where the law requires us to report a suspicion of money laundering
Our software and IT providers: Xero, TaxCalc, BrightPay, VT Transaction+, Google Workspace, EDD-Pro (identity and screening checks), Capium (historic records only) They store or process information for us, under contracts that require them to keep it secure
Our professional indemnity insurers and their broker If a claim or possible claim arises
Our website provider (Strawberry Forge) Hosts our website and the consultation booking form
GoCardless To collect our fees
Your new accountant When you move to another firm and ask us to hand over
Other businesses we introduce you to Only with your consent
Our professional advisers (for example, solicitors) If we need legal advice or need to defend a claim

We may also share information if we sell or merge our business. The new owner would have to protect it in the same way.

Sending information outside the UK

Some of our software providers, such as Xero and Google, store or access information outside the UK, for example in the European Economic Area or the United States.

When this happens, we make sure the information is protected to UK standards by relying on one of the following:

  • UK “adequacy” regulations, which recognise that a country protects personal information properly (this includes the UK–US “data bridge” for certified US companies)
  • The UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses

Contact us if you would like more detail about these safeguards.

How long we keep your information

We only keep information for as long as we need it. These are our standard periods:

Information How long we keep it Why
Client files, working papers and tax records 7 years after we stop acting for you To meet HMRC record-keeping rules and deal with any enquiries or claims
Identity and anti-money laundering records 5 years after we stop acting for you Required by the Money Laundering Regulations 2017
Payroll records we hold for your business Returned to you or deleted when we stop acting, unless the law requires us to keep them We hold these on your behalf
Enquiries and consultations that don’t lead to work 12 months after our last contact So we can follow up on your enquiry
Marketing preferences Until you opt out, plus a record that you opted out So we don’t contact you again

We may keep information for longer if there is an ongoing HMRC enquiry, a legal claim, or a regulatory investigation. When the period ends, we securely delete or destroy the information.

Keeping your information safe

We protect your information by:

  • using secure, password-protected cloud software with two-step sign-in
  • limiting access to the people who need it for their work
  • training staff on data protection
  • requiring our suppliers to keep information secure under written contracts

If something goes wrong and your information is put at serious risk, we will tell you and, where the law requires, the ICO.

Automated decisions

We do not make decisions about you using computers alone. Our identity and screening software flags possible matches, but a person always reviews the results.

If you don’t give us the information we need

The law requires us to check your identity before we act for you. Some services, such as tax returns, also depend on you giving us complete and accurate information. If you don’t provide it, we may not be able to act for you, or to carry on acting for you.

Your rights

You have the right to:

  • See your information: ask for a copy of what we hold about you
  • Correct it: ask us to fix anything that is wrong or incomplete
  • Delete it: ask us to erase it
  • Restrict it: ask us to limit how we use it
  • Object: where we rely on legitimate interests, or for marketing (we will always stop marketing if you ask)
  • Move it: ask us to send information you gave us to you or to another firm in a common format
  • Withdraw consent: where we rely on your consent, at any time

Some limits apply. Where the law requires us to keep information, for example our anti-money laundering records, we cannot delete it until the required period ends. The law may also stop us telling you about some information, for example where disclosing it could affect the prevention or detection of crime.

How to ask: email michael@kaysaccountants.uk, write to us, or ask in person. It is free in most cases. We will reply within one month. For complex requests this can be extended by up to two more months; we will tell you if so. We may ask you to confirm your identity first.

Cookies and our website

Cookies are small files a website saves on your device. Our website uses:

  • Essential cookies: needed for the website to work, for example to remember settings.
  • Advertising measurement cookies: we use Google Tag Manager and Google Ads to see how well our online adverts work. These set cookies such as “_gcl_au” and share information about your visit with Google.

You can block or delete cookies in your browser settings. We are adding a cookie banner so you can choose whether to accept advertising cookies.

When you book a consultation or send an enquiry through our website, we use your details only to reply to you. We keep them as set out in the retention table above.

How to complain

If you are unhappy with how we have used your information, please tell us first:

  • Email: michael@kaysaccountants.uk
  • Post: Data Protection, Kays Accountants Ltd, New Maxdov House, 130 Bury New Road, Prestwich, Manchester, M25 0AA

We will acknowledge your complaint within 30 days. We will look into it and tell you the outcome without unnecessary delay.

If you are still unhappy, you can complain to the ICO (Information Commission), the UK’s data protection regulator:

Changes to this notice

We review this notice at least once a year and whenever we change how we use personal information.

Last updated: 27 October 2026