Privacy Policy

Fair Accountants respects your privacy. This policy explains how we collect, use, share and protect personal information when you visit our website, contact us or use our accountancy services. It also explains your rights and how to raise a concern.

We handle personal information in accordance with applicable UK data protection and privacy law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), as amended.

1. Who we are

Fair Accountants Ltd is registered in England and Wales under company number 16004370 and trades as Fair Accountants. In this policy, “we”, “us” and “our” mean Fair Accountants Ltd.

We are the data controller for information we use to provide professional accountancy and tax services, manage our business and meet our own legal obligations. This means we decide why and how that information is used.

For particular services, such as payroll processing carried out solely on a business client’s instructions, we may act as a data processor. Our role depends on the activity and is addressed in the relevant engagement terms and, where required, a data processing agreement. The client remains responsible for explaining its own use of personal information to its employees and other individuals.

Practice address: Unit 42, Base Point, Metcalf Way, Crawley, RH11 7XX, United Kingdom.
Registered office: Unit 42, Base Point, Metcalf Way, Crawley, RH11 7XX, United Kingdom.

Email: tahir@fairaccountants.co.uk
Telephone: +44 203 488 6622
Website: https://fairaccountants.co.uk/

Please use these contact details for privacy questions, rights requests or data protection complaints.

2. Personal information we collect

We collect information that is relevant and necessary for the services you request, the operation of our website and our legal obligations. Depending on our relationship with you, this includes:

• Contact and enquiry details, such as your name, address, email, telephone number and correspondence.
• Identification and verification information, such as date of birth, identity documents, proof of address, beneficial ownership details and results of client due diligence checks.
• Tax and financial information, such as National Insurance numbers, Unique Taxpayer References, income, expenditure, bank details and statements, invoices, accounts and VAT records.
• Business information about directors, shareholders, people with significant control, employees and other individuals connected with a business client.
• Payroll information, such as pay, tax codes, pension contributions, employment details, leave and statutory payment records.
• Information about services, instructions, fees, payments and correspondence with HMRC, Companies House and other authorities.
• Website technical information, such as IP address, browser and device details, security logs and, where the relevant technologies are enabled, pages visited, referral information and website interactions.

Sensitive information

Some work may require information about health, such as sickness information needed for statutory sick pay, or trade union membership where deductions are processed. If relevant, client due diligence may involve information about alleged offences or convictions. We only process such information where necessary and where the additional legal conditions are met.

3. Where information comes from

We obtain information directly from you and, where relevant, from business clients, their directors or employees, authorised representatives, previous accountants, identity verification providers and public authorities such as HMRC. We may also obtain publicly available information from Companies House and other relevant public registers. The sources used depend on the service and checks required.

Where we receive personal information about someone other than our client, we provide the required privacy information within the applicable legal time limits unless a lawful exception applies. Business clients should help make this policy available to individuals whose information they provide to us.

4. Why we use information and our lawful bases

We identify the lawful basis for each activity before processing personal information. More than one basis can apply to different parts of a service. The main purposes and bases are set out below.

Enquiries and quotations

We use enquiry information to answer questions and prepare quotations. Where an individual asks us to take steps towards a contract, we rely on those pre-contract steps. For general enquiries or enquiries on behalf of a company, we rely on our legitimate interests in responding to prospective clients and operating our practice.

Accountancy and tax services

For services contracted with an individual or sole trader, we rely on contract where the processing is necessary to perform that agreement. When our contract is with a company or other organisation, we normally rely on our legitimate interests in delivering the agreed professional services for personal information about its directors, employees and other contacts. We rely on legal obligations where a specific duty applies to us.

Client identification and legal compliance

We rely on legal obligation to carry out mandatory anti-money laundering and counter-terrorist financing checks, maintain required records and make disclosures required by law. We do not rely on client consent for mandatory checks or reporting.

Business administration and security

We rely on our legitimate interests in managing client relationships, collecting fees, protecting our systems, preventing fraud and establishing or defending legal claims. We rely on legal obligation for records or disclosures that legislation requires us to maintain or make.

Website analytics and marketing

Where consent is required for cookies or similar technologies, we obtain it before using them. For qualifying statistical analytics used without consent under a PECR exception, we identify an appropriate UK GDPR basis, normally legitimate interests in improving the website. Marketing relies on consent or legitimate interests as appropriate, together with the separate PECR rules explained in Section 10.

When relying on legitimate interests, we assess necessity and balance our interests against your rights and reasonable expectations. You can object to this processing as explained in Section 12. Special category and criminal offence information also require the additional conditions described in Section 2.

Information needed to act for you

Some information is needed to enter into or perform our engagement, and identification information is required for mandatory client checks. If you do not provide the information needed, we may be unable to accept instructions, continue acting or complete the requested work. We will explain what is required and why. Optional information will be identified as such.

5. Who receives your information

We do not sell your personal information. Where necessary and lawful, we share relevant information with:

• HMRC, Companies House and other public authorities in connection with your instructions or a legal requirement.
• AAT, as our professional body and anti-money laundering supervisor, where required for supervision, compliance monitoring or investigations.
• The National Crime Agency, law-enforcement bodies, courts and other competent authorities where disclosure is required or otherwise lawful.
• Providers of accounting, payroll, identity verification, secure document storage, email, IT support, website hosting and analytics services.
• Professional advisers and professional indemnity insurers where needed for advice, insurance, complaints or legal claims.
• Other professionals, banks or lenders where you instruct us to share information or there is another appropriate lawful basis.

We limit disclosures to what is necessary. Where a supplier processes information on our behalf, we put appropriate contractual and security arrangements in place. Some recipients, such as public authorities and professional advisers, act as independent controllers. Legal restrictions may prevent us from telling you about certain disclosures.

Information collected for statutory anti-money laundering checks is subject to specific restrictions on further use. We do not use that information for unrelated purposes unless the law permits it or the required consent has been obtained.

6. Transfers outside the United Kingdom

Some service providers may store or access personal information outside the United Kingdom. This can include overseas support access as well as hosting. We check the arrangements applicable to our providers and use a lawful transfer mechanism where required.

You can contact us for more information about relevant transfers and to request a copy of the applicable safeguards, subject to appropriate redaction of confidential information.

7. How long we keep information

We keep personal information only for as long as needed for the purpose, taking account of legal duties, professional requirements and the need to handle disputes. Different parts of a client file can have different retention periods.

Client files and working papers

We normally retain ordinary client files and working papers for six years after the end of the financial year in which the relevant work was completed. Some records may need a different period because of the type of transaction or service, a continuing engagement, an enquiry, a dispute or a legal requirement. We review longer retention for continuing necessity. The separate rules below apply to AML information.

Anti-money laundering records

We normally retain customer due diligence records for five years after the business relationship ends, or after completion of an occasional transaction where applicable. Relevant transaction records are subject to the statutory rules, including the applicable ten-year limit for transaction records within a business relationship. At the end of the applicable period, we delete personal information obtained for these purposes unless a specific legal exception permits or requires further retention, such as a legal requirement, relevant legal proceedings or the individual’s consent.

Enquiries and website information

Enquiries that do not lead to an engagement are normally deleted 12 months after our last substantive contact, unless a specific legal or dispute-related reason requires longer retention.

Website analytics data is retained for 14 months. Security logs are retained for 12 months, or longer where needed to investigate a security incident. Cookie durations are explained in our cookie information. We keep the minimum information needed on marketing suppression lists to respect an opt-out for as long as necessary to prevent further unwanted marketing.

8. Cookies and similar technologies

Cookies and similar technologies store information on, or access information from, your device. Our cookie information explains the technologies actually used, their providers, purposes and durations, and the controls available to you.

Full details of the cookies we use are set out in our Cookie Notice.

Necessary technologies

We use technologies without consent where a legal exception applies, including those strictly necessary to provide a service you request or to transmit a communication. We do not treat a technology as strictly necessary simply because it is useful to our business.

Analytics and third-party content

Where consent is required, optional analytics and other non-exempt technologies remain disabled until you agree. Embedded reviews or other third-party content may disclose your IP address and device information to the provider when loaded. Where consent is required for associated storage or access technologies, these are blocked until you agree.

If we use analytics under the statistical purposes exception, we explain that use and provide a simple, free way to object. We only rely on this exception where all its conditions are met, including restrictions on identifying or tracking visitors and on the provider’s use of information.

Your choices

You can accept or refuse optional technologies and change or withdraw consent at any time through the “Cookie settings” link in our website footer. Refusing optional technologies does not prevent you from accessing the basic website, although content requiring them may remain unavailable. Browser settings can also be used to block or delete cookies, but do not replace the choices provided by our website.

9. How we protect information

We use technical and organisational measures appropriate to the nature of the information and the risks involved. These include appropriate access restrictions, secure systems, confidentiality arrangements and procedures for handling and disposing of records. We review our arrangements and restrict access to those who need it.

No internet transmission or storage system is completely secure. Please contact us to arrange a suitable method before sending identity documents, bank records or other sensitive information. We investigate suspected personal data breaches and notify the ICO and affected individuals where required by law.

10. Marketing communications

Service messages, such as requests for records and filing reminders relating to an engagement, are separate from promotional marketing. We use marketing contact information only where there is an appropriate lawful basis, and the relevant communication rules permit it.

We send marketing emails or texts to individuals, sole traders and relevant partnerships only with consent or where all applicable commercial soft opt-in requirements are met. Those requirements include obtaining contact details during a sale or negotiations for our services, marketing our own similar services, and offering an opt-out when details are collected and in every message.

For corporate subscribers, such as limited companies, prior consent is not generally required by PECR for marketing emails. Where personal contact information is used, we still require an appropriate UK GDPR basis and respect objections. We identify ourselves and provide a valid opt-out route in our marketing messages.

You can stop direct marketing at any time by using the unsubscribe method in the message or emailing tahir@fairaccountants.co.uk.  This does not stop essential communications about services you use.

11. Automated decisions

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on individuals.

12. Your data protection rights

Depending on the processing and the applicable legal conditions, you have rights to:

• Access your personal information and obtain a copy.
• Have inaccurate or incomplete information corrected.
• Request deletion of information in specified circumstances.
• Request restrictions on the use of your information.
• Receive certain information in a portable format, or have it transmitted to another controller where the conditions apply.
• Withdraw consent at any time where processing relies on it. Withdrawal does not affect processing that was lawful before withdrawal.

Your right to object

You can object to processing based on legitimate interests on grounds relating to your particular situation. We will consider your objection and stop the processing unless the law allows us to continue. You have an absolute right to object to the use of your personal information for direct marketing, including related profiling, at any time.

Making a request

Email tahir@fairaccountants.co.uk or use the contact details in Section 1. We may request proportionate information to verify your identity. Requests are normally free. A fee or refusal is only possible where the law allows it, and we will explain our reasons.

We respond without undue delay and normally within one month, subject to the legal rules on identity verification and any necessary clarification. Where permitted for complex or multiple requests, we may extend the period by up to a further two months and will explain the extension within the applicable time limit. Rights are subject to legal conditions and exemptions; for example, we may need to keep records to meet legal obligations.

13. Data protection complaints

If you are concerned about our use of personal information, please email tahir@fairaccountants.co.uk or contact us using Section 1. Please describe your concern and the outcome you are seeking. We provide a clear route for complaints and do not charge a fee to consider them.

We acknowledge data protection complaints within 30 days of receipt, subject to the applicable rules for calculating that period. We make appropriate enquiries, keep you informed of progress where appropriate and communicate the outcome without undue delay. Acknowledgement within 30 days does not necessarily mean the investigation will be completed within that period.

You also have the right to complain to the Information Commissioner’s Office (ICO). You do not need our permission to do so. The ICO generally recommends allowing the organisation to resolve the matter first.
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

14. Other websites and policy changes

Our website may link to third-party websites, including GOV.UK and Companies House. Those organisations explain their own processing in their privacy notices. Please review those notices when you use their services.

We review this policy and update it when our processing or legal requirements change. The publication date appears at the beginning. Where necessary, we will also bring material changes to your attention directly or by a prominent website notice.