Privacy notice
How we look after your personal data
This notice explains what personal data Birdsong Accountancy Ltd collects, why we need it, who we share it with, how long we keep it and what your rights are. It applies to our clients, the people who work for or with our clients, people who enquire about our services and visitors to this website.
1. Who we are
Birdsong Accountancy Ltd is the data controller for the personal data described in this notice.
- Registered in England and Wales, company no. 14613836
- Registered office: Suite 1c The Mill, 355–359 Old Road, Clacton-on-Sea, CO15 3RQ
- Registered with the Information Commissioner's Office (ICO), registration no. ZB508973
- Supervised by HM Revenue & Customs for anti-money laundering purposes, registration no. XQML00000211001
For anything to do with your data, contact Nadia Gibbs, Director, at admin@birdsongba.co.uk or on 07393 588237.
2. The personal data we collect
Depending on how you deal with us, we may hold:
- Contact details: name, address, email address and phone number.
- Identity details: date of birth, photo ID, proof of address and the results of identity checks.
- Tax and government references: National Insurance number, Unique Taxpayer Reference, company number, VAT number and HMRC and Companies House authentication codes.
- Financial information: bank statements and transactions, income, expenses, invoices, receipts, pensions, investments and other information needed to prepare your books, accounts and tax returns.
- Payroll information: for your employees, names, addresses, NI numbers, tax codes, pay, pension details and statutory payments such as sick, maternity or paternity pay.
- Correspondence: emails, messages, call notes and meeting notes.
- Website data: the basic technical information your browser sends when you load our website, such as your IP address.
3. Where we get it from
Most of it comes straight from you. We may also get information from HMRC and Companies House (using the authorisations you give us), your bank and other providers through software feeds you set up, your previous accountant, public registers, and identity verification and sanctions screening services we use for anti-money laundering checks.
4. Why we use it and our lawful basis
| What we do | Lawful basis |
|---|---|
| Provide the bookkeeping, payroll, tax, VAT and accounts services you've engaged us for | Contract |
| Verify your identity and carry out other checks under the Money Laundering Regulations 2017, and make any reports required by law | Legal obligation |
| File returns and deal with HMRC, Companies House and other authorities on your behalf | Contract and legal obligation |
| Keep records to meet tax, company law and professional requirements | Legal obligation |
| Reply to enquiries and send quotes before you become a client | Legitimate interests (responding to people who contact us) or steps before entering a contract |
| Run our business, manage invoicing and protect ourselves if a claim or dispute arises | Legitimate interests |
| Send you updates or newsletters, where we offer them | Consent, which you can withdraw at any time |
Where we run payroll, we process your employees' data, including some health-related information such as statutory sick pay, to help you meet your obligations as an employer. You're responsible for telling your employees how their data is used, and our engagement letter sets out how we handle it.
Anti-money laundering checks can involve information about criminal convictions or sanctions. We only process this where the law requires or allows it.
We don't sell your data, and we don't use it to make decisions about you by automated means alone.
5. Who we share it with
We only share what's needed, with:
- Government bodies: HMRC, Companies House, The Pensions Regulator and pension providers, as part of the services we provide.
- Law enforcement: the National Crime Agency or other authorities, where the law requires us to.
- Our software and service providers: for example cloud accounting and payroll software (such as Xero), practice management software (Sodium), email and file storage (Google Workspace), and identity verification services. They act on our instructions and must keep your data secure.
- Subcontractors: trusted bookkeepers or other professionals who help us deliver your work. They're bound by confidentiality and data protection terms.
- Our supervisors and advisers: HMRC as our AML supervisor, our insurers and our professional advisers, where needed.
- Other people you ask us to share with: for example your bank, mortgage lender or a new accountant.
6. International transfers
Some of our software providers store or access data outside the UK. When they do, we make sure the transfer is covered by UK adequacy regulations or by appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
7. How long we keep it
- Client records: generally 6 years after our engagement ends. This covers HMRC's and Companies House's record-keeping rules and the period in which a legal claim could be brought.
- Anti-money laundering records: 5 years after our business relationship ends, as required by the Money Laundering Regulations 2017. After that we delete them, unless another law requires us to keep them or you agree that we can.
- Enquiries that don't lead to work: up to 12 months.
After these periods, we securely delete or destroy the data.
8. Keeping it secure
We use secure, access-controlled cloud systems, multi-factor authentication and encrypted connections. Only people who need your information to do their job can see it.
9. Your rights
You have the right to:
- ask for a copy of the data we hold about you
- ask us to correct anything that's wrong
- ask us to delete your data, where we don't have to keep it by law
- ask us to restrict how we use your data
- object to us using your data on the basis of legitimate interests
- ask for data you've given us in a portable format
- withdraw your consent at any time, where we rely on it
Get in touch using the details in section 1. There's no charge, and we'll normally reply within one month. Some rights are limited by law. For example, we can't delete records we're legally required to keep.
10. Complaints
If you're unhappy with how we've handled your data, please tell us first at admin@birdsongba.co.uk. We'll acknowledge your complaint within 30 days, look into it, and let you know the outcome without undue delay.
You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.
11. Our website
Our website doesn't use analytics, advertising or tracking cookies. The page loads its fonts from Google Fonts, which means your browser sends your IP address to Google so the fonts can be delivered. If we ever add cookies that aren't strictly necessary, we'll ask for your consent first. Links to other sites, such as Instagram, are covered by those sites' own privacy policies.
12. Changes to this notice
We'll update this notice when our practices or the law change. The date at the top shows when it was last updated.