PRIVACY NOTICE

Shires Accountants Limited

Registered in England and Wales, company number 13932529. AAT licence number 1005505. ICO registration number ZB324675.

  1. About this notice

This notice explains how Shires Accountants Limited collects, uses, shares and protects personal data, and what rights you have. It applies to our clients, and to other individuals whose personal data reaches us in the course of our work.

We process personal data in accordance with the United Kingdom General Data Protection Regulation, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

This notice is issued with our engagement letter and should be read alongside our Standard Terms of Business.

  1. Who we are and how to contact us

Shires Accountants Limited is an accountancy and tax advisory practice. Our registered office and trading address is as follows.

Shires Accountants Limited

Suite G30 Genesis Centre

Innovation Way

Stoke-on-Trent

Staffordshire

ST6 4BF

 

We are not required to appoint a statutory Data Protection Officer. Paul Millard, Director, is our contact point for all data protection matters. You can reach him by email at paul.millard@shiresaccountants.co.uk, by post at the address above, or by telephone on 01270 820273 or 01782 345400.

We are registered with the Information Commissioner’s Office under registration number ZB324675.

  1. When we are a controller and when we are a processor

3.1  For most of our work we are a controller. This means that we decide why and how personal data is processed. We are a controller when we prepare accounts and tax returns, give advice, carry out client due diligence under the Money Laundering Regulations 2017, keep our client records, and invoice and collect our fees. We act as a controller in our own right and not on your instructions, because we have our own professional, regulatory and legal obligations to meet.

3.2  For payroll we are a processor. Where we operate a payroll for you, the personal data of your employees belongs to you. You are the controller of it and we process it on your instructions. That relationship is governed by a separate data processing schedule which forms part of your payroll engagement. Where we act as a processor, this notice explains our general approach, but the schedule governs what we do with the data.

3.3  Where we act as a processor, we will delete or return all personal data to you at the end of the engagement, as agreed with you and as set out in the schedule.

  1. Whose personal data we hold

We hold personal data about the following people.

  • Our clients, and where a client is a business, its directors, members, partners, shareholders and beneficial owners.
  • People connected with our clients whose details are needed for the work, such as spouses, civil partners and family members named in tax returns.
  • Employees, workers, subcontractors and pension scheme members of our clients, where we operate a payroll or a Construction Industry Scheme return.
  • People who contact us to enquire about our services.
  • Suppliers and other professional contacts.

Where you are not our client but your personal data reaches us because of work we do for someone else, sections 5 to 13 of this notice still apply to you. In most cases we will have received your data from our client.

  1. What personal data we hold and where it comes from

The personal data we hold depends on the work we do. It may include your name, date of birth, contact details, National Insurance number, tax references, employment and income details, bank details, details of assets and liabilities, and copies of identification documents.

We obtain personal data from the following sources.

  • From you directly, in correspondence, meetings, portals and documents you send us.
  • From our client, where you are an employee, director, beneficial owner or family member of that client.
  • From HM Revenue and Customs, Companies House and other public registers.
  • From your previous adviser, on a professional handover.
  • From electronic identity verification and screening services, as described in section 8.
  1. Why we process personal data

We process personal data for the following purposes.

  • To provide the professional services set out in our engagement letter.
  • To meet our obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, including client due diligence, ongoing monitoring, screening and reporting.
  • To meet our professional obligations as a licensed member of the Association of Accounting Technicians, including practice assurance review.
  • To invoice for our services, to collect our fees, and to deal with any fee dispute.
  • To investigate or defend complaints, disciplinary proceedings and legal proceedings.
  • To maintain and improve our records, systems and services.
  • To tell you about other services we provide, where you have agreed to receive that information.
  1. Our legal bases

We rely on the following legal bases.

  • Performance of a contract, so that we can deliver the services you have engaged us to provide.
  • Compliance with a legal obligation, for example our obligations under the Money Laundering Regulations 2017 and under tax legislation.
  • Our legitimate interests, which include recovering debts owed to us, investigating and defending claims, keeping our client records accurate, protecting the practice against fraud, and managing and developing our business. We balance those interests against your rights before we rely on this basis.
  • Your consent, which we rely on only where we have asked you and you have agreed, for example before sending you information about other services.

If you do not provide information we request, we may be unable to provide professional services to you, and we may be unable to start acting or may have to cease to act.

  1. Special category data and criminal offence data

8.1  Some of the data we handle needs extra protection.

8.2  We process health data where we operate statutory sick pay, statutory maternity pay, statutory adoption pay and statutory paternity pay through a payroll, and we may process trade union membership data where subscriptions are deducted through a payroll. We rely on the condition in the United Kingdom General Data Protection Regulation permitting processing necessary for carrying out obligations in the field of employment law, together with the corresponding condition in Schedule 1 to the Data Protection Act 2018.

8.3  We process criminal offence data where our screening checks identify sanctions listings, politically exposed persons or adverse information, and where we consider whether a report is required under the Money Laundering Regulations 2017. We rely on the conditions in Schedule 1 to the Data Protection Act 2018 relating to the prevention and detection of unlawful acts and to regulatory requirements.

8.4  We hold an Appropriate Policy Document explaining how we comply with the data protection principles in relation to this data and how long we keep it. A copy is available on request.

  1. Electronic identity verification and automated decision making

9.1  We use an electronic identity verification service, BrightChecks, to help us meet our obligations under the Money Laundering Regulations 2017. The service checks the information you give us against databases and returns an indicative result.

9.2  A search of this kind leaves a record with the service provider. It is not an application for credit and it does not affect your credit rating.

9.3  The result produced by the service is not a decision. Every result is reviewed by us, and we decide whether to accept you as a client, to request further evidence, or to decline to act. No decision which produces legal effects for you, or which similarly significantly affects you, is taken solely by automated means.

9.4  We do not carry out profiling.

  1. Who we share personal data with

We may share personal data with the following.

  • HM Revenue and Customs and Companies House.
  • Any third party with whom you ask or permit us to correspond, including your solicitor, bank, lender, financial adviser or previous adviser.
  • Subcontractors and service providers who assist us in delivering our services.
  • Providers of the software we use, including our practice management, accounting, tax, payroll and portal systems.
  • Our electronic identity verification and screening provider.
  • Our professional indemnity insurers, AXA Insurance UK plc, and our insurance broker.
  • Our fee protection insurer, where you have taken that service. We hold a practice policy and we do not register clients individually with the insurer, so your details reach them only if a claim relating to you is submitted.
  • The Association of Accounting Technicians, and the Office for Professional Body Anti-Money Laundering Supervision, in connection with practice assurance and the requirements of the Money Laundering Regulations 2017.
  • The practice with which we hold our continuity of practice arrangement, if that arrangement is brought into effect.
  • Our own professional advisers, including our solicitors and accountants.

Where the law allows or requires us to do so, we may also share personal data with the National Crime Agency, the police and other law enforcement agencies, courts and tribunals, and the Information Commissioner’s Office.

We may be prohibited by law from telling you that we have made a report under the Money Laundering Regulations 2017, or that we are considering doing so.

We do not sell personal data, and we do not share it for the marketing purposes of any other organisation.

  1. Transfers outside the United Kingdom

11.1  Some of the subcontractors and service providers we use are located outside the United Kingdom, and personal data we hold may therefore be transferred outside the United Kingdom.

11.2  Where a transfer is to a country covered by United Kingdom adequacy regulations, we rely on those regulations. Where it is not, we put in place an International Data Transfer Agreement, or the United Kingdom Addendum to the European Commission standard contractual clauses, together with any additional measures needed to protect the data.

11.3  We review these arrangements regularly. You can ask us which countries are involved and what safeguards apply.

  1. How long we keep personal data

12.1  We keep correspondence, working papers and other records for seven years from the end of the accounting period or tax year to which they relate, after which we may destroy them. We may keep for longer any document we consider to be of continuing significance, such as details of capital gains base costs and of claims and elections submitted to HM Revenue and Customs, because that information can be needed many years later.

12.2  After our engagement ends, we retain your records for seven years on the same basis. We may destroy any original documents we have been unable to return to you six months after termination, unless law or regulation requires otherwise.

12.3  Records obtained for the purposes of client due diligence under the Money Laundering Regulations 2017 are kept for five years from the end of our business relationship with you, after which we delete them unless we are required or permitted to keep them for another purpose, such as ongoing legal proceedings.

12.4  Where we act as a processor, retention is governed by the data processing schedule.

12.5  You are responsible for retaining the information we send you. The law requires you to keep records relevant to your tax affairs for the following minimum periods.

  • Individuals, trustees and partnerships with trading or rental income: five years and ten months after the end of the tax year.
  • Individuals, trustees and partnerships without such income: 22 months after the end of the tax year.
  • Companies, limited liability partnerships and other corporate entities: six years from the end of the accounting period.
  1. How we protect personal data

13.1  We take appropriate technical and organisational measures to keep personal data secure. These include controlled access to our systems, encryption of data both in transit and at rest, regular backups, and due diligence on the providers of the software and services we use.

13.2  We send confidential documents to you through our secure client portal rather than by email. We will only send confidential documents by unencrypted email where you have specifically asked us to do so and have confirmed that you are content for us to send them in that way. Email is not a secure method of communication and we would encourage you to use the portal.

13.3  Where we use artificial intelligence tools to assist in delivering our services, we do not input confidential information or personal data into any tool which does not provide appropriate safeguards for confidentiality and data protection, and every output is reviewed by us before use.

  1. Your rights

You have the following rights in relation to your personal data. Some of them apply only in certain circumstances, and further information is available at www.ico.org.uk.

  • The right to be informed about how we use your personal data, which this notice provides.
  • The right of access to the personal data we hold about you. Section 15 explains how to make a request.
  • The right to have inaccurate personal data corrected, and incomplete personal data completed. Please tell us as soon as you become aware of anything that is wrong.
  • The right to have personal data erased. We may be unable to comply where we have a legal or regulatory reason to keep it, and we will tell you if that is the case.
  • The right to restrict processing, and the right to object to processing.
  • The right to data portability, which applies to data you have provided to us where we process it by automated means on the basis of consent or of a contract.
  • The right to withdraw consent, where we rely on consent.
  • The right to complain, which section 17 explains.

We will respond to a request to exercise any of these rights without undue delay and within one month. We may extend that period by up to a further two months where a request is complex or where we receive a number of requests, and we will tell you within one month if we need to do so and why.

  1. Making a subject access request

15.1  You can ask us for a copy of the personal data we hold about you. This is known as a subject access request. You can make it in any way you choose, including verbally, and you do not have to use a particular form of words or mention data protection law. We would find it helpful to receive requests in writing, but we will not refuse a request made in any other way.

15.2  To help us respond quickly, please tell us what information you are looking for, and any detail that will help us find it, such as the period it relates to or the service it concerns.

15.3  Where we are not sure of your identity, we may ask you for information to confirm it. We will only ask for what is reasonably necessary and proportionate in the circumstances, and we will not ask at all where we already know who you are.

15.4  If we need to ask you to clarify your request, the time limit is paused until you reply.

15.5  You may ask someone else, such as a relative or solicitor, to make a request on your behalf. We will need your written authority before we respond to them.

15.6  In limited circumstances the law allows us to refuse a request, or to charge a reasonable fee. If that applies we will explain why.

15.7  Where you are a controller and we act for you as a processor, we will assist you with requests made to you, as set out in the data processing schedule.

  1. Withdrawing consent

Where we rely on your consent, you can withdraw it at any time by telling us. Please note that withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it, that we may be unable to continue providing a service which depended on your consent, and that we may still be permitted or required to process your data on another legal basis.

  1. Complaints about how we use your personal data

17.1  If you are unhappy with how we have handled your personal data, or with our response to a request, you have the right to complain to us. We would rather hear from you than not.

17.2  You can complain in whatever way suits you, including by email to paul.millard@shiresaccountants.co.uk, by post to the address in section 2, or by telephone on 01270 820273 or 01782 345400. We will accept a complaint however it reaches us.

17.3  We will acknowledge your complaint within 30 days of receiving it. We will make reasonable enquiries into it, keep you informed of progress, and tell you the outcome without undue delay.

17.4  We keep a record of the complaints we receive and how they were resolved.

17.5  You also have the right to complain to the Information Commissioner’s Office at any time, whether or not you have complained to us first. The Information Commissioner’s Office can be contacted at www.ico.org.uk or on 0303 123 1113.

17.6  A complaint about the service we have provided, rather than about personal data, is dealt with under our Complaints Policy and Procedure, which is available on request.

  1. Cookies

18.1  Cookies are small files placed on your device when you visit a website.

18.2  Our website does not set any cookies of its own. We do not use analytics cookies, advertising cookies or any other form of tracking, and we do not build a profile of your visit or follow you across other websites.

18.3  Some pages may include content hosted by other organisations. Content of that kind can place cookies on your device, and we have no direct control over those cookies. You can block or delete cookies at any time through your browser settings.

18.4  If we introduce cookies which are not strictly necessary, we will ask for your consent before setting them and we will update this notice.

  1. Changes to this notice

We may amend this notice from time to time. The current version is always available on our website and on request, and we will provide a copy of any amended version to clients.

This notice was last updated on 23rd September 2026.