1. Who this notice covers and how to contact us
UA Tax Ltd, company number 15178069 and ICO registration ZB674061, is the controller when it decides why and how personal data is used in its practice. This notice covers clients, prospective clients, people connected with a client's affairs, contacts at other accountancy practices, suppliers, referrers, job applicants, staff and website visitors. It covers our accountancy, tax compliance, tax advisory and related business operations, as well as enquiries and appointments. We may provide more specific information for a particular service or employment relationship.
Contact UA Tax Ltd at 128 City Road, London, EC1V 2NX, info@uatax.co.uk or 020 7081 9900 with a privacy question, request or complaint. This notice does not replace the separate contractual data-processing terms required where we act solely on another organisation's documented instructions.
2. The information we use
Depending on our relationship and the assignment, information may include names, contact details, identity and verification documents, dates of birth, tax and National Insurance references, ownership and beneficial ownership, financial and banking details, accounts, tax returns, payroll, employment and pension records, property and transaction information, family and estate details, correspondence, instructions, meeting notes, invoices and payment records. Business contact data may include role, employer, authority to instruct and professional relationships. Supplier information may include contract, contact, invoice and payment details. For applicants and staff we may hold CVs, qualifications, references, right-to-work evidence, contract and payroll details, pension, attendance, leave, performance and necessary health or absence information.
Website and communication data may include IP address, device and browser details, referral and usage information, enquiry and booking details, and records of your privacy choices. We do not need complete card details: the payment provider handles card payments.
3. Where information comes from
We obtain information from you, an authorised representative, an instructing accountancy practice or business, employers and people relevant to the work. We may receive it from HMRC, Companies House, public registers, banks, solicitors, valuers, payroll and cloud-accounting systems, identity-verification providers and other advisers where the service or law requires. We may check publicly available professional and business information when considering an engagement or a conflict. Where we receive another person's data indirectly, we provide privacy information to them when required, taking account of any lawful exception.
4. Why we use information and our lawful bases
- Enquiries, proposals and onboarding: responding, assessing suitability, checking authority and conflicts, agreeing fees and scope, and arranging calls. We rely on steps requested before a contract or performance of a contract with an individual, or legitimate interests in responding to business contacts and running an independent practice.
- Professional services: preparing accounts, returns, computations and advice; discussing options; liaising with HMRC and others when authorised; administering work and billing. We rely on contract for an individual client and legitimate interests for work commissioned by a company or another practice, together with legal obligations that apply to particular records or filings.
- Legal and professional compliance: identity and beneficial-ownership checks, anti-money-laundering and sanctions controls, tax, company, employment and accounting obligations, professional supervision and lawful disclosures. We rely on legal obligation where applicable; related risk and conflict controls may rely on legitimate interests.
- Practice management: security, quality review, complaints, insurance, fee protection where relevant, debt recovery and legal claims. We rely on legitimate interests in protecting clients and the practice, legal obligation where applicable, and establishment, exercise or defence of claims where relevant.
- Suppliers, recruitment and staff: administering supplier relationships, applications, employment, pay and statutory duties. We rely on contract or pre-contract steps, legal obligations and legitimate interests in staffing and managing the practice, as appropriate to the activity.
- Optional analytics and direct electronic marketing: consent where required. We do not infer marketing consent from a service enquiry. Optional analytics does not load unless you accept it through the website control when configured.
Our legitimate interests include responding to enquiries, delivering work for business clients, maintaining secure and effective operations, managing conflicts and claims, and protecting professional standards. We assess those interests against the rights and expectations of the people concerned. A specific engagement may require a more detailed explanation of a purpose or basis.
5. Sensitive and criminal offence information
Tax, payroll, estate and family matters can reveal health, religion, trade-union membership or other special category information. Due diligence and disputes can involve criminal offence information. We limit collection to what is necessary and identify an Article 6 basis together with a separate Article 9 condition or Data Protection Act 2018 condition where required. Depending on the matter, this may include explicit consent, legal claims or a relevant substantial public interest condition for regulatory or anti-money-laundering work. We apply additional safeguards and any required appropriate policy document. Do not include sensitive details in a general website enquiry.
6. Information needed to provide a service
We need enough information to respond to an enquiry, confirm a booking and perform agreed work. Identity, beneficial-ownership and other evidence may be required by law before we start or continue. We will explain a particular request when we make it. If essential information is missing, we may be unable to accept, complete or continue the work. Clients remain responsible for giving accurate and timely records and for deciding what to disclose about other people lawfully.
7. Work for organisations and other accountancy practices
For our own client relationship, regulatory records and professional judgments, UA Tax generally decides the purposes and means of processing and acts as controller. When an accountancy practice or other organisation instructs us, that organisation may also be a controller of its clients' or staff's data. For a particular activity such as payroll performed only on a client's documented instructions, our role may instead be processor. The roles and any required Article 28 processing terms, including instructions, security, sub-processors, assistance and return or deletion, are set out in the relevant engagement documents. This public notice is not itself an Article 28 agreement.
8. Who may receive information
We share relevant information only as necessary and lawful with authorised staff, suitably bound contractors and a continuity practitioner if required to protect client affairs; the instructing client or authorised advisers; HMRC, Companies House, courts and other authorities; ACCA, CIOT or other professional and anti-money-laundering supervisors where applicable; legal advisers and professional indemnity insurers; and tax investigation fee protection insurers or administrators where we declare a client for cover, administer an arrangement or make a claim. The information shared for fee protection may include the client's identity, relevant category, engagement and HMRC correspondence, and details needed to assess a claim. We may use banks, payment, identity, cloud-accounting, payroll, pension, hosting, email, storage, security, scheduling and meeting providers. We do not sell personal data.
Some recipients process information under our instructions; others are independent controllers. Access by a continuity practitioner, subcontractor or another adviser is limited to an appropriate purpose and subject to confidentiality, authority and legal safeguards. Ask us about the recipients relevant to a particular engagement.
9. Website, email, meetings and bookings
The website enquiry form passes information through our Hostinger server to our business mailbox. Microsoft 365 and Teams normally handle correspondence and online meetings. TidyCal loads only after you choose to load a booking calendar; it receives technical information and the details you enter to administer appointments. A separate payment provider handles card payments. If you choose WhatsApp Business, Meta/WhatsApp processes your account, messages and technical data under its own terms. These providers may also have their own privacy notices.
Ordinary email, messaging and public forms may be unsuitable for passports, bank records, tax returns or other confidential files. Send only a concise outline initially and ask for an appropriate secure route. Tell us if you need a different communication method.
10. Cookies and analytics
The site stores your analytics choice in local storage for up to six months. Optional Google Analytics is loaded only after you accept; it may receive device, browser, approximate location, referral and interaction data. You can reject it and still use the site. When accepted, Google Analytics normally uses first-party _ga and _ga_<ID> cookies to distinguish browsers and maintain session state; their default duration is up to two years, refreshed on use. Rejecting optional analytics stops future collection on this site and clears those site cookies, but does not undo processing already completed.
You can change your analytics choice here at any time:
The TidyCal booking embed and external services may set their own cookies or similar storage when loaded. The booking interface and provider notices explain their processing. Browser controls may also block cookies, although this can affect external booking functions.
11. Marketing, reviews and case studies
Where we send direct electronic marketing, we use consent where required by the Privacy and Electronic Communications Regulations and provide an unsubscribe route. You can object to direct marketing at any time. We do not publish a client testimonial or identifiable case study without the relevant authority and an agreed presentation. If you ask us to withdraw permission for future publication, we will assess and action that request in accordance with the basis on which the material was published and applicable law.
12. International access and transfers
Some cloud, communication, scheduling and specialist service providers may process or allow access to data outside the UK. When a restricted transfer occurs, it must be covered by an applicable UK adequacy regulation or an appropriate safeguard, such as the UK International Data Transfer Agreement or UK Addendum to standard contractual clauses, with any required assessment. We consider the actual service and destination rather than assuming that all data stays in the UK or EEA. Email us for details of relevant safeguards and how to obtain a copy.
13. How long we keep records
We keep records under a category-based retention schedule. The period or criteria depend on the work, the last contact or end of the engagement, statutory tax, company, payroll and anti-money-laundering requirements, ACCA and insurance expectations, limitation periods and whether a claim, HMRC enquiry, complaint or legal hold is active. Anti-money-laundering due-diligence records are generally retained for five years after the business relationship ends, subject to lawful exceptions. Some tax history, such as base costs or claims carried forward, may be relevant for longer. We review unsuccessful enquiries and recruitment information by reference to their purpose and last activity, rather than retaining them indefinitely. Website analytics choices expire after up to six months.
Our internal schedule determines the applicable period for each category; ask us for the period or criteria relevant to your information. We securely delete, destroy or anonymise data when no longer justified. Clients must also retain their own records for applicable tax and company periods; our retention does not replace their obligation.
14. Security and automated decisions
We use access controls, appropriate service providers and organisational safeguards proportionate to the sensitivity and risk. We limit access to those who need it and use appropriate secure routes for confidential documents. No internet transmission is entirely risk free. We do not make solely automated decisions about clients or website visitors that have legal or similarly significant effects. If this changes, we will provide the additional information required by law.
15. Your rights and requests
Depending on the basis and circumstances, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing. You have an absolute right to object to direct marketing. Send a request to info@uatax.co.uk or our postal address. You may authorise another person to act for you; we may verify their authority and your identity where necessary and proportionate. A request does not have to use a particular form or legal phrase.
We normally respond without undue delay and within one month, subject to lawful clarification, extension or exemption. Requests are normally free of charge. We will explain if a legal obligation or another exception prevents us from doing everything requested.
16. Data protection complaints
Email info@uatax.co.uk with the issue and the outcome you seek. We will help you make a complaint, acknowledge it within 30 days, make appropriate enquiries, keep you informed and communicate the outcome without undue delay. You may also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/ or telephone 0303 123 1113. You do not need our permission to approach the ICO.
17. Changes to this notice
We review this notice when services, suppliers, data flows or legal duties change. Material changes affecting information already held will be communicated where required. The date displayed on this page identifies the current website version. For an employment or service-specific processing activity, supplementary privacy information may also apply.