Privacy notice

Effective from: 29 May 2026, Version 1.1, updated 12 August 2026 (website form processor added)

1. About this notice

This privacy notice explains how APROTAX LTD ("we", "us", "our") collects and uses your personal data, and your rights in relation to that data. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations 2003 (PECR).

Please read this notice carefully. If you have any questions, contact us using the details in section 12.

2. Who we are

We are APROTAX LTD, a private company limited by shares registered in England and Wales (company number 11839066). Our registered office is 14 Fogarty Park Road, Bristol, BS15 8FR.

We are registered with the Information Commissioner's Office (ICO) as a data controller under registration number ZA547387.

We are an AAT-licensed accountancy practice (AAT member 10421519; licence 1008060) and our AML supervisor is the Association of Accounting Technicians.

Our Data Protection Lead is Anca Prodan MAAT. You can contact her using the details in section 12.

3. The personal data we collect

3.1 If you are a client or prospective client

• Identity data: your full name, date of birth, nationality, photograph from your identity document.
• Contact data: postal address, email address, telephone number.
• Identification document data: passport, driving licence, or other government-issued ID; proof of address (utility bill, bank statement).
• Financial data: bank account details (for invoicing), tax-related data (National Insurance number, Unique Taxpayer Reference, employment income, dividend income, capital gains data, VAT data), and where relevant, source of funds / wealth evidence.
• Engagement data: copies of communications between us, meeting notes, records of the services we provide to you.
• For corporate clients: equivalent identity, contact and tax data for the company's directors, beneficial owners (persons with significant control) and authorised signatories.

3.2 If you visit our website

• Usage data: pages visited, time spent, approximate location (derived from IP address), browser and device type.
• Contact data: name, email address and message content you provide via our contact form, WhatsApp link or email.

3.3 Special category and criminal offence data

We do not routinely collect "special category" data (health, religion, ethnicity, etc.) or criminal offence data. If we do need to collect this for a specific service, we will rely on a substantial public interest condition under the DPA 2018 (see section 4.2) and tell you at the point of collection.

4. How we use your personal data and our lawful bases

4.1 Why we use your data

• To provide accountancy and tax services to you under our engagement letter.
• To carry out customer due diligence (CDD) and ongoing monitoring required by the Money Laundering Regulations 2017.
• To file tax returns, accounts and other statutory submissions to HMRC, Companies House and other authorities on your behalf.
• To process payments and issue invoices.
• To respond to your enquiries.
• To send you occasional updates about our services (where you have a current engagement with us, on a "soft opt-in" basis; you can opt out at any time).
• To comply with our legal, regulatory and professional obligations (including AAT licensing requirements).
• To defend, establish or exercise legal claims.

4.2 Our lawful bases (UK GDPR Article 6 and 9)

5. Who we share your personal data with

We share personal data with the following categories of recipients, only where strictly necessary:

• Our regulators and authorities: HMRC, Companies House, the Information Commissioner's Office, the Association of Accounting Technicians (our AML supervisor), the National Crime Agency where we are legally required to file a Suspicious Activity Report.
• Our IT and software service providers: including Xama Technologies Ltd (our AML and CDD platform, including Companies House monitoring via Xama Core), Microsoft (Microsoft 365 / OneDrive for document storage and email), Formspree Inc (our website contact form processor, which passes your enquiry to our email), and our accountancy / tax software provider. Each is engaged under a written data processing agreement compliant with UK GDPR Article 28.
• Our continuity nominee: Mrs Bavani Giritharan FCCA, trading as Bavani Accountant, who is contractually appointed to take over our practice in the event we are unable to act. She has no active access to your data in normal operations and would only be provided access on activation of the continuity plan under controlled conditions, subject to professional confidentiality.
• Our professional advisers: solicitors, insurers (Trafalgar Risk Management Ltd, our professional indemnity insurer) and our continuity nominee, where strictly necessary for the management of our practice.
• Third parties where you have instructed us: for example, where you have asked us to liaise with your bank, your previous accountant, or a financial adviser.

We do not sell your personal data to anyone, ever.

6. International transfers

We aim to keep your personal data within the United Kingdom. Some of our cloud-service providers (such as Microsoft 365) operate global infrastructure; where data is transferred outside the UK, the transfer is to a country covered by UK adequacy regulations, or is protected by appropriate safeguards (such as the International Data Transfer Agreement / IDTA or the UK Addendum to the EU Standard Contractual Clauses).

7. How long we keep your personal data

• Client engagement records (including correspondence and working papers): 6 years from the end of the relevant tax year or the end of the engagement, whichever is later.
• Customer due diligence records (under MLR 2017 reg. 40): 5 years from the end of the business relationship.
• Marketing data: until you ask us to stop, or until the data is no longer accurate.
• Internal SAR records: 5 years from the date of the internal SAR.
• Website analytics: no more than 14 months in identifiable form.

After the retention period, we securely delete the data (electronic deletion with backup purge within 6 months; secure shredding of any paper records).

8. Your rights

• Right to be informed: through this notice.
• Right of access: you can ask for a copy of the personal data we hold about you (a Data Subject Access Request).
• Right to rectification: you can ask us to correct inaccurate or incomplete data.
• Right to erasure: you can ask us to delete your data. This right is limited where we are required to keep records under MLR 2017, HMRC rules, or AAT rules.
• Right to restrict processing: you can ask us to limit how we use your data in certain circumstances.
• Right to data portability: for data you provided to us where processing is by consent or contract.
• Right to object: particularly to direct marketing, which you can opt out of at any time.
• Rights related to automated decision-making: we do not make decisions about you that have legal or similarly significant effect using automated processing alone.

To exercise any of these rights, contact us using the details in section 12. We will respond within one calendar month. We do not charge a fee unless the request is manifestly unfounded or excessive.

9. Cookies and website analytics

Our website does not set analytics or marketing cookies, and there is no cookie banner because none is needed.

• Strictly necessary: the site may store a small setting in your browser to remember a preference (for example, that you dismissed a notice). These do not identify you and do not require consent.
• Analytics: we use Vercel Web Analytics to count page views and see which pages are read. It uses no cookies and no persistent identifier. It records the page, the referring site, your country, browser and device type, and a hashed value that is discarded within 24 hours. We cannot identify you from it. See Vercel's analytics privacy notice.
• Contact forms: submissions are delivered to us by Formspree, Inc. (United States, under standard contractual clauses). Formspree keeps a copy so we can recover a message if an email goes astray; see Formspree's privacy policy for their retention.

If we ever add tools that do set cookies, we will update this notice and ask for your consent first.

10. How to complain

If you are unhappy with how we have used your personal data, please contact us first using the details in section 12, and we will try to put it right. Our Complaints Handling Policy is available on request. You also have the right to complain to the Information Commissioner's Office (ICO) at any time:

• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Helpline: 0303 123 1113
• Website: ico.org.uk

11. Changes to this notice

We review this notice at least annually and update it when our processing or applicable law changes materially. The "Effective from" date at the top of this notice shows when it was last updated. If we make significant changes, we will notify you by email (where we hold your email address) and update the version on our website.

12. Contact us

For any privacy-related question or to exercise your rights:

• Data Protection Lead: Anca Prodan MAAT
• Email: anca@aprotax.co.uk
• Post: APROTAX LTD, 14 Fogarty Park Road, Bristol, BS15 8FR
• Telephone: 0117 374 1280