Privacy Policy

Stava Accountancy Ltd ("we", "us", "our") respects your privacy. This policy explains what personal data we collect, why we collect it, how we look after it and what rights you have. It applies to visitors to this website, people who contact us, and our clients and their representatives.

We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Stava Accountancy Ltd is the data controller for the personal data described in this policy. This means we decide how and why your data is used.

• Registered office: 48 Basepoint Business Centre, Rivermead Drive, Swindon, Wiltshire SN5 7EX
• Registered in England and Wales, company number: 09822922
• Registered with the Information Commissioner's Office (ICO), registration number: ZA207541

For any questions about this policy or your personal data, email steve@stavaaccountancy.co.uk or call +44 1793 205288.

2. Personal data we collect

If you contact us

When you phone us, email us or use the contact form on this website, we collect your name, email address, phone number (if you give it) and anything you tell us about your enquiry. Messages sent through the form are delivered to our Microsoft 365 mailbox.

If you become a client

To provide our services and meet our legal obligations, we may collect:

• Identity data: name, date of birth, National Insurance number, Unique Taxpayer Reference (UTR) and copies of identity documents such as a passport or driving licence.
• Contact data: address, email address and telephone numbers.
• Financial data: bank details, income, expenses, invoices, receipts, payroll information, pension details and tax records.
• Business data: details of directors, shareholders, partners and employees where this relates to the work we do for you.
• Correspondence: records of our communications with you and with HMRC or other bodies on your behalf.

Most of this data comes directly from you. We may also receive data from HMRC, Companies House, your previous accountant, your bank or accounting software (with your permission), and identity verification and credit reference agencies.

3. How we use your data and our lawful bases

We only use your personal data where the law allows us to. The table below sets out what we use it for and the lawful basis we rely on under Article 6 of the UK GDPR.

Where we rely on legitimate interests, we have considered your rights and are satisfied that they do not override our interests. We do not sell your data and we do not use it for automated decision-making or profiling.

If you don't provide data that we need for legal or contractual reasons, we may not be able to act for you.

4. Special category and criminal offence data

We do not usually need special category data, such as information about your health. Sometimes it is relevant to your tax affairs, for example a disability-related allowance or a claim based on medical circumstances. In those cases we process it only where it is necessary to establish, exercise or defend legal claims, or with your explicit consent. Anti-money laundering checks may occasionally reveal criminal offence data. We handle this only as required by law.

5. Who we share your data with

We share personal data only where necessary, and only with:

• HMRC, Companies House and other government bodies, when we file returns or deal with them on your behalf.
• Software and service providers who help us run the practice, such as cloud accounting, payroll, practice management, email, IT support and secure document storage providers. They act on our instructions under written contracts.
• Identity verification providers used for anti-money laundering checks.
• Cloudflare, which provides the Turnstile check on our contact form to stop spam (see section 10).
• Our professional body, regulators and insurers, where required for monitoring, compliance or insurance purposes.
• Law enforcement and other authorities where the law requires us to share data, such as reporting suspicions of money laundering to the National Crime Agency.
• Other professional advisers, such as your solicitor or financial adviser, but only with your permission.
• A future owner if our business is sold or merged, under the same protections set out in this policy.

6. International transfers

Some of our software providers may store or access data outside the UK. When this happens we make sure your data is protected. Either the destination country is covered by UK "adequacy regulations", or the transfer is covered by the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. How long we keep your data

We keep personal data only for as long as we need it:

• Enquiries that don't lead to work: up to 12 months.
• Client records and working papers: 6 years after the end of the tax year or accounting period they relate to, or after our engagement ends, whichever is later. This reflects HMRC and Companies Act record-keeping requirements and legal limitation periods.
• Anti-money laundering records: 5 years after our business relationship ends, as required by the Money Laundering Regulations 2017.

After these periods we delete your data securely or anonymise it, unless we have to keep it longer for legal reasons.

8. How we protect your data

We use appropriate technical and organisational measures to keep your data safe. These include encrypted and password-protected systems, multi-factor authentication, access only for staff and suppliers who need it, and secure methods for exchanging documents. If a personal data breach is likely to put your rights at risk, we will tell you and, where required, the ICO within 72 hours.

9. Your rights

Under the UK GDPR you have the right to:

• Access your personal data and receive a copy (a "subject access request").
• Rectification: ask us to correct data that is inaccurate or incomplete.
• Erasure: ask us to delete your data where we no longer have a lawful reason to keep it.
• Restriction: ask us to limit how we use your data.
• Data portability: receive data you gave us in a structured, machine-readable format, or have it sent to another organisation.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, where we rely on consent.

Some rights don't apply in every situation. For example, we can't delete records that the law requires us to keep. To use any of these rights, contact us using the details below. It is free, and we will reply within one month. We may need to confirm your identity first.

10. Cookies and this website

This website does not use analytics, advertising or tracking cookies.

Our contact form uses Cloudflare Turnstile to check that messages come from people rather than automated spam. To do this, Cloudflare processes technical information such as your IP address and details about your browser and device. It uses this information only to provide the check and keep the service secure, not for advertising. We rely on our legitimate interests in protecting our website and inbox from abuse. See the Cloudflare Turnstile Privacy Addendum for details.

The site uses fonts from Google Fonts. When a page loads, your browser connects to Google's servers, which receive your IP address. Google's use of that data is covered by the Google Privacy Policy. The site is hosted on Microsoft Azure, which keeps standard server logs, including IP addresses, for security and operational purposes.

11. Complaints

If you have a concern about how we handle your data, please talk to us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

12. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.