Privacy Notice

1. Who we are and our role

SB Business Consulting Limited is an accountancy and tax practice registered in England and Wales under company number 11369594. Our registered office is 28 Townsend Street, Cheltenham, GL51 9HD. Samuel Brogden, Director, is our point of contact for privacy enquiries; he is not designated as a statutory Data Protection Officer.

We are usually an independent controller when carrying out professional accountancy and tax work and when running our practice and website. A client business may separately be a controller of its staff, customer or supplier data. If a particular service means we process data only on the client’s instructions, we will agree appropriate Article 28 processor terms where required. Our role depends on the actual service and law, not just a label in a contract.

2. Who this notice covers

This notice covers clients and prospective clients; directors, owners and staff of client businesses; people whose information appears in client accounting, tax, VAT or payroll records; business contacts, referrers and suppliers; website visitors; and anyone who contacts us. It may also apply to tenants, customers, contractors and family members whose data is relevant to a client engagement.

If a client provides us with information about other people, it should make suitable privacy information available to them and have a lawful basis for sharing it. We may also give this notice to those individuals directly where appropriate and required.

3. Personal information we may use

• Names, addresses, dates of birth, contact details, job titles and identification documents.
• National Insurance numbers, UTRs, PAYE and VAT references, Companies House information and other tax identifiers.
• Accounts, tax returns, income, expenses, invoices, receipts, bank and payment details, payroll, pension, benefits, shareholdings, loans and transaction records.
• Business ownership, contracts, customer and supplier details, and information needed to give advice or prepare filings.
• Identity verification, beneficial ownership, sanctions and politically exposed person screening, source of funds and risk assessment information.
• Emails, calls, messages, file notes, proposals, signed engagement letters, service history and complaints.
• Website and device information, such as IP address, browser, pages viewed, cookie preferences and enquiry form details, where collected.

We seek information relevant to the purpose and do not ask you to supply sensitive material unnecessarily.

4. Special category and criminal offence information

Tax, payroll and employment records may include information about health, sickness or maternity, trade union membership or other special category data. Where we use it as controller, we need both an Article 6 lawful basis and a relevant Article 9 condition, such as employment and social security obligations, legal claims or explicit consent where suitable. We apply any additional condition and safeguards required by the Data Protection Act 2018.

We may encounter limited criminal offence or allegation information in due diligence or client records. We use it only where permitted by law and with the applicable Data Protection Act 2018 condition and safeguards. Ordinary financial or tax information is not automatically special category data, although it remains confidential.

5. Where information comes from

We obtain information directly from you, through our website or onboarding process, and from records supplied by you or your organisation. We may also receive it from a previous accountant, your bookkeeper, employer, director, bank, software provider, pension provider, professional adviser, referrer, or a client’s customers and suppliers.

Other sources include HMRC, Companies House and other public registers, business websites, professional directories, identity verification and sanctions screening providers. For business development, we may obtain publicly available company and officer details from Companies House or other business directories. We use and disclose those sources in the ways described below.

6. Why we use information and our lawful bases

We choose and record the lawful basis appropriate to the purpose and relationship. “Contract” generally applies to an individual who is our client; where our client is a company, we may instead rely on legitimate interests or legal obligation when handling a director’s or employee’s details.

If we need information to meet a legal obligation or perform the agreed work and you do not provide it, we may be unable to act or complete the service. We will explain what is needed where we can lawfully do so.

7. Anti-money laundering and regulatory checks

We must carry out client due diligence and ongoing monitoring. This can include identity and address evidence, ownership and control, source of funds or wealth, risk assessments, sanctions and politically exposed person checks, and records of enquiries and decisions. We may use specialist verification providers and public registers. In some cases the law prevents us from telling you about a report or enquiry.

8. Legitimate interests

Our legitimate interests include providing and improving professional services, maintaining business relationships and security, keeping an appropriate audit trail, managing risks and claims, and introducing relevant services to business contacts. We balance those interests against people’s rights and expectations and use proportionate information and safeguards. You can object to processing based on legitimate interests in certain circumstances; your right to object to direct marketing is absolute.

9. Marketing choices

We may send relevant information to business contacts, including by post using publicly available company details. Electronic marketing is sent only where the applicable privacy and electronic communications rules allow it. We do not sell personal information for another organisation’s marketing.

You can object to direct marketing at any time. Email sam@sbbusinessconsulting.co.uk or use an unsubscribe link where one is provided. We may keep a minimal suppression record to make sure we honour your choice. Withdrawing consent does not affect earlier lawful processing.

10. Who we share information with

We share information only where relevant to a purpose in this notice, including with:

• HMRC, Companies House, The Pensions Regulator and other public authorities;
• accounting, tax, bookkeeping, payroll, document capture and bank-feed providers (for example Xero where used for your engagement);
• client onboarding, e-signature, identity verification, sanctions screening, practice management and document storage providers;
• banks, card payment and Direct Debit providers, insurers and pension providers;
• email, hosting, IT, security, analytics, advertising and website providers;
• our employees, contractors, appropriately bound subcontractors and independent quality reviewers;
• ICAEW, regulators, professional advisers, legal advisers, insurers and debt recovery providers where appropriate; and
• a potential purchaser or successor of the practice, under appropriate confidentiality and data protection safeguards.

Some recipients are independent controllers; others process information on our behalf under appropriate written terms. We assess providers and require confidentiality, security and data protection safeguards suitable for the service. We remain responsible for our own compliance and for the providers we appoint as the law requires. We do not treat this notice as permission to share information for unrelated purposes.

11. Access and transfers outside the UK

Cloud systems, support staff or outside providers may store or access information outside the UK. Where a transfer is restricted under UK data protection law, we rely on a recognised UK adequacy regulation or an appropriate safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to EU Standard Contractual Clauses, together with any required transfer risk assessment. Limited legal exceptions may apply where appropriate.

You can ask us for more information about the safeguards relevant to your data using the contact details below.

12. Security, automation and AI

We use measures appropriate to the information and risk, including access controls, confidentiality duties, secure cloud services and multi-factor authentication where available. No online service can be guaranteed completely secure. We investigate suspected breaches and notify the ICO and affected people where the law requires.

We may use software automation and AI-assisted tools to help organise, extract, analyse or draft material. We use safeguards and human review for professional work. We do not knowingly use identifiable confidential client data to train unrestricted public AI models without a suitable legal basis and protection. We do not currently make decisions about individuals that have legal or similarly significant effects based solely on automated processing; if that changes, we will provide the information and rights required by law.

13. How long we keep information

We retain information only as long as reasonably needed for the service, legal and professional duties, tax and accounting records, insurance, disputes and legitimate business purposes. Typical periods are below; a longer or shorter period may apply in a particular case.

These are our file-retention periods. Your own duty to retain original receipts, invoices and other records is separate and is explained in section 20 of our Terms of Business. We delete, anonymise or securely dispose of information when it is no longer needed, subject to backup cycles and legal holds.

14. Website, cookies and analytics

Our website uses essential technology to operate and remember privacy choices. It may also use analytics and advertising technologies, including Google Analytics and Google Ads through Google Tag Manager, WordPress statistics and related services, depending on our current configuration and your choices. These tools may collect IP address, device and browsing information and may involve other providers receiving data. Details of individual cookies, their providers and durations are available through our website’s Consent Preferences control.

Where consent is required for non-essential cookies or similar technology, we ask for it before using that technology. You can accept, reject or change non-essential choices through the cookie banner or the Consent Preferences control on the website. You can also clear cookies in your browser. Essential cookies may still be used to deliver the site and remember your choices.

Our site may contain links to other websites with their own privacy information. We are not responsible for their content or practices.

15. Your rights

Depending on the circumstances and the lawful basis, you may ask us to give you access to your information, correct it, erase it, restrict its use, provide portable data or stop certain processing. You may withdraw consent at any time where we rely on it. These rights have conditions and exceptions; for example, we may need to retain records to meet a legal or professional obligation.

You have an absolute right to object to direct marketing. You can also object to processing based on legitimate interests in certain circumstances. Contact us using the details below. We may ask for proof of identity before responding and will explain any lawful reason we cannot meet a request in full.

16. Keeping information accurate

Please tell us if your contact details or other information relevant to our work changes, so that we can keep our records current and send important information to the right place.

17. Contact and complaints

For privacy questions or to exercise a right, contact Samuel Brogden, Director and privacy point of contact, at sam@sbbusinessconsulting.co.uk, 01242 350490, or by post at SB Business Consulting Limited, 28 Townsend Street, Cheltenham, GL51 9HD.

Please contact us first if you are concerned about how we use your information. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or 0303 123 1113.

18. Changes to this notice

We may update this notice to reflect changes in our services, providers or the law. The current version and its date will appear on this page. Where a change materially affects how we use information, we will provide further notice where required.