1. Who we are

Brian Gumbley Accountancy Services Ltd (company number 09843320) is based at Corner House, 28 Huddersfield Road, Newhey, Rochdale, Lancashire OL16 3QF. For our own client relationships, website and business administration, we generally act as a data controller. In some services, such as processing payroll on a client’s instructions, we may act as a processor; the applicable engagement terms explain those arrangements.

For privacy enquiries, rights requests or complaints, contact Brian Gumbley at bgumbley@sky.com or write to the address above.

2. Who and what this policy covers

This notice explains how we handle personal data about clients, prospective clients, client employees and contacts, suppliers, website visitors and others who communicate with us. Separate notices may apply to our employees and job applicants.

Personal data is information relating to an identified or identifiable living person. It may include names, addresses, dates of birth, National Insurance numbers, UTRs, contact information, financial records and online identifiers.

3. Information we collect

Depending on the services requested, we may collect identification and AML verification documents; contact and professional details; accounting, tax, VAT, CIS, pension and payroll information; bank and transaction records; correspondence; and website or device information.

Where necessary for a particular engagement, we may encounter special category data (for example health, religious beliefs, trade union membership or biometric data used to identify someone) and criminal offence information. We only process such information where the relevant legal conditions and safeguards apply.

4. Where the information comes from

We receive information directly from individuals and clients, their authorised representatives, employers, banks, accounting and payroll systems, HMRC, Companies House and other public or professional sources where appropriate. Information provided by a business client may relate to its directors, employees, subcontractors or customers.

5. How and why we use personal data

Purpose

Typical lawful basis

Provide accountancy, tax, payroll, bookkeeping and advisory services; communicate about engagements

Contract; legitimate interests; legal obligation, depending on the activity

Verify identity, meet anti-money laundering, tax and professional obligations

Legal obligation

Manage invoices, debt recovery, business records and service quality

Contract; legitimate interests; legal obligation

Protect systems, prevent fraud and investigate incidents

Legitimate interests; legal obligation

Send marketing communications where permitted

Consent or legitimate interests, subject to marketing rules

Where we rely on legitimate interests, these include operating and protecting our practice, communicating with business contacts and recovering sums due. We balance those interests against individuals’ rights. Where special category or criminal offence data is processed, we also identify an appropriate additional legal condition.

6. Sharing information

We may share relevant data with HMRC, Companies House, other regulators or authorities, banks, auditors, professional advisers, insurers, and approved IT, cloud, bookkeeping, tax, payroll, document-management and other service providers. We may disclose information to a client’s authorised representatives or as required by law. We require appropriate confidentiality and security safeguards from service providers.

We do not sell personal data. In a business sale or reorganisation, information may be shared where lawful and appropriately protected.

7. International transfers

Some service providers may store or access personal data outside the UK. Where a restricted international transfer occurs, we use an applicable UK adequacy regulation or another lawful transfer mechanism, such as the UK International Data Transfer Agreement or UK Addendum, together with any required assessments and safeguards. Details of relevant safeguards can be requested using the contact details above.

8. Security and confidentiality

We apply appropriate technical and organisational controls, including access restrictions, authentication, secure storage and transfer, staff confidentiality obligations, training and incident-response procedures. Our staff are instructed to verify a caller’s identity and authority before disclosing client information. No system can be guaranteed completely secure.

Suspected personal data breaches are escalated internally promptly and assessed for any notification duties to the ICO and affected individuals.

9. How long we keep data

We retain information only for as long as necessary for the relevant service, legal and regulatory requirements, the establishment or defence of legal claims, and legitimate business needs. Many accounting and tax records are ordinarily retained for around six years, but periods differ by record type and circumstances; some AML records have specific statutory retention requirements. We periodically review records and securely delete or anonymise them when no longer needed.

10. Your data protection rights

Depending on the circumstances and lawful basis, you may request access to your data, correction, erasure, restriction, portability or object to certain processing. You may withdraw consent where we rely on it, without affecting earlier lawful processing.

You have the right to object to direct marketing at any time. We will stop processing your personal data for that purpose if you object.

Please contact us using the details in section 1. We generally respond to valid rights requests within one month, subject to applicable extensions and permitted exemptions. We may need to verify identity before releasing information.

11. Data protection complaints

You can complain about our handling of personal data by emailing bgumbley@sky.com or writing to our office. We will acknowledge a data protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed and explain our outcome.

You may also complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We encourage you to contact us first so that we can try to resolve your concern.

12. Website, marketing and automated decisions

Our website may process technical data such as IP addresses and browser information. Where cookies or similar technologies require consent, we will seek it through appropriate website controls; any separate cookie notice should describe the technologies actually used.

We may send service communications and, where permitted by applicable electronic marketing rules, marketing messages. You can opt out of marketing at any time.

We do not describe any routine solely automated decisions producing legal or similarly significant effects in this notice. If we introduce such processing, we will provide the required information and safeguards.

13. Information you provide and updates

Certain information is needed to perform an engagement or comply with legal requirements (for example identity checks and tax information). If it is not provided, we may be unable to accept or complete an engagement.

We may revise this notice when our services, practices or the law change. The current version will be made available on our website or on request. Material changes will be brought to individuals’ attention where appropriate.

Document control: Privacy Policy | Version 2.0 | 16 October 2026