Privacy Policy

Introduction

Business Consulting & Accounting Ltd, trading as BC&A ("we", "us", "our"), is committed to protecting and respecting your privacy.

This Privacy Policy explains how we collect, use, store and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Policy Applies To

• Website visitors
• Clients and prospective clients
• Individuals who contact or interact with us

Contact Details

Data Protection Contact

• Tahir Ahmed
• Data Protection Lead
• Email: info@bcaaccountants.com

Scope and Source of Data

We process personal data obtained:

• Directly from you (e.g. when you contact us or engage services)
• Indirectly from third parties (e.g. HMRC, Companies House, financial institutions)
• Automatically via website usage, cookies and digital interactions

Data Protection Principles

We process personal data in accordance with the following principles:

• Lawfulness, fairness and transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality

What Personal Data We Collect

Data You Provide

• Name, address, email, telephone
• Date of birth
• National Insurance number
• Tax reference numbers
• Financial and business information
• Identification documents

Automatically Collected Data

• IP address
• Browser type and version
• Device identifiers
• Website interaction data

Third-Party Data Sources

• HMRC
• Companies House
• Financial institutions
• Professional advisers
• Credit reference agencies

Live Chat Data

We use tawk.to. We may Collect:

• Chat transcripts
• Contact details (if provided)
• Technical data

Special Category Data

We do not routinely process special category data. Where such data is processed, enhanced safeguards are applied in accordance with UK GDPR.

How We Use Your Personal Data

We process personal data for the following purposes:

• Delivery of professional services
• Responding to enquiries
• Identity verification
• Compliance with legal and regulatory obligations
• Billing and financial management
• Dispute resolution and complaints handling
• Internal record keeping and compliance
• Service improvement and analytics
• Marketing (where lawful)

Legal Basis for Processing

In most cases, we process personal data because it is necessary to provide our services or comply with legal obligations. Where consent is required, it is obtained prior to processing. Where we rely on legitimate interests, we ensure that such interests are balanced against your rights and freedoms.

Failure to Provide Data

Where personal data is required by law or under the terms of a contract, failure to provide such data may result in:

• Inability to provide services
• Delay in service delivery
• Termination or refusal of engagement

Sharing Your Personal Data

Service Providers

We use trusted third-party systems to support our operations, including:

• Microsoft 365 (Outlook, OneDrive)
• ClickUp (CRM system)
• Xero (accounting platform)
• Brevo
• tawk.to
• Other IT and cloud service providers

We only share personal data where necessary and ensure that all providers are subject to appropriate contractual and security obligations, including Data Processing Agreements.

Regulatory and Legal Bodies

We may share data with:

• Law enforcement agencies
• Courts and tribunals
• Information Commissioner's Office

International Transfers

Some providers (including tawk.to and Brevo) may process personal data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses
• Equivalent data protection protections

Data Storage & Retention

Personal data is primarily stored within secure cloud environments, including Microsoft 365 infrastructure.

• Tax records: 6 years
• Advisory work: 6 years
• Client relationships: up to 7 years post-engagement
• Live chat data: up to 24 months

Cookies may be session-based or persistent depending on purpose.

Security & Compliance

Data Security

We implement appropriate technical and organisational measures, including:

• Role-based access controls
• Secure Microsoft 365 environment
• Encryption and secure storage
• Staff confidentiality obligations and training
• Monitoring and internal controls

In the event of a breach, we will notify relevant authorities and affected individuals where required.

Professional Confidentiality

As a firm of accountants, we are subject to strict professional confidentiality obligations. All client information is treated as confidential and disclosed only:

• Where required by law
• With client consent
• To authorised parties for service delivery

Anti-Money Laundering (AML)

We are legally required to:

• Verify identity
• Conduct due diligence
• Monitor client relationships

We may report suspicious activity and are prohibited from informing you where such reports are made.

We do not use automated decision-making or profiling.

Cookies, Live Chat & Marketing

Cookies

We use:

• Strictly necessary cookies
• Analytics cookies (with consent)
• Functionality cookies
• Live chat cookies (via tawk.to)
• Marketing cookies (where applicable)

Non-essential cookies are only used with consent. Users can manage cookies via our cookie banner or browser settings.

Live Chat Disclaimer

We use tawk.to. By using this feature:

• Conversations may be recorded
• Data may be stored for compliance and training
• It is intended for general enquiries only

Do not submit sensitive personal or financial information. Use of live chat does not create a client relationship or constitute professional advice.

Marketing Communications

We may contact you where:

• You have provided consent, or
• You are an existing client

We use Brevo to manage communications. You can opt out at any time.

Your Rights & Contact

Your Rights

You have the right to:

• Access your data
• Rectify inaccuracies
• Request erasure
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent

You also have the right to lodge a complaint with the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/

We will respond to all valid requests without undue delay and in any event within one month.

Withdrawal of Consent

Where we rely on consent, you have the right to withdraw it at any time. You can do so by:

• Clicking the unsubscribe link in marketing emails
• Adjusting your cookie preferences
• Contacting us at info@bcaaccountants.com

Withdrawal of consent does not affect prior lawful processing. We may continue to process data where another legal basis applies.

Complaints

Contact: info@bcaaccountants.com

You have the right to lodge a complaint with the Information Commissioner's Office

Changes to This Policy

We may update this policy from time to time and will notify users via website updates or direct communication where appropriate.

This policy is reviewed periodically to ensure ongoing compliance.

Effective Date: April 2026
Last Updated: April 2026