01 · WHO WE ARE

The firm responsible for your information

Welbourne & Co Ltd (trading as Welbourne + Co) is the controller of the personal information described in this notice. We're a company registered in England and Wales, number 07171141, with our registered office at 16 Birch Grove, Elm, Wisbech, Cambridgeshire PE14 0AP. We're registered with the Information Commissioner's Office, registration number Z2393982.

For any question about your information, or to exercise any of your rights, contact Richard Welbourne at [email protected] or on 01945 661999.

02 · WHAT WE HOLD

The information we collect

• Identity and contact details: name, address, date of birth, email, telephone, and copies of identity documents we're required to check.
• Tax and government references: National Insurance number, UTRs, VAT and PAYE references, Companies House personal codes.
• Financial information: income, bank and loan details, investments, property, pensions, and the business records you give us or give us access to.
• Payroll information about your employees, where we run your payroll: pay, tax codes, pension details and statutory payments.
• Family information where it affects your tax, such as a spouse's income or children for child benefit.
• Records of our dealings with you: emails, letters, notes of meetings and calls, and, where we tell you we're doing so, recordings or transcripts of calls and meetings.

Occasionally we hold more sensitive information, for example health details where they affect statutory sick pay or a tax relief. We only hold it where the work needs it.

Where it comes from

Mostly from you. We also receive information from HMRC and Companies House through our agent access, from your previous accountant, from software you give us access to (such as Xero), from identity verification services, and from public registers.

03 · WHY WE USE IT

Our reasons, and the legal basis for each

04 · WHO WE SHARE IT WITH

Sharing, and the firms that process data for us

We only share your information where the work needs it, the law requires it, or you've asked us to. That includes:

• HMRC, Companies House, The Pensions Regulator and pension providers, when we file or submit on your behalf.
• Banks, lenders, mortgage brokers or other advisers, when you ask us to.
• The Association of Chartered Certified Accountants (ACCA), which can inspect our files as part of its monitoring of our work.
• Our professional indemnity insurers and legal advisers, if a claim arises.
• The National Crime Agency or other authorities, where the law requires us to report.
• Other accountants we occasionally subcontract work to, who are bound by the same confidentiality terms as we are.

Software and service providers

We use business software that stores or processes information on our behalf, and we work inside software that you or your business already use. The providers are:

Where you already use one of these accounting or file-sharing services, the provider holds your information under your own agreement with them, and we access it with your permission.

We'll update this list when we change providers. The current version is always on our website.

05 · ARTIFICIAL INTELLIGENCE

How we use AI tools

We use AI tools to help our team work more efficiently, for example to analyse bookkeeping records, check figures, and prepare first drafts of documents and letters. The rules we work to:

• We use business versions of these tools, under terms that keep your information confidential and don't allow it to be used to train the provider's AI models.
• A member of our team reviews everything an AI tool produces before it is relied on or sent to you. Responsibility for our work stays with us.
• We don't use AI to make decisions about you that have legal or similarly significant effects without a person being involved.
• If we record or transcribe a call or meeting, we'll tell you at the start, and you can ask us not to.

06 · OUTSIDE THE UK

International transfers

Some of our providers, or their own suppliers, store or process information outside the UK, mainly in the European Economic Area and the United States. Where that happens, the transfer is protected by the safeguards UK law requires, such as a UK adequacy decision (including the UK-US data bridge) or the Information Commissioner's international data transfer agreement.

07 · HOW LONG WE KEEP IT

Retention

We may keep information longer where the law requires it, or where it's needed for a complaint, claim or investigation.

08 · KEEPING IT SECURE

Security

We keep information in secure cloud systems with access limited to the people who need it. Documents should be sent to us through our secure client portal where possible, because ordinary email can be intercepted. If a security incident affects your information in a way that puts you at risk, we'll tell you.

09 · YOUR RIGHTS

What you can ask us to do

You can ask us to:

• give you a copy of the information we hold about you;
• correct anything that's wrong or incomplete;
• delete information, or restrict how we use it;
• stop using it for a purpose based on our legitimate interests, including marketing;
• give your information to you, or another firm, in a usable electronic format.

Some of these rights are limited where we have to keep information by law, for example anti-money laundering and tax records. We'll respond within one month, and there's no charge in most cases.

10 · COMPLAINTS

If you're unhappy with how we've handled your information

Please tell us first. Email [email protected] with "Data protection complaint" in the subject, or write to us at the address in section 1. We'll acknowledge your complaint within 30 days, keep you updated while we look into it, and tell you the outcome.

You can also complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint, or 0303 123 1113.

11 · CHANGES

Updates to this notice

We review this notice at least once a year and when we change how we work. The current version is on our website, and we'll tell you about any significant change.