Last updated: 8th August 20226
1. Who we are
Blythe Phillips Accountants (“we”, “us”, “our”) is an accountancy practice based in Halesowen, West Midlands. We are the data controller for the personal data described in this notice.
| Legal name | Blythe Phillips Ltd |
|---|---|
| Company number | 07018016 |
| Address | 8/9 Earls Way, Halesowen, West Midlands, B63 3HR |
| Telephone | 0121 550 5700 |
| privacy@blythephillips.co.uk | |
| ICO registration number | Z2619787 |
| Regulated by | CIMA |
We are not required to appoint a Data Protection Officer. Data protection queries should be sent to Keith Harvey using the details above.
2. What this notice covers
This notice explains how we collect and use personal data about:
- visitors to our website at blythephillips.co.uk
- prospective clients who contact us
- clients and, where relevant, their directors, shareholders, partners, employees and beneficial owners
- suppliers, contacts and job applicants
3. The personal data we collect
3.1 If you use our website
Our website is deliberately minimal. We do not use analytics, advertising trackers or profiling tools.
When you submit the contact form, we collect:
- your name
- your email address
- your telephone number, if you provide it
- the content of your message
- any files you choose to attach
Our web host records standard server logs, which include IP addresses, browser type and pages requested. These are generated automatically for security and troubleshooting.
Please do not send sensitive personal or financial documents through the website contact form. It is intended for general enquiries. Once we are in contact, we will tell you a secure way to send documents.
3.2 If you are a client, or connected to one
To provide accountancy, tax, payroll and related services we typically process:
- name, address, date of birth and contact details
- National Insurance number, Unique Taxpayer Reference, tax and VAT registration numbers
- income, expenditure, assets, liabilities and other financial information
- bank account and payment details
- employment and payroll data, including salary, pension and benefits
- identification documents such as a passport, driving licence or proof of address, collected for anti-money-laundering checks
- company records, including directorships, shareholdings and beneficial ownership
- correspondence between us
Where you are our client, we may also process personal data about other people — your employees, family members, business partners or beneficial owners. Where you provide us with that data, you are responsible for ensuring you may lawfully share it with us, and for making those individuals aware of this notice.
3.3 Special category and criminal offence data
Occasionally we process special category data, for example health information relevant to a benefits or tax claim, and criminal offence data, for example where anti-money-laundering screening returns a result or where a tax matter involves an investigation or penalty.
We only do so where we have a lawful basis under Article 9 or Article 10 of the UK GDPR — usually because processing is necessary for reasons of substantial public interest, for the establishment, exercise or defence of legal claims, or because you have given explicit consent.
4. Where we get personal data from
- directly from you
- from HMRC, Companies House and other government bodies
- from your previous accountant or adviser, on your authority
- from banks, payroll providers and accounting software you ask us to access
- from anti-money-laundering and identity verification services
- from publicly available sources such as the Companies House register
5. Why we use your personal data, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Respond to your enquiry | Legitimate interests — replying to someone who has contacted us |
| Provide accountancy, tax, payroll and advisory services | Contract — necessary to perform our engagement with you |
| Carry out anti-money-laundering and client due diligence checks | Legal obligation — Money Laundering Regulations 2017 |
| File returns and correspond with HMRC and Companies House | Legal obligation and contract |
| Keep accounting and tax records | Legal obligation |
| Manage our practice, including invoicing and credit control | Legitimate interests — running our business |
| Protect our website from spam and abuse | Legitimate interests — security of our systems |
| Deal with complaints, disputes or professional claims | Legitimate interests and legal claims |
| Send you updates about tax and accounting matters, where you have asked to receive them | Consent — you may withdraw it at any time |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and concluded that they are not. You may ask us for details of that assessment.
6. Who we share your personal data with
We do not sell personal data, and we do not share it for marketing purposes.
We share it with:
- HMRC, Companies House and other regulators or government bodies
- our software and IT providers — accounting, tax, payroll and practice management software, our IT support and our web host
- anti-money-laundering and identity verification providers
- our professional body for practice assurance and monitoring
- our professional advisers, including insurers, lawyers and auditors
- banks and payment providers, where relevant to a service we provide
- subcontractors who assist us, under written confidentiality terms
We may also disclose personal data where we are legally required to do so. In particular, we are obliged to report suspicions of money laundering to the National Crime Agency, and we are prohibited by law from telling you if we do so.
7. Sending data outside the UK
Some of our software providers store data outside the UK. Where that happens, we make sure it is protected by an appropriate safeguard, normally UK adequacy regulations or the International Data Transfer Agreement or Addendum. You may ask us for details of the safeguards that apply to a particular provider.
8. How long we keep your personal data
| Record | Retention period |
|---|---|
| Website enquiries that do not lead to an engagement | 12 months, then deleted |
| Client engagement files, accounts and tax records | 7 years from the end of the relevant tax year or engagement |
| Anti-money-laundering records and identification documents | 5 years from the end of the business relationship, as required by the Money Laundering Regulations 2017 |
| Payroll records | 6 years from the end of the tax year |
| Correspondence relating to a complaint, dispute or claim | 7 years from resolution, or longer where a claim remains possible |
| Unsuccessful job applications | 6 months |
| Server logs | As set by our hosting provider, typically a few weeks |
Where we no longer need personal data, we delete it or securely destroy it.
9. How we protect your personal data
We take appropriate technical and organisational measures, including encrypted connections to our website, access controls and two-factor authentication on key systems, access restricted on a need-to-know basis, staff confidentiality obligations, and regular review of our systems and suppliers.
No system is completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours, and will tell you directly where the risk to you is high.
10. Your rights
Under UK data protection law you have the right to:
- be informed about how we use your data — this notice
- access the personal data we hold about you
- have inaccurate data corrected
- have data erased, where we no longer have grounds to keep it
- restrict how we use your data in certain circumstances
- object to processing carried out on the basis of legitimate interests
- receive certain data in a portable format
- withdraw consent at any time, where we rely on consent
These rights are not absolute. We often cannot delete data that we are legally required to keep — anti-money-laundering records in particular must be retained for five years regardless of any erasure request.
To exercise a right, contact us using the details in section 1. We will respond within one month. There is normally no charge.
11. Cookies
Our website uses very few cookies and sets no advertising or tracking cookies. Please see our Cookie Policy for full details.
12. Changes to this notice
We may update this notice from time to time. The current version is always on our website, and the date at the top shows when it was last changed.
13. How to complain
If you are unhappy with how we have handled your personal data, please contact us first using the details in section 1 — we would like the chance to put it right.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint