Privacy Policy

About this policy

Fiscal Umbrella Accountants Ltd, company number 16315644, registered in England and Wales at Suite 2B, Crystal House, Luton LU1 1HS, is the data controller for the personal data described here. That means we decide what is collected and what happens to it. This policy covers data about our clients and the people who work for them, people who enquire about our services or answer the questions on our website, suppliers and contacts, and visitors to fiscalumbrella.co.uk. It takes effect from 17 October 2026 and applies to everything we do, online and off.

What personal data we collect

We collect data in three ways: you give it to us, our website records some of it automatically, or it reaches us from another organisation.

Information you give us

Your name, company name, email address, phone number and the details you share when you answer the questions on our site or speak to us. If you become a client we also hold the records needed to do the work: accounting records, bank and payment data, payroll and personal tax details, National Insurance and Unique Taxpayer Reference numbers, and the identity documents we are required to take under the money laundering regulations.

Information collected automatically

When you visit fiscalumbrella.co.uk our hosting and analytics tools record your IP address, approximate location, browser and device type, the pages you look at, how long you stay and the site or search that sent you. Some of this comes from cookies and similar technologies. Non-essential cookies are only set where you have agreed to them. Our cookie policy at /cookie-policy/ explains what is used and how to change your choice.

Information from third parties

We receive data about you from Companies House and other public registers, from HMRC when we act as your agent, from your previous accountant during a handover, and from the bookkeeping and marketplace systems you connect to us. Identity verification and sanctions screening services may also return results to us where the money laundering regulations require those checks before we start work.

Why we process your data

Every piece of personal data we hold sits under one of four lawful bases in the UK GDPR, and the basis we rely on depends on what the data is for.

To provide our services (Contract)

Once you engage us we process your data to do the work set out in the letter of engagement: bookkeeping, VAT returns, payroll, year-end accounts, corporation tax, the director’s personal tax and the advisory work that goes with them. Without this data we cannot prepare or file anything on your behalf.

To meet our legal obligations (Legal obligation)

We are required to verify client identity and keep those records under the Money Laundering Regulations 2017, to report where the law obliges us to, to file returns and accounts with HMRC and Companies House, and to keep our own books. These obligations continue after an engagement ends.

To run and improve our business (Legitimate interests)

We rely on legitimate interests to keep in touch with existing clients about related services, to protect our systems from fraud and misuse, to measure how the website is used, to manage billing and debt recovery, and to defend or bring legal claims. You can object to any of this at any time.

Where you have agreed (Consent)

We rely on consent for marketing emails to people who are not already clients and for non-essential cookies. You can withdraw consent whenever you like by using the unsubscribe link in any email, changing your cookie choice on the site, or emailing info@fiscalumbrella.co.uk. Withdrawing it does not affect processing that happened before.

Who we share your data with

We do not sell personal data, and we do not pass it to anyone for their own marketing.

Data is shared only where it is needed to do the work, where the law requires it, or where a supplier processes it on our instructions. Suppliers act under written contracts that limit them to the purpose we set and require them to keep the data secure.

HMRC and Companies House

We file VAT returns, payroll submissions, corporation tax returns, self assessment returns, accounts and confirmation statements on your behalf, and we correspond with HMRC as your agent on matters covered by your engagement.

Software providers

We use Xero, QuickBooks, A2X, Hubdoc and Dext for bookkeeping and record capture, along with cloud hosting, email, document storage and practice management systems. Each holds client data on our instructions under a processing agreement.

Professional advisers

Where a job calls for it, and normally with your knowledge, we share data with auditors appointed by you, solicitors, insurers, specialist tax advisers and the construction colleague who handles CIS and VAT clean-ups.

Regulatory and legal authorities

Our supervisory bodies, the ACCA and AAT, may inspect files as part of practice monitoring. We also disclose data to law enforcement, the National Crime Agency or a court where the law or a court order requires it.

International data transfers

Some of the software and hosting we use stores or processes data outside the United Kingdom, usually in the European Economic Area or the United States. Where data goes to a country the UK has recognised as providing adequate protection, that decision covers the transfer. Where it does not, we rely on the International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses, together with the supplier’s own security measures. You can ask us which suppliers hold data outside the UK and on what basis by emailing info@fiscalumbrella.co.uk.

How long we keep your data

We keep personal data for as long as the work and the law require, then delete it or strip out anything that identifies a person.

Client records

Accounting records, tax filings, correspondence and identity documents are kept for at least six years after the engagement ends, in line with the Money Laundering Regulations 2017. Some tax records are held for seven years where HMRC time limits make that sensible.

Enquiry data

If you answer the questions on our site or contact us and we do not go on to work together, we keep what you sent for up to 24 months from your last contact with us, then delete it or remove anything that identifies you.

Website analytics

Analytics data tied to a device or visit is kept for up to 26 months, after which it is deleted or held only in aggregate form that cannot be linked back to an individual visitor. Server logs are kept for a shorter period for security purposes.

Marketing consent records

Where you have agreed to marketing we keep a record of that agreement for as long as it is active and for two years after you withdraw it or we stop contacting you, so we can show when and how consent was given.

Your rights

These are statutory rights under the UK GDPR, and they apply whether you are a client, a former client or someone who simply visited the site. Some of them depend on the lawful basis we are relying on, and we will tell you if one does not apply to your request.

Right to be informed

You can know what we collect, why we collect it, who we share it with and how long we keep it. This policy is how we set that out, and we will answer follow-up questions in plain terms.

Right of access

You can ask for a copy of the personal data we hold about you and the reasons we hold it. Send a subject access request to info@fiscalumbrella.co.uk and we will respond within one month.

Right to rectification

If something we hold about you is wrong or out of date, tell us and we will correct it. Where we have passed the data to someone else, we will let them know about the correction where that is possible.

Right to erasure

You can ask us to delete your data. We cannot delete records we are required to keep under the money laundering regulations or tax law, and we will explain what must stay and why.

Right to restrict processing

You can ask us to pause what we do with your data, for instance while a dispute about its accuracy is sorted out. We will keep the data but stop using it beyond storage until the question is settled.

Right to data portability

Where we process data you gave us by consent or under a contract, and we do it by automated means, you can ask for it in a common machine-readable format or ask us to send it to another provider.

Right to object

You can object to processing we base on legitimate interests, and we will stop unless we have compelling grounds to continue. If you object to direct marketing we stop straight away, with no questions asked.

Rights related to automated decision-making

We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal or similarly significant effects. Every decision about your work involves a person at this firm.

How to exercise your rights

Email info@fiscalumbrella.co.uk and say what you want us to do. We may ask for proof of identity before we release or change anything, which protects you as much as us. We will respond within one month of receiving your request and of confirming who you are. Complex requests can take up to a further two months, and we will tell you if that applies. There is no charge in ordinary cases.

How we protect your data

Data moving between you and our website or portals is encrypted using HTTPS, and the systems we use encrypt data at rest. Access is limited to the people who need it for their work, with individual accounts and multi-factor authentication on our main systems. Records are backed up, and devices are password protected and kept up to date. Fasih and anyone working on client files follow confidentiality obligations under ACCA and AAT rules, and we review our arrangements and our suppliers’ arrangements from time to time. If a breach happens that risks your rights, we will report it to the ICO within 72 hours and tell you where the law requires it.

Cookies

Our site uses essential cookies that make it work, and analytics cookies that tell us which pages people read. Analytics and any marketing cookies are only set once you have agreed. You can change or withdraw your choice at any time. Full detail of what is used sits in our cookie policy at /cookie-policy/.

Children’s data

We work with limited companies and their directors, so our services and this website are meant for adults in business. We do not knowingly collect personal data from anyone under 18. If you believe a child’s data has reached us, email info@fiscalumbrella.co.uk and we will delete it.

Changes to this policy

We update this policy when our systems, suppliers or legal obligations change. The last reviewed date at the top of the page always shows the current version. Where a change materially affects how we handle client data, we will tell existing clients by email rather than relying on you to check.

How to contact us

One address handles every data question.

Send data protection questions, subject access requests, corrections and objections to the email below and address them to Fasih Khan, who handles data protection for the firm. Phone and WhatsApp are fine for a first conversation, though written requests are easier to track.

Data queries: info@fiscalumbrella.co.uk. Response within 1 month under UK GDPR. Data controller: Fiscal Umbrella Accountants Ltd, Suite 2B, Crystal House, Luton, Bedfordshire LU1 1HS, United Kingdom. Companies House 16315644. ICO registration number ZC195564.

Complaints to the ICO

If you are unhappy with how we have handled your data or your request, tell us first and we will look at it again. You also have the right to complain to the Information Commissioner’s Office at any time. You can reach them at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by phone on 0303 123 1113, or online at https://ico.org.uk/make-a-complaint/. Complaining to the ICO does not affect any other legal remedy available to you.