Privacy Policy

Last updated: 4 November 2026

This privacy policy explains how CJC Accountancy Ltd collects, uses, shares and protects personal information. It covers people who visit our website, contact us, request a quote, book a consultation, buy our Simple Self Assessment service or become our clients, and people whose information we receive in the course of our work.

1. Who we are

CJC Accountancy Ltd ("CJC", "we", "us") is the controller of the personal information described in this policy.

• Registered in England and Wales, company number 11819511.

• Registered office: 124 City Road, London, EC1V 2NX.

• Registered with the Information Commissioner's Office (ICO), registration reference ZA521061.

• An accountancy practice licensed by the Association of Accounting Technicians (AAT), which is also our anti-money laundering supervisor.

• An Authorised Corporate Service Provider (ACSP) for Companies House identity verification.

For any question about this policy or your personal information, email info@cjcaccountancy.co.uk or call 01277 295725. Our director, Chris Clark FMAAT, deals with all privacy enquiries personally.

2. The information we collect

We collect information you give us directly, and information that we receive or create while working for you.

• Enquiries and quote requests. Your name, email address, phone number (if given), the services you are interested in, and anything else you tell us in our website forms, by email or by phone.

• Consultation bookings. Your name, email address and phone number, the date and time of your appointment, your answers to our booking questionnaire (for example the area of tax, your question and any relevant deadline), any booking terms and declarations you accept (with the date and time you gave them), and the video meeting details created for your appointment.

• Simple Self Assessment. Your answers in our quotation request form, which we use to check whether your return is suitable for the fixed fee. If we invite you to pay, the details you enter at our website checkout: your name, email address and billing address, your phone number if you choose to give it, and the name and email address you used for your quotation request (which you give in our short order-details form, so that we can match your payment to your request). We also keep the order details, such as the service, price, date and order number, and the payment status.

• Payments (consultations and Simple Self Assessment). Payment amount, date and status, and any refund. Your card details are entered into, and processed by, our payment provider (Stripe). We do not see or store your full card number.

• Client engagements and onboarding. The information you give us when we set up your engagement (for example in our client intake form); contact details; identity and verification records; tax references; income, expenses, assets and other financial information; employment, pension and payroll information; business and company records; and the correspondence, computations, returns and accounts we prepare for you.

• Identity checks. Copies of identity documents such as passports and driving licences, proof of address, and, for companies and other entities, information about their owners, directors and controllers (see section 4).

• Information about other people. Details of other individuals relevant to your affairs, such as a spouse, employees, directors or shareholders. If you give us someone else's information, please make sure they are aware of this policy.

• Our website. Technical information such as your IP address, browser and device details, the pages you visit and the website that referred you. This is recorded by our website platform and its security tools. If you agree to analytics cookies, we also collect information about how you use our website using Squarespace Analytics and Google Analytics (see section 10).

We ask you not to send tax reference numbers or documents through our website forms or the booking questionnaire. If we need supporting records, we will ask you for them during the engagement.

Information about people who are not our clients

In the course of our work, we receive information about people other than our clients, such as employees, spouses or partners, directors, shareholders and beneficial owners. We usually receive it from our client, from public registers such as Companies House, or from HMRC.

We use it only to provide the services our client has engaged us for, and to meet our legal obligations, as described in this policy. We ask our clients to let the people concerned know that they share their information with us, and to point them to this policy.

Where we deal with someone directly, for example a director whose identity we verify, we give them this policy at first contact. Otherwise we consider, case by case, whether we need to tell the person ourselves or whether an exemption applies: for example, where telling them would involve disproportionate effort, where the law requires us to obtain or disclose the information, or where the information is subject to professional confidentiality. Anyone whose information we hold has the rights set out in section 11.

3. How we use your information and our lawful bases

Data protection law requires a lawful basis for each use of personal information.

• Responding to enquiries and preparing quotations. Taking steps at your request before entering into a contract. Where the enquiry is made on behalf of someone else, our legitimate interests in responding to business enquiries.

• Checking whether a Simple Self Assessment return is suitable for the fixed fee, taking payment, and refunding it in full if we cannot act or the engagement does not go ahead. Taking steps at your request before entering into a contract; performance of a contract; legal obligation (accounting records).

• Arranging and delivering consultations, including the video call and the written follow-up summary. Performance of a contract with you.

• Keeping a record of the booking terms and declarations you accepted. Legal obligation (consumer contract rules); our legitimate interests in being able to show what was agreed.

• Taking payment and keeping our own accounting records. Performance of a contract; legal obligation (tax and company law record keeping).

• Providing accountancy, tax, payroll and bookkeeping services. Performance of a contract with our client. Where the information is about someone other than our client (for example employees or shareholders), our and our client's legitimate interests in delivering the service, or a legal obligation.

• Customer due diligence and other anti-money laundering checks. Legal obligation.

• Companies House identity verification as an Authorised Corporate Service Provider. Legal obligation, and performance of a contract where you have asked us to verify your identity.

• Filings and correspondence with HMRC, Companies House and other authorities. Performance of a contract (filings you authorise); legal obligation (disclosures required by law).

• Meeting professional and regulatory requirements. Legal obligation; our legitimate interests in meeting the standards of our professional body.

• Keeping records to deal with queries, complaints or legal claims. Our legitimate interests in protecting our business and responding to claims; legal obligation where a retention period is set by law.

• Running and protecting our website and forms, including preventing spam and abuse. Our legitimate interests in operating a secure, working website.

• Website analytics (Squarespace Analytics and Google Analytics). Your consent, which you can withdraw at any time through "Cookie settings" on our website.

Our website platform, Squarespace, also processes some technical information for its own purposes, such as delivering, securing and monitoring the performance of its platform (see section 10b).

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights. You can ask us for more information.

Special category and criminal offence information

Most of the information we use is ordinary personal and financial information, such as income, employment, tax and company records. This is protected by data protection law, but it is not "special category" information.

Data protection law gives extra protection to special category information. This means information about:

• health, including disability;

• racial or ethnic origin;

• religious or philosophical beliefs;

• political opinions;

• trade union membership;

• sex life or sexual orientation;

• genetic data, and biometric data used to identify someone.

We do not ask for special category information unless it is relevant to the work you ask us to do. Some tax and accounting matters can involve it. For example:

• information about health or disability may affect a tax relief or allowance, the tax treatment of a payment, or a trust set up for a disabled or vulnerable person;

• it may also be relevant where someone acts for another person, for example under a power of attorney;

• in estate and trust matters, we may receive information about the person who has died or about beneficiaries.

Where we need to use special category information, we will:

• use only what is needed for the specific task;

• have a lawful basis under Article 6 of the UK GDPR (see the table above);

• have a condition under Article 9 of the UK GDPR and the Data Protection Act 2018, which we identify for the particular circumstances before we use the information. Depending on the circumstances, this may be your explicit consent, or another condition, such as where the information is needed to establish, exercise or defend legal claims. We do not rely on consent where another condition is more appropriate, and we will tell you which condition applies if you ask;

• keep it with our other confidential client records, under the measures described in section 8, and only for as long as we need it.

If we receive special category information that we did not ask for and do not need, we will not use it. We will delete it or return it to you, unless the law requires us to keep it.

Information about criminal convictions and offences has separate legal protection. We do not ask for it as part of our normal services. If it becomes relevant, for example during our anti-money laundering checks or because it affects a tax matter you ask us to deal with, we will use it only where the law allows us to, under Article 10 of the UK GDPR and the Data Protection Act 2018.

4. Anti-money laundering and identity verification

Anti-money laundering checks

As an accountancy service provider supervised by the AAT, we must comply with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. Before we act for you, and while we continue to act, we must:

• identify you and verify your identity;

• for a company or other entity, verify its details and identify its beneficial owners, taking reasonable measures to verify their identity and understand its ownership and control;

• understand the purpose and intended nature of our work for you, and keep our information up to date.

We carry out these checks ourselves. We ask you for identity documents, such as a passport or driving licence, which we examine personally, and we keep copies of the relevant documents on file. Where appropriate, as part of these checks, we use TaxCalc's anti-money laundering search service to screen against sanctions lists, lists of politically exposed persons and their relatives and close associates, and other watchlists.

Any personal information we obtain for these purposes will be processed only to prevent money laundering, terrorist financing or proliferation financing, unless another law permits a different use or you consent to it.

Companies House identity verification

We are an Authorised Corporate Service Provider (ACSP). If you ask us to verify your identity for Companies House, for example as a company director or person with significant control, we collect the information and documents required by the Companies House identity verification standard. We then confirm the outcome to Companies House. This is a separate legal process from our anti-money laundering checks, with its own record-keeping rules (see section 7).

5. Who we share your information with

We do not sell personal information.

HMRC, Companies House and other authorities. With your authority, we submit returns, accounts and filings on your behalf and correspond with authorities about them. This includes:

• Self Assessment, Corporation Tax and VAT returns;

• payroll Real Time Information submissions;

• Companies House filings that form part of our business accountancy services, such as statutory accounts;

• Companies House identity verification.

Separately, we may have to disclose information without your authority where the law requires it. Examples are a reporting obligation under anti-money laundering law, or a lawful request from HMRC, a regulator, the police or a court.

Our professional body. The AAT may review our files as part of its supervision and monitoring of our practice.

Service providers. We use the following providers to run our practice. They handle information on our behalf under contract, except where stated.

• Microsoft 365, supplied through 123 Reg. Business email and calendar (Outlook), client document storage (OneDrive for Business), and collecting documents from clients through OneDrive file-request links (see section 8). Consultation appointments booked online are copied automatically to our Outlook calendar. 123 Reg also registers our domain name.

• Squarespace. Our website, website forms, contact records, our website checkout (Squarespace Commerce) and website statistics (Squarespace Analytics).

• Acuity Scheduling (part of Squarespace). Online appointment booking, the booking questionnaire and any booking declarations, and appointment emails. Acuity passes the appointment details needed to create the video meeting to Zoom, and copies the appointment to our Outlook calendar.

• Zoom (Zoom Communications, Inc.). Hosting the video call for consultations. When you book, a unique meeting with a passcode and waiting room is created for your appointment; it is updated if you reschedule and removed if the appointment is cancelled. Zoom processes the information needed to run the call, such as the name you join with, your IP address and device details, and meeting times. We do not record consultations, and we have switched off Zoom's recording, transcription and AI summary features for our meetings.

• Stripe. Processing card payments: for consultations (through Acuity) and for Simple Self Assessment (through our website checkout). Stripe also uses payment information as an independent controller for fraud prevention and to meet its own legal obligations.

• Google. Google Analytics: if you accept analytics cookies, Google Analytics collects information about your visit on our behalf, so we can see how our website is used and improve it (see section 10a). Google reCAPTCHA protects our website forms and booking page from spam and abuse.

• TaxCalc. Preparing and filing tax returns. We also use TaxCalc's anti-money laundering search service, where appropriate, for client due diligence checks (see section 4).

• Xero and QuickBooks Online (Intuit). Accounting software we use for clients. Intuit's terms state that it acts as a controller for some of the information processed in QuickBooks Online, under its own privacy statement.

We may also share information with our professional advisers or insurers where necessary, and with a successor business if our practice is sold or transferred.

6. International transfers

Some of our service providers, or their sub-processors, may process personal information outside the UK, for example in the United States, Australia or New Zealand.

When personal information is transferred outside the UK, it is protected by one of the safeguards recognised under UK data protection law. Each provider relies on its own safeguard:

• UK adequacy regulations. The UK has recognised some countries as providing adequate protection. These regulations also cover US organisations certified under the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge").

• Approved contract terms. These are the International Data Transfer Agreement, or the European Commission's standard contractual clauses with the UK Addendum.

You can ask us for more information about the safeguard that applies to a particular provider.

7. How long we keep your information

We keep personal information only for as long as we need it, and for any period required by law or by our professional obligations.

• Enquiries that do not lead to work, and related correspondence. Up to 12 months after our last meaningful contact.

• Simple Self Assessment requests that do not lead to an engagement (including refunded payments). Enquiry details and associated correspondence: up to 12 months after our last meaningful contact. Payment and refund accounting records: 6 years from the end of the accounting period in which the transaction occurred, subject to any longer applicable statutory, professional or legal requirement.

• Paid consultations: booking records, questionnaire answers, booking declarations, contract and payment records, correspondence, consultation notes and the written summary. 7 years after the consultation.

• Video meeting information held by Zoom. Zoom keeps basic meeting information, such as meeting times and participants, under its own retention policies. There are no recordings or transcripts, because we do not record consultations.

• Client records: tax returns, accounts, computations, working papers and correspondence. 7 years after our engagement ends.

• Anti-money laundering records: identity documents and due diligence information. 5 years after our business relationship ends (or after a one-off transaction is completed), as required by the Money Laundering Regulations 2017. We then delete the personal data unless another law requires us to keep it, it is needed for legal proceedings, or you consent.

• Companies House identity verification records. 7 years from the date the verification was completed, as required for Authorised Corporate Service Providers.

• Website statistics and analytics. Squarespace's aggregated statistics: kept by Squarespace under its own policies. Google Analytics: detailed event data is kept for 2 months, and data linked to a visitor's random identifier for up to 14 months. The 14-month period restarts if the same browser visits again. After these periods the detailed data is deleted from Google Analytics. Our summary reports, such as monthly visitor numbers, are not affected by these settings.

These are our normal periods. We may keep information for longer where the law requires it, or where it is reasonably needed for an ongoing enquiry, complaint, dispute or legal claim.

We assess the personal information we retain in accordance with our retention periods and applicable legal and professional obligations. When information is no longer required, we take appropriate steps to securely delete or dispose of it, subject to any continuing retention requirements. Some copies may remain for a limited time in our providers' backups or deleted-item folders before they are permanently removed.

8. Keeping your information secure

Consultations take place in Zoom meetings that are unique to each appointment, protected by a passcode and a waiting room, and that participants cannot join before we do.

We store practice documents and client records in Microsoft OneDrive for Business, and we use Microsoft 365 for business email and our calendar. Access to our Microsoft 365 account is protected by multi-factor authentication, as one of the measures we use to keep information secure.

We use email (Outlook) for correspondence. When we need confidential documents from you, we send you a file-request link in OneDrive for Business that is specific to you and the work concerned. You can upload files through it, but you cannot see other people's files, and we switch the link off once we have what we need. We send draft tax returns as password-protected PDF files, and give you the password separately, by phone or another channel we have confirmed with you. We ask for your written approval before we file a return.

Please take care if you email sensitive documents, and use the upload link we send you where possible.

9. Marketing

We do not currently send marketing emails or newsletters. Making an enquiry, requesting a quote, booking a consultation or buying our Simple Self Assessment service does not sign you up to marketing. If we introduce marketing in future, we will only send it in line with data protection and electronic marketing law, and you will always be able to opt out.

10. Cookies and website analytics

Our website uses cookies and similar technologies. Some are strictly necessary for the website to work and to keep it secure. We use analytics cookies only if you agree to them. You can accept or reject optional cookies when you first visit, and change your choice at any time using the "Cookie settings" button that appears at the bottom-left of every page once you have made a choice. Our Cookie Policy explains which cookies we use and how to manage your choices.

10a. Website analytics

We use two analytics services to understand how our website is used, so we can improve it: Squarespace Analytics (part of our website platform) and Google Analytics 4, provided by Google.

What is collected. Pages viewed, how you reached our website (for example a search engine or a link), approximate location (country or city, derived from your IP address), device type, browser, screen size, language, and how you interact with pages, such as scrolling, clicks on links to other websites, file downloads and whether a form was started or sent. Google Analytics does not receive the information you type into our forms. If we later measure enquiries or consultation bookings, we will record only that the action happened.

Identifiers. Google Analytics sets cookies containing a randomly generated identifier, so that repeat visits from the same browser can be recognised. We do not use it to identify you by name.

What Google receives, and Google's role. Google receives this information, including your IP address, which it uses to derive approximate location. Google states that Google Analytics 4 does not log or store IP addresses. Google provides Google Analytics to us as our data processor under Google's data processing terms, which we accepted on 23 August 2021. We have also accepted Google's controller-to-controller data protection terms, which apply only if information is shared with Google under optional data-sharing settings. Those settings are switched off.

Our Google Analytics settings. In our Google Analytics account:

• Google signals is switched off;

• collection of user-provided data is switched off;

• advertising personalisation is switched off in all regions;

• no Google Ads account is linked;

• all four optional data-sharing settings are switched off;

• site search tracking is switched off.

These settings limit how the information is used, but Google's own terms and policies still apply. For example, Google may use limited information to provide, maintain and protect its services.

When it operates. Google Analytics does not load, and sends nothing to Google, until you accept analytics cookies (by choosing "Accept all", or by switching on "Performance and Analytics" under "Manage cookies"). If you choose "Reject all", it does not load. If you later withdraw your consent, it stops collecting straight away and its cookies are deleted from your browser. If you accept again, it resumes without counting your page view twice. Advertising features are not used, and advertising-related consent stays switched off whatever you choose.

Squarespace Analytics cookies are set only after you accept. If you withdraw your consent, Squarespace removes them when you next load a page on our website. Squarespace Analytics also receives information about each page you view (the page, the referring website, your browser, screen and window size, and the time) from your browser, but only if you have accepted analytics cookies. Squarespace provides Squarespace Analytics to us as part of its website services, under its Terms of Service and Data Processing Addendum.

Legal basis. Your consent. You can withdraw it at any time through "Cookie settings". Withdrawing consent stops Google Analytics collecting from your browser and removes analytics cookies, and Squarespace Analytics stops receiving page-view information from your browser. It does not affect collection that took place before you withdrew.

Retention. See section 7.

International transfers. Google may process the information in the United States and elsewhere, relying on one of the safeguards described in section 6.

More information. Google explains how it uses information from websites that use its services at policies.google.com/technologies/partner-sites.

10b. Website visit logs

We do not keep individual logs of visits to our website. The Squarespace Activity Log, which would show us individual visits, is switched off.

Server records. Like any web server, Squarespace's servers receive the standard information your browser sends when it requests a page, such as your IP address, the page requested, your browser type and the referring website. Squarespace uses this to deliver and secure the website and keeps it under its own policies.

Squarespace performance monitoring. Squarespace's own website code includes performance monitoring that we cannot switch off. On a sample of page loads, your browser sends Squarespace technical measurements of how the page and its images loaded, and display settings such as a reduced-motion or high-contrast preference. In our tests it did not set a cookie or store an identifier on your device. Squarespace receives this information under its own terms and privacy policy. It is not controlled by our cookie settings.

10c. Spam protection

Separately from analytics, pages with a protected form, and our booking page, use Google reCAPTCHA to check that submissions are genuine. This is needed to protect the forms and is not affected by your analytics choice. It is explained in our Cookie Policy. Our website fonts are delivered by our website platform, not by Google Fonts.

11. Your rights

Under UK data protection law, you have the right to:

• access the personal information we hold about you and receive a copy;

• rectification of information that is inaccurate or incomplete;

• erasure of your information, where we no longer need it or have no lawful reason to keep it;

• restrict our use of your information in certain circumstances;

• object to our use of your information where we rely on legitimate interests;

• data portability for information you provided to us, where we process it under a contract or with your consent and by automated means;

• withdraw consent at any time, where we rely on consent.

These rights are not absolute. For example, we may need to keep records to comply with tax or anti-money laundering law, or to deal with a legal claim. Some information may be exempt from disclosure, such as information that would prejudice the prevention or detection of crime. If we cannot fully meet a request, we will explain why.

We do not make decisions about you based solely on automated processing.

12. How to make a request

Email info@cjcaccountancy.co.uk. There is normally no fee. Here is what to expect:

• Proof of identity. We may ask you to confirm your identity, or for information to help us find what you are asking for.

• Response time. We will respond within one month. That month runs from the date we receive your request, or from receipt of any information we have reasonably asked for to confirm your identity, if later.

• Extensions. For complex requests, or where you have made several requests, we may extend the time by up to two further months. If so, we will tell you within the first month and explain why.

• Access requests. We will carry out a reasonable and proportionate search for your information. If we need you to clarify what you are asking for, the time limit pauses until you reply.

13. Complaints

If you are unhappy with how we have handled your personal information, please contact us first at info@cjcaccountancy.co.uk. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator:

• website: ico.org.uk/make-a-complaint

• helpline: 0303 123 1113

14. Changes to this policy

We will update this policy when our practices or the law change. The latest version will always be on our website, with the date it was last updated shown at the top.