1.1 eAccounts Ltd (“eAccounts“, “we“, “us” or “our“) is committed to protecting the privacy and security of personal data. This privacy notice explains how we collect, use, share and retain personal data, and the rights available to the individuals concerned.
1.2 This notice applies to personal data relating to:
1.3 In this notice, “Data Protection Legislation” means the UK General Data Protection Regulation (“UK GDPR“), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR“), each as amended or replaced from time to time. “Personal data”, “processing”, “controller” and “processor” have the meanings given in the UK GDPR.
2.1 eAccounts Ltd is the controller of the personal data described in this notice. We are a firm of accountants regulated by the Institute of Chartered Accountants in England and Wales (ICAEW).
| Registered name | eAccounts Ltd |
| Company number | 11678003 (registered in England and Wales) |
| ICO registration number | ZA537752 |
| Address | Ground Floor, Cardigan House, Castle Court, Swansea SA7 9LA |
| admin@e-accounts.co.uk | |
| Telephone | 029 2105 5592 |
2.2 We are not required to appoint a Data Protection Officer. Questions about this notice or our use of personal data should be addressed to the Data Protection Lead at the contact details above.
3.1 Depending on our relationship with you, we may process the following categories of personal data:
3.2 We obtain personal data directly from you and, where applicable, from:
4.1 We process personal data only where we have a lawful basis under Article 6 of the UK GDPR, as set out below.
| Purpose | Lawful basis (UK GDPR Article 6(1)) |
|---|---|
| Providing bookkeeping, VAT, payroll, pension auto-enrolment, accounts, tax and related services | (b) performance of a contract; and (c) legal obligation |
| Client identity, anti-money-laundering, sanctions and conflict checks | (c) legal obligation (Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017) |
| Filing returns with HMRC and Companies House, and retaining statutory records | (c) legal obligation |
| Processing personal data of clients’ employees, customers and suppliers in the course of our services | (f) legitimate interests |
| Using AI tools to support our work (section 6) | (f) legitimate interests |
| Responding to enquiries and preparing quotations | (b) steps taken at your request before entering into a contract; and (f) legitimate interests |
| Collecting fees by Direct Debit or card | (b) performance of a contract |
| Direct marketing (section 12) | (f) legitimate interests for existing clients; (a) consent where required by PECR |
| Website analytics and advertising cookies | (a) consent |
| Compliance with ICAEW requirements, professional indemnity insurance, quality reviews, and the establishment, exercise or defence of legal claims | (c) legal obligation; and (f) legitimate interests |
4.2 Legitimate interests. Where we rely on legitimate interests, those interests are: providing our professional services efficiently and accurately; managing and developing our business; maintaining appropriate records; and protecting our legal position. We have assessed that these interests are not overridden by the rights and freedoms of the individuals concerned. You may request details of that assessment.
4.3 Special category and criminal offence data. We do not ordinarily require special category data. Where it is contained in records provided to us, or where identity and anti-money-laundering checks reveal special category or criminal offence data, we process it only as necessary under Article 9(2)(f) (legal claims) or Article 9(2)(g) (substantial public interest) of the UK GDPR, and the conditions in Schedule 1 of the Data Protection Act 2018, including those relating to preventing or detecting unlawful acts, regulatory requirements and the prevention of fraud. We maintain an appropriate policy document where required.
5.1 Identity and due diligence information is a statutory requirement under anti-money-laundering legislation. If it is not provided, we cannot act for you.
5.2 Other information we request is a contractual requirement, needed to provide our services. If it is not provided, we may be unable to complete the work, or to complete it accurately or on time.
5.3 Providing information through our website forms is voluntary. We need your contact details to respond to an enquiry.
6.1 We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 of the UK GDPR.
6.2 We use AI tools where appropriate to support our work. Any output is reviewed by a member of our team, and our providers of AI tools are contractually prohibited from using your personal data to train their models.
7.1 We do not sell personal data. We disclose it only to the recipients described below.
7.2 Service providers (processors). We use the following categories of service provider. Each acts only on our documented instructions, under a written agreement meeting the requirements of Article 28 of the UK GDPR.
| Category of provider | Purpose | Location of processing |
|---|---|---|
| Accounting, payroll and bookkeeping software | Maintaining accounting records, payroll and pension auto-enrolment, capturing receipts and bills, and connecting selling platforms | United Kingdom / EU; certain providers in the United States |
| Practice management and client portal | Client records, workflow, client portal and secure file storage | United Kingdom; certain providers are US companies |
| Office and email | Email, documents, meeting bookings and working papers | Primarily United Kingdom |
| AI tools | Supporting our team’s work (section 6) | United States |
| Payments | Direct Debit and card payments | United Kingdom / EU and United States |
| Identity verification | Identity and anti-money-laundering checks | United Kingdom |
| Website, enquiries and email marketing | Website hosting, enquiry forms, enquiry management and newsletters | United Kingdom / EU and United States |
| Website analytics and advertising | Measuring website and advertising performance, subject to consent | United States |
7.3 At the date of this notice, our principal service providers within these categories are: Xero (UK) Ltd, for accounting, payroll and pension software; AutoEntry (part of the Sage group) and tofu, for capturing receipts and bills; PDLC Tech Ltd (trading as Link My Books), for connecting online selling platforms; Bright SG Ltd (BrightManager) and our own practice system, eAccountsOS, which is hosted by Supabase, Inc. and Vercel Inc.; Microsoft Ireland Operations Limited, for Microsoft 365 and Azure; Anthropic Ireland, Limited, for AI tools; Plus Five Five, Inc. (Resend), for system email; GoCardless Ltd and Stripe Payments UK Ltd, for payments; SmartCredit Limited (trading as SmartSearch) and Veriphy Limited, for identity verification; SiteGround Spain S.L., for website hosting; HubSpot Ireland Limited and The Rocket Science Group LLC (Mailchimp), for enquiries and email marketing; and Google Ireland Limited and Microsoft Corporation (Microsoft Clarity), for website analytics and advertising. We will update this list when our providers change.
7.4 Other recipients. We may also disclose personal data to:
8.1 Certain of our service providers process personal data outside the United Kingdom, principally in the United States, or are established in the United States and may access personal data from there.
8.2 Where personal data is transferred outside the United Kingdom, we ensure that it is protected by one of the following safeguards under Chapter V of the UK GDPR:
8.3 You may request further information about the safeguard that applies to a particular transfer.
9.1 We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, regulatory, accounting and reporting requirements.
| Category of data | Retention period |
|---|---|
| Client accounting, tax and engagement records | Six years from the end of the engagement |
| Identity and anti-money-laundering records | Five years from the end of the business relationship, as required by law |
| Enquiries that do not result in an engagement | 24 months from the last contact |
| Direct marketing data | Until you unsubscribe, or 24 months from the last contact |
| Website analytics data | As stated in our cookie notice, up to 14 months |
9.2 We may retain data for longer where required by law, or where necessary to establish, exercise or defend legal claims. At the end of the retention period, data is securely deleted or anonymised.
10.1 We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage, in accordance with Article 32 of the UK GDPR. These measures include encryption of data in transit and at rest, multi-factor authentication, and access controls limiting personal data to personnel who require it.
10.2 We maintain procedures for responding to any suspected personal data breach. We will notify the Information Commissioner’s Office and affected individuals where we are required to do so by law.
10.3 We do not currently record telephone calls or meetings. If we introduce recording, we will inform you before any recording takes place.
11.1 Subject to certain conditions and exemptions under the Data Protection Legislation, you have the right to:
11.2 Right to object. You have the right to object, on grounds relating to your particular situation, to processing based on our legitimate interests. You also have an absolute right to object at any time to the processing of your personal data for direct marketing purposes.
11.3 Some rights do not apply in every case. For example, we cannot erase records we are legally required to keep.
11.4 To exercise any of these rights, please contact us using the details in section 2. We will respond within one month of receipt. That period may be extended by up to two further months for complex or numerous requests, in which case we will inform you. No fee is normally charged. We may need to verify your identity before responding.
12.1 We may send existing clients information about our services by email in reliance on our legitimate interests and Regulation 22 of PECR. We send electronic marketing to other individuals only with their consent. Every marketing communication includes a means of unsubscribing.
12.2 Our website uses strictly necessary cookies. Analytics, session-recording and advertising cookies are placed only with your consent, given through our cookie banner, which you may withdraw at any time. Full details of the cookies we use and their duration are set out in our cookie notice.
12.3 Personal data submitted through our quote, contact and booking forms is used to respond to and follow up your enquiry and, if you become a client, to provide our services.
13.1 Where a client provides us with personal data relating to other individuals, including its employees, customers and suppliers, the client is responsible for ensuring that it has a lawful basis for doing so and that those individuals have been informed, where required, that their data will be shared with us. Clients may refer those individuals to this notice.
13.2 Our services are not directed at children. We do not knowingly collect personal data from individuals under the age of 18, except where it is contained in records provided by a client or a parent or guardian, for example payroll or trust records.
14.1 If you have any concerns about our use of your personal data, please contact us first using the details in section 2, so that we can try to resolve them.
14.2 You also have the right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority for data protection: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
15.1 We review this notice at least annually and whenever there is a material change to our processing. The current version is published on our website. Where changes are significant, we will notify clients directly.
15.2 This notice was last updated on 14 October 2026.
eAccounts Ltd is an independent, private accountancy firm. We are not affiliated with HMRC, Companies House or any government body. Many government services, such as filing your own tax return, are free at gov.uk.
Ground Floor
Cardigan House
Castle Court
Swansea
SA7 9LA