Franks Accountants Limited (“Franks Accountants”, “we”, “us” or “our”) is committed to protecting and respecting your privacy and ensuring that your personal data is handled fairly, lawfully, securely and transparently.

Franks Accountants Limited is a company registered in England and Wales under company number 08803530 and is VAT registered under number 181 2321 39.

Our registered office is:

First Floor, Equinox 1
Audby Lane
Wetherby
West Yorkshire
England
LS22 7RD

We are registered with the Information Commissioner’s Office (“ICO”) as a data controller. Our ICO registration number is ZA051337.
This Privacy Policy explains how we collect, use, store and protect personal data and the rights you have in relation to your personal data.
This Privacy Policy should be read alongside our Terms of Engagement, website terms of use and any other documents referred to within those terms.

1. Data protection legislation

We process personal data in accordance with applicable UK data protection legislation, including:

  • the UK General Data Protection Regulation (“UK GDPR”);
  • the Data Protection Act 2018;
  • the Data (Use and Access) Act 2025, where applicable; and
  • the Privacy and Electronic Communications Regulations 2003 (“PECR”), where applicable.

We may update this Privacy Policy from time to time to reflect changes in legislation, regulatory guidance or the way in which we process personal data.

2. What is personal data?

“Personal data” means information relating to an identified or identifiable living individual.

This can include information such as your name, address, telephone number, email address, date of birth, National Insurance number, Unique Taxpayer Reference (“UTR”), financial information, employment information, identification documents and other information relating to you.

Some information is subject to additional protection under data protection legislation. This includes special category data, such as information concerning health, racial or ethnic origin, religious or philosophical beliefs, trade union membership, genetic or biometric data used for identification purposes, sex life or sexual orientation.

We will only process special category data where an appropriate legal condition under applicable data protection legislation applies.

3. Information we collect

We may collect personal data when:

  • you engage us to provide professional services;
  • you contact us by telephone, email, post, through our website or by other means;
  • you complete forms or provide information to us electronically or in hard copy;
  • you provide us with documents or information required to undertake accounting, taxation, payroll or other professional services;
  • you use our website;
  • you communicate with us about our services;
  • you apply for employment or work with us;
  • we receive information from HMRC, Companies House or another government or regulatory authority;
  • another person or organisation provides information to us on your behalf or in connection with the services we provide to you; or
  • we obtain information from publicly available sources where this is lawful and appropriate.

Depending upon the services we provide, the personal data we collect may include:

  • your name and contact details;
  • residential and correspondence addresses;
  • date of birth;
  • National Insurance number;
  • Unique Taxpayer Reference and other tax identifiers;
  • Companies House information;
  • financial and banking information;
  • employment and payroll information;
  • information relating to your business activities;
  • information contained within accounting records;
  • identification and verification information;
  • information relating to directors, shareholders, employees and other individuals connected with a business;
  • correspondence and communications between you and us;
  • information required to comply with anti-money laundering and other legal obligations;
  • information relating to your use of our website, including IP address and information about pages visited; and
  • any other information you provide to us which is necessary for us to provide our services.

4. Information provided by you

You may provide personal data to us through electronic forms, documents, accounting software, client portals, email, telephone, post, face-to-face meetings or other means.

Where you provide us with personal data relating to another individual, such as an employee, director, shareholder, family member or business associate, you should ensure that you are entitled to provide that information to us.

Where appropriate, we may provide privacy information directly to those individuals in accordance with applicable data protection legislation.

5. Why we use your personal data

We use personal data where necessary to:

  • provide accounting, taxation, payroll and other professional services;
  • administer and manage our relationship with you;
  • prepare and submit accounts, tax returns, VAT returns, payroll information and other statutory or regulatory submissions;
  • communicate with you about the services we provide;
  • comply with our legal, regulatory and professional obligations;
  • carry out client identification, verification and acceptance procedures;
  • comply with anti-money laundering and counter-terrorist financing requirements;
  • undertake appropriate due diligence and risk assessments;
  • maintain accurate accounting and business records;
  • manage our billing and payments;
  • maintain the security of our systems and information;
  • monitor and improve the quality of our services;
  • manage complaints and enquiries;
  • administer and develop our business;
  • manage professional and commercial risks;
  • protect our business, clients, employees and third parties from fraud and other unlawful activity;
  • provide information about our services where this is lawful and appropriate; and
  • exercise or defend our legal rights.

We will not use your personal data for a new purpose which is incompatible with the original purpose without first considering the applicable legal requirements and, where necessary, informing you.

6. Our lawful bases for processing personal data

We must have a lawful basis under the UK GDPR for processing your personal data.
Depending upon the circumstances, our lawful bases may include:

Contract

We may process your personal data where this is necessary to enter into or perform a contract with you, including our Terms of Engagement.

Legal obligation

We may process personal data where this is necessary for us to comply with a legal or regulatory obligation.
This includes obligations relating to taxation, accounting, payroll, anti-money laundering, Companies House and other statutory or professional requirements.

Legitimate interests

We may process personal data where this is necessary for our legitimate interests, or those of a third party, provided that these interests are not overridden by your interests or fundamental rights and freedoms.

Our legitimate interests may include administering and developing our business, providing and improving our services, maintaining security, managing risks, communicating with clients and protecting our legal rights.

Consent

In certain circumstances, we may rely on your consent to process personal data.

Where we rely on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Vital interests

In limited circumstances, we may process personal data where this is necessary to protect someone’s vital interests.

7. Special category data

We may occasionally process special category personal data where this is necessary to provide our services or comply with our legal obligations.

For example, payroll services may require us to process information relating to an employee’s health or other information which falls within a special category.

Where special category data is processed, we will ensure that an appropriate condition under Article 9 of the UK GDPR, together with any additional requirements under the Data Protection Act 2018, applies.

8. Anti-money laundering and client due diligence

As a professional accountancy firm, we are subject to legal and regulatory requirements relating to anti-money laundering and terrorist financing.

We may therefore be required to collect and verify information about you and other individuals connected with your business, including identification documents, information concerning beneficial ownership and other due diligence information.

We may carry out checks using information obtained from publicly available sources and third-party verification providers where permitted by law.

We may also be required to retain this information for a prescribed period even where our relationship with you has ended.

Where the law requires us to report information to a relevant authority, we may be unable to tell you that a report has been made.

9. Sharing personal data

We will keep your personal data confidential and will only disclose it where there is a lawful basis for doing so.
Depending upon the services we provide and the circumstances, personal data may be shared with:

  • HM Revenue & Customs;
  • Companies House;
  • other government departments, regulators and statutory authorities;
  • pension providers and administrators;
  • banks, lenders and other financial institutions where authorised or instructed by you;
  • auditors and other professional advisers;
  • solicitors, financial advisers, mortgage advisers or other professional advisers where instructed or authorised by you;
  • payroll, accounting and other software providers;
  • identity verification and anti-money laundering providers;
  • IT, cloud hosting, data backup and cybersecurity providers;
  • document storage and management providers;
  • payment service providers;
  • insurers and professional advisers where necessary to manage our business or professional obligations; and
  • other service providers who process personal data on our behalf.

Where we appoint a third party to process personal data on our behalf, we will take appropriate steps to ensure that the processing is carried out in accordance with applicable data protection legislation and that appropriate contractual and security measures are in place.

10. Disclosure required by law

We may disclose personal data where we are required or permitted to do so by law, regulation, court order or professional obligation.

We may also disclose personal data where this is necessary to:

  • establish, exercise or defend legal claims;
  • protect our rights, property or safety;
  • protect the rights, property or safety of our clients or others;
  • detect or prevent fraud or other unlawful activity; or
  • comply with a request from a competent regulatory or law enforcement authority.

11. Business transfers

If Franks Accountants Limited is involved in a merger, acquisition, restructuring, sale of all or part of its business or assets, or similar transaction, personal data may be transferred as part of that transaction where legally permitted.

Where appropriate, we will take reasonable steps to ensure that any recipient continues to handle personal data in accordance with applicable data protection requirements.

12. How we protect your personal data

We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, disclosure or other unlawful processing.

These measures may include:

  • access controls;
  • user authentication;
  • password protection;
  • encryption where appropriate;
  • secure cloud systems;
  • data backup procedures;
  • cybersecurity measures;
  • staff training and confidentiality obligations;
  • secure document handling; and
  • procedures for responding to data breaches and other security incidents.

No method of transmitting information over the internet or storing information electronically is completely secure. While we take appropriate measures to protect your personal data, we cannot guarantee absolute security.

13. How long we keep personal data

We will retain personal data only for as long as is reasonably necessary for the purposes for which it was collected, including to:
provide our services;

  • comply with legal, regulatory and professional obligations;
  • maintain appropriate business and financial records;
  • deal with complaints or disputes;
  • establish, exercise or defend legal claims; and
  • meet our professional and insurance requirements.

Different types of personal data may be retained for different periods.

In particular, certain accounting, taxation and anti-money laundering records must be retained for specified periods under applicable legislation and professional requirements.

When personal data is no longer required, we will securely delete, destroy or anonymise it where appropriate.

14. Your data protection rights

Subject to certain legal exemptions and limitations, you may have the following rights under applicable data protection legislation:

Right to be informed

You have the right to receive clear information about how we use your personal data.

Right of access

You have the right to request a copy of the personal data we hold about you and certain additional information about how we process it.

Right to rectification

You have the right to ask us to correct inaccurate or incomplete personal data.

Right to erasure

In certain circumstances, you have the right to ask us to delete your personal data.
This right is not absolute. For example, we may be required by law or professional obligations to retain certain information.

Right to restrict processing

In certain circumstances, you have the right to ask us to restrict the processing of your personal data.

Right to object

In certain circumstances, you have the right to object to our processing of your personal data, particularly where we rely on legitimate interests as our lawful basis.

You may also have an absolute right to object to direct marketing.

Right to data portability

Where applicable, you may have the right to receive certain personal data you have provided to us in a structured, commonly used and machine-readable format and to request that it is transferred to another organisation.

This right only applies in specific circumstances, including where processing is based on consent or contract and is carried out by automated means.

Rights relating to automated decision-making

You may have rights relating to decisions made solely by automated means, including profiling, where such decisions produce legal or similarly significant effects.

We do not currently routinely make decisions about clients based solely on automated processing which produce legal or similarly significant effects.

15. Making a data protection request

If you wish to exercise any of your data protection rights, please contact us using the contact details provided on our website or by contacting us at our registered office.

We may need to request additional information from you to verify your identity before responding to a request.

We will normally respond to a valid request without undue delay and within one month.

Where permitted by law, this period may be extended by a further two months where a request is particularly complex or where we receive a number of requests. If an extension is required, we will inform you within the applicable period and explain why.

We will generally not charge a fee for exercising your rights. However, where permitted by law, we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive.

16. Information obtained from other sources

We may obtain personal data from sources other than you, including HMRC, Companies House, other professional advisers, employers, employees, directors, shareholders, publicly available sources and third-party verification providers.

Where required by law, we will provide the relevant individual with privacy information when we obtain their personal data or within the applicable statutory timeframe.

17. International transfers

Some of our service providers may process or store personal data outside the United Kingdom.

Where personal data is transferred outside the UK, we will ensure that the transfer is carried out in accordance with applicable UK data protection legislation.

Depending upon the destination and circumstances, this may include relying on UK adequacy regulations, appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism.

We will not rely on an individual’s general agreement to this Privacy Policy as the legal basis for an international transfer where the law requires a specific transfer mechanism.

18. Cookies and website information

Our website may use cookies and similar technologies.

Cookies may be used for purposes such as ensuring the website operates correctly, improving functionality, understanding how visitors use the website and, where applicable, marketing or analytics.

Where required by applicable law, we will ask for your consent before placing non-essential cookies on your device.

Further information about the cookies we use and how you can manage them will be provided in our Cookie Policy.

19. Direct marketing

We may contact existing clients about services which we believe may be relevant to them where permitted by law.

We will comply with applicable data protection and electronic marketing legislation, including the Privacy and Electronic Communications Regulations 2003 (“PECR”).

Where consent is required for electronic direct marketing, we will obtain that consent before sending the relevant communications.
You can object to direct marketing or unsubscribe from marketing communications at any time.

20. Complaints

If you have any concerns about the way we have handled your personal data, we would encourage you to contact us first so that we can investigate and try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office (“ICO”), which is the UK’s independent supervisory authority for data protection.
Further information about the ICO and how to make a complaint can be found on the ICO’s website.

21. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legislation, regulatory guidance, our services, technology or the way we process personal data.

Any updated version will be published on our website and will take effect from the date of publication unless otherwise stated.

We recommend that you review this Privacy Policy periodically.