Privacy Notice / Data Protection & Privacy Statement

1. Who we are
P&N Accountants Limited is the controller of the personal data we process.
P&N Accountants Limited is regulated by the Institute of Financial Accountants.
Contact details:
P&N Accountants Limited
Email: mail@pnaccountants.co.uk
Telephone: 01709 522390
Website: www.pnaccountants.co.uk
This Privacy Notice / Data Protection & Privacy Statement explains how we collect, use, store, share
and protect personal data.
2. Scope of this policy
This policy applies to personal data we process through:
– our website;
– client enquiries;
– client onboarding;
– accountancy, bookkeeping and tax services;
– Self Assessment, CIS, VAT, payroll and company services;
– Making Tax Digital support;
– the P&N MTD Portal;
– email, telephone, post and other communications;
– professional, legal, regulatory and compliance activities.
Where you use the P&N MTD Portal, you should also read the Portal Terms displayed on the website or within the portal.
3. Personal data we may collect
We may collect and process the following types of personal data:
– name;
– contact details, including address, email address and telephone number;
– date of birth where needed for identification, tax or compliance work;
– National Insurance number;
– Unique Taxpayer Reference, known as UTR;
– company details and directorship details;
– business and trading details;
– employment, payroll and pension information;
– income, expense, CIS, VAT and tax records;
– bank details where needed for accountancy, payroll, tax refund or payment purposes;
– identification and anti-money laundering information;
– records of communications with you;
– documents and records you provide to us;
– website enquiry details;
– portal account and login-related information;
– portal submissions, uploaded files, declarations and audit records;
– technical information such as IP address, browser/device information, security logs and website/portal usage data.
We only collect personal data that is relevant to the services we provide, our legal obligations, professional obligations, client relationship management, and the security and operation of our systems.
4. How we collect personal data
We may collect personal data:
– directly from you;
– from your business, employer or company;
– from HM Revenue & Customs;
– from Companies House;
– from previous accountants or professional advisers;
– from payroll, bookkeeping, tax or accounting software;
– from banks, finance providers or third parties where relevant and authorised;
– through the P&N MTD Portal;
– through website enquiry forms;
– through email, telephone, post or meetings;
– from publicly available sources where relevant.
5. Why do we use personal data
We use personal data for the following purposes:
– to respond to enquiries;
– to decide whether we can act for you;
– to complete client onboarding and anti-money laundering checks;
– to provide accountancy, bookkeeping and tax services;
– to prepare accounts, tax returns, VAT returns, CIS records, payroll records and other compliance work;
– to provide Making Tax Digital support;
– to submit information to HMRC or Companies House where authorised and required;
– to communicate with you about your records, deadlines, queries and work we are carrying out;
– to operate and secure the P&N MTD Portal;
– to keep records of information submitted to us;
– to maintain audit trails and evidence of client approvals/declarations;
– to comply with legal, tax, regulatory and professional obligations;
– to manage complaints, disputes, insurance matters or legal claims;
– to manage our business, systems, records and client files;
– to prevent fraud, unauthorised access, misuse or security incidents.
6. Lawful basis for processing
We rely on different lawful bases depending on the purpose of processing.
The lawful bases we may rely on include:
Contract:
Where processing is necessary to provide services under our engagement with you or to take steps before entering into an engagement.
Legal obligation:
Where processing is necessary to comply under legal obligations, including tax law, anti-money laundering rules, company law, payroll obligations, HMRC requirements and regulatory obligations.
Legitimate interests:
Where processing is necessary for our legitimate business interests, including managing client relationships, operating secure systems, keeping proper business records, maintaining audit trails, preventing fraud, resolving disputes, and protecting our legal position.
Consent:
Where we rely on consent for a specific purpose, we will ask for it separately. Consent is not normally the lawful basis we rely on for core accountancy and tax work.
7. Main processing activities, data used and lawful basis
Purpose: Responding to enquiries
Data used: Name, contact details, enquiry information
Lawful basis: Legitimate interests / steps before contract
Purpose: Client onboarding
Data used: Name, contact details, ID/AML information, business details
Lawful basis: Legal obligation / contract
Purpose: Accountancy and tax services
Data used: Tax records, income, expenses, UTR, National Insurance number, business records
Lawful basis: Contract / legal obligation
Purpose: Payroll services
Data used: Employee details, pay, tax, National Insurance, pension information
Lawful basis: Contract / legal obligation
Purpose: VAT, CIS and Self-Assessment work
Data used: VAT, CIS, tax and business records
Lawful basis: Contract / legal obligation
Purpose: MTD portal use
Data used: Portal login, submissions, uploaded files, declarations, audit records
Lawful basis: Contract / legal obligation / legitimate interests
Purpose: HMRC and Companies House submissions
Data used: Tax/company records, client approvals, statutory information
Lawful basis: Legal obligation / contract
Purpose: Record keeping and audit trail
Data used: Client records, submission records, communications, logs
Lawful basis: Legal obligation / legitimate interests
Purpose: Security and fraud prevention
Data used: Login data, IP address, device/browser information, security logs
Lawful basis: Legitimate interests / legal obligation
Purpose: Complaints, disputes and claims
Data used: Client file, communications, work records
Lawful basis: Legitimate interests / legal obligation
8. Special category data
We do not usually need to collect special category data, such as health information, religious beliefs, political opinions, trade union membership or similar sensitive information.
You should not send or upload this type of information unless we specifically ask for it or it is directly relevant to the work we are carrying out.
If special category data is provided to us, we will only process it where there is a lawful basis and a valid condition under data protection law, such as where it is necessary for legal claims, legal obligations, substantial public interest or another applicable condition.
9. Criminal offence data
We do not routinely process criminal offence data.
If such information is provided or becomes relevant, we will process it only where lawful and necessary, for example, in relation to anti-money laundering obligations, professional obligations, legal claims, fraud prevention or regulatory requirements.
10. Anti-money laundering checks
As an accountancy practice, we may need to carry out anti-money laundering checks before or during an engagement.
This may include collecting identification documents, verifying identity, understanding business activities, checking ownership/control of a business, assessing risk, and keeping records of those checks.
We may use third-party service providers to assist with identification, verification, sanctions screening, politically exposed persons screening, and compliance checks, where required.
11. The P&N MTD Portal
The P&N MTD Portal is used by existing clients to provide information and documents to P&N Accountants Limited for review.
The portal may collect:
– UTR;
– National Insurance number;
– income and expense records;
– CIS details;
– mileage and vehicle details;
– uploaded receipts, invoices and documents;
– tax year, quarter or period information;
– declaration confirmations;
– Privacy Notice and Portal Terms acceptance records;
– audit records and security logs.
The portal is a data collection and communication tool. Submitting information through the portal does not, by itself, mean that any tax return, MTD quarterly update, final declaration or other submission has been filed with HMRC.
12. Emails and communications
We may contact you by email, telephone, post or through the P&N MTD Portal.
Portal and service emails may include:
– registration emails;
– password reset or login emails;
– verification emails;
– query notifications;
– submission confirmation emails;
– service or deadline-related messages.
These are service and administrative communications, not marketing emails.
We do not aim to include sensitive tax details, such as UTRs, National Insurance numbers, detailed income figures or uploaded documents, in automated emails.
13. Marketing
We do not use the P&N MTD Portal to send marketing emails or newsletters.
If we send marketing communications in the future, we will do so in accordance with appropriate data protection and electronic marketing rules.
You can ask us to stop sending marketing communications at any time.
14. Who we share personal data with
We may share personal data where necessary with:
– HM Revenue & Customs;
– Companies House;
– pension providers;
– payroll and bookkeeping software providers;
– tax and accountancy software providers;
– cloud hosting, IT, portal, security and email providers;
– anti-money laundering and identity verification providers;
– banks or finance providers where relevant and authorised;
– legal advisers, insurers and professional advisers;
– regulatory bodies and professional bodies;
– law enforcement, courts, tribunals or public authorities where required;
– third parties you authorise us to deal with.
We do not sell your personal data.
15. External processors and service providers
We may use external service providers to support our business, website, portal, software, document storage, email, security, accounting, tax and compliance systems.
Where those providers process personal data on our behalf, they are expected to do so only in accordance with our instructions and applicable data protection terms.
16. International transfers
Some software, cloud, email, IT or portal providers may store or process personal data outside the United Kingdom.
Where this happens, we will take reasonable steps to ensure appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, international data transfer agreements or other legally recognised safeguards.
17. How long do we keep personal data
We keep personal data for as long as necessary for the purpose for which it was collected and for legal, tax, regulatory, professional, insurance, and legitimate business reasons.
Retention periods may vary depending on the type of record.
Client records, tax records, accounting records, engagement records, portal submissions, declarations, uploaded documents, correspondence and audit records may be retained in line with our data retention policy and applicable legal/professional requirements.
Where you cease to be a client, access to the P&N MTD Portal may be disabled, but underlying records may be retained where required.
18. Security
We take reasonable technical and organisational actions to protect personal data.
These may include:
– password-protected access;
– email verification;
– admin verification controls;
– HTTPS encryption in transit;
– private file storage;
– restricted access;
– audit logging;
– file type restrictions;
– protected download routes;
– rate limiting and security controls;
– backup and recovery arrangements;
– staff confidentiality procedures;
– secure record keeping.
No system is completely risk-free. You should also take care to protect your own login details, passwords, devices and email account.
19. Website cookies and similar technologies
Our website and portal may apply cookies or similar technologies.
Some cookies are necessary for the website or portal to work properly, such as login/session cookies.
If non-essential cookies, analytics or tracking tools are used, we will provide appropriate information and consent options where required.
A separate Cookie Statement or cookie notice may be displayed where necessary.
20. Your rights
Under UK data protection law, you may have rights including:
– the right to access your personal data;
– the right to have inaccurate personal data corrected;
– the right to request deletion of personal data in certain circumstances;
– the right to restrict processing in certain circumstances;
– the right to object to processing in certain circumstances;
– the right to data portability in certain circumstances;
– the right not to be subject to certain automated decisions;
– the right to withdraw consent where processing is based on consent;
– the right to complain to the Information Commissioner’s Office.
These rights are not absolute. We may need to retain or continue processing certain records where required for legal, tax, regulatory, professional, insurance or legitimate business reasons.
21. How to contact us about your data
If you have any questions about this policy or how we use personal data, please contact:
P&N Accountants Limited
Email: mail@pnaccountants.co.uk
Telephone: 01709 522390
Website: www.pnaccountants.co.uk
22. Complaints
If you are unhappy with how we use your personal data, please contact us first so that we can investigate and respond.
You also have the right to complain to the Information Commissioner’s Office.
ICO website: www.ico.org.uk
ICO telephone: 0303 123 1113
23. Changes to this policy
We may update this policy from time to time.
The version currently shown is:
Privacy Notice / Data Protection & Privacy Statement v1.0
Effective date: 14th May 2026 / 14/05/2026