1. WHO WE ARE

IPA Bookkeeping & Accounting Ltd (“IPA”, “we”, “us” or “our”) is a UK bookkeeping practice based in Suffolk.

Business address:
Heathlings
Fengate Drove
Weeting
Brandon
Suffolk
IP27 0PW
United Kingdom

Privacy and data protection enquiries:
ipa.bookkeeping.clients@gmail.com

Telephone:
07494 106238

Email is our preferred method of contact for privacy and data protection enquiries.

IPA Bookkeeping & Accounting Ltd is registered with the Information Commissioner’s Office (ICO) as a data controller.

ICO registration reference: ZB517655

2. ABOUT THIS PRIVACY NOTICE

This Privacy Notice explains how IPA Bookkeeping & Accounting Ltd collects, uses, stores and shares personal information.

It applies where you:

• visit or contact us through our website;
• enquire about our services;
• are a prospective, current or former client;
• are a director, partner, beneficial owner or other person connected with a client;
• provide information in connection with bookkeeping, accounting, tax or related services; or
• otherwise communicate or interact with us.

The personal information we process depends on the circumstances and the services being provided.

3. PERSONAL INFORMATION WE MAY COLLECT

Depending on our relationship with you and the services being provided, we may process:

• your name and contact details, including email address and telephone number;
• residential and business addresses;
• date of birth;
• Unique Taxpayer Reference (UTR);
• National Insurance number;
• VAT registration number;
• company registration details and other business information;
• passports, driving licences and other identification documents;
• proof-of-address documentation;
• information about directors, partners, beneficial owners and other relevant individuals;
• bookkeeping and accounting records;
• invoices, receipts, expenses and supporting documents;
• bank account details, bank statements, bank-feed information and transaction data;
• income, expenditure and other financial information;
• tax information, calculations, liabilities and relevant HMRC correspondence;
• correspondence and other information supplied during our relationship; and
• personal information about other people contained in records supplied to us, such as customers, suppliers, employees or tenants.

We only seek to collect and process personal information that is relevant to the purposes for which it is required.

4. INFORMATION COLLECTED THROUGH OUR WEBSITE

Our website is built and hosted using 123 Reg Website Builder.

If you use our website contact or enquiry form, we currently collect:

• your name;
• your email address; and
• the information you choose to include in your message.

Name and email address are required fields.

File attachments are currently disabled.

Information submitted through the form is sent through the 123 Reg Website Builder contact-form service to our business email account.

We use Google reCAPTCHA on our contact form to help protect our website against spam, abuse and automated submissions.

For further information about cookies and similar website technologies, please see our Cookie Notice.

5. ANTI-MONEY LAUNDERING AND IDENTITY VERIFICATION

As a UK bookkeeping practice, we are subject to anti-money laundering requirements.

We carry out customer due diligence, identity verification, client risk assessment and ongoing AML-related checks where required.

Depending on the circumstances, this may involve processing:

• your name, date of birth and residential address;
• identification documents;
• proof-of-address information;
• identity-verification information and results;
• information about directors, partners and beneficial owners;
• politically exposed person (PEP) screening results;
• sanctions screening results;
• adverse-media screening results;
• source-of-funds information where required;
• source-of-wealth information where required; and
• AML risk assessments, risk ratings and records supporting AML decisions.

Source-of-funds and source-of-wealth information is not routinely requested from every client. It may be required depending on the circumstances, our risk assessment or applicable AML requirements.

We currently use ICB AML Online as our main system for client due diligence and client AML risk assessments.

We also use Xama Technologies as an AML/KYC, identity-verification and compliance platform to support information and document collection, electronic identity verification and relevant AML checks.

Electronic identity verification may involve photographs or selfies and biometric information used for identity-verification purposes.

Do not start or continue work where AML checks are incomplete or unresolved without review.

6. SPECIAL-CATEGORY PERSONAL INFORMATION

We do not intentionally request special-category personal information as part of our normal bookkeeping, accounting or tax services.

However, this type of information may occasionally appear incidentally in records or documents supplied to us.

For example, bookkeeping records or correspondence could reveal information concerning health, religious beliefs, trade-union membership or another special category of personal information.

Separately, biometric information may be processed where electronic identity verification is undertaken through our AML/KYC provider.

Where special-category personal information is processed, we apply the additional conditions and protections required by applicable data protection law.

7. WHERE WE OBTAIN PERSONAL INFORMATION

We may obtain personal information:

• directly from you;
• from people who refer prospective clients to us;
• from a spouse or partner, business partner, employee or another person authorised to provide information;
• from a previous bookkeeper or accountant;
• from HMRC where we are appropriately authorised to act;
• from Companies House and other relevant public registers or publicly available sources;
• through ICB AML Online and Xama;
• from identity-verification and AML information providers;
• through bookkeeping, accounting and data-capture systems to which we have authorised access for a client, including Xero, QuickBooks Online, FreeAgent, Dext, AutoEntry and Hammock; and
• through Xenon Connect and connected bookkeeping or accounting systems.

We may therefore receive personal information about you from a source other than directly from you.

8. WHY WE USE PERSONAL INFORMATION

We may process personal information to:

• respond to enquiries;
• take steps requested by prospective clients before entering into an engagement;
• assess whether we can provide requested services;
• establish and manage client relationships;
• provide agreed bookkeeping, accounting, VAT, tax or related services within our service scope;
• maintain bookkeeping and accounting records;
• communicate with clients and prospective clients;
• carry out customer due diligence, identity verification and AML risk assessments;
• conduct relevant PEP, sanctions and other AML checks;
• comply with legal, regulatory and professional requirements;
• communicate with HMRC where appropriately authorised;
• administer and manage our practice and workflows;
• review bookkeeping information and maintain service quality;
• protect our website and contact form against spam and misuse;
• maintain appropriate business, regulatory and compliance records;
• obtain professional advice or deal with insurance or legal matters;
• respond to lawful requests from regulators, courts or competent authorities; and
• send marketing communications where you have agreed to receive them.

9. OUR LAWFUL BASES FOR USING PERSONAL INFORMATION

The lawful basis we rely on depends on why we are processing personal information.

Depending on the circumstances, we may rely on the following lawful bases.

Contract

We may process personal information where this is necessary to take steps you request before entering into an agreement with us or to perform our agreement with you.

Legal obligation

We may process personal information where this is necessary to comply with applicable legal requirements, including relevant anti-money laundering obligations.

Legitimate interests

We may process personal information where this is necessary for a legitimate business purpose and, after considering the circumstances, those interests are not overridden by your rights and interests.

Our legitimate interests may include appropriately administering and protecting our business, responding to general business communications, maintaining appropriate business records, protecting our website and systems, and establishing, exercising or defending legal rights where relevant.

Consent

We may rely on consent where we ask you to make a genuine choice, including under our current approach to email marketing.

Where we rely on consent, you may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Where special-category personal information is processed, we also identify an appropriate additional condition under applicable data protection law.

10. INFORMATION WE NEED FROM YOU

Some personal information is necessary so that we can:

• take requested steps before providing services;
• enter into and perform our engagement with you; or
• comply with legal and regulatory requirements.

In particular, we may be legally required to obtain sufficient information and evidence to complete applicable AML customer due diligence and identity-verification requirements.

If information that we reasonably require for these purposes is not provided, we may be unable to accept an engagement, begin providing services or, in some circumstances, continue an existing engagement.

We will only request information that is relevant to the purpose for which it is required.

11. WHO WE MAY SHARE PERSONAL INFORMATION WITH

Where necessary and appropriate, we may share or make personal information available to:

• HM Revenue & Customs (HMRC), where we are authorised to act for a client;
• the Institute of Certified Bookkeepers (ICB), including in its role as our professional body and AML supervisor where applicable;
• ICB AML Online;
• Xama Technologies and relevant AML/KYC or identity-verification providers;
• Engager.app;
• Xenon Connect;
• accounting and bookkeeping software providers, including Xero, QuickBooks Online, FreeAgent, Dext, AutoEntry and Hammock, depending on the systems used for the particular client;
• Google/Gmail in connection with business email and communications;
• 123 Reg in connection with our website, hosting and website enquiries;
• banking platforms where authorised bank-feed connections are used for bookkeeping;
• professional advisers and insurers where reasonably necessary; and
• courts, law-enforcement bodies, regulators and other competent authorities where disclosure is required or permitted by law.

We do not otherwise routinely disclose client information directly to banks merely because bank information forms part of bookkeeping records.

We only share personal information where there is an appropriate reason to do so and seek to limit disclosures to information relevant to the purpose.

12. INTERNATIONAL PROCESSING

Some of the software, cloud, communications and service providers we use operate internationally or may use service providers or subprocessors located outside the United Kingdom.

This means that personal information may, where relevant to the service being used, be processed or accessed outside the UK.

Where personal information is transferred internationally, we require the transfer to be handled in accordance with applicable UK data protection requirements.

Depending on the destination and circumstances, international transfers may rely on UK adequacy regulations or other safeguards recognised under UK data protection law, including appropriate contractual safeguards.

Processing locations and safeguards depend on the provider and service concerned and may change as providers update their infrastructure and subprocessors.

If you would like further information about international processing relevant to your personal information or the safeguards that apply, please contact:

ipa.bookkeeping.clients@gmail.com

13. HOW LONG WE KEEP PERSONAL INFORMATION

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected and to meet applicable legal, regulatory, professional, accounting, tax, anti-money laundering, contractual or claims-related requirements.

Different categories of information may therefore be retained for different periods.

When deciding how long information should be retained, we consider:

• why the information was collected and whether that purpose continues;
• the nature of our relationship with you and whether we continue to provide services;
• applicable legal and regulatory record-keeping requirements;
• AML record-keeping requirements;
• accounting and tax requirements;
• the nature and sensitivity of the information;
• whether information may be required to establish, exercise or defend legal claims; and
• whether another legitimate reason for continued retention applies.

Where personal information is no longer required, we take appropriate steps to delete, dispose of or anonymise it, subject to applicable legal or regulatory requirements.

14. MARKETING

IPA may send occasional marketing emails containing bookkeeping and tax updates, practical guidance, deadline reminders and information about our services.

Under our current approach, we maintain a marketing list only for people who have positively indicated that they wish to receive these communications.

Making an enquiry does not automatically add you to our marketing list.

If you contact us about our services, we may respond to your enquiry and may separately invite you to opt in to marketing communications.

You can withdraw your marketing consent at any time, including by replying to a marketing email and asking us to stop.

We do not currently use SMS or text messages for direct marketing.

15. HOW WE USE ARTIFICIAL INTELLIGENCE

We use AI-assisted tools to support certain practice activities, including research, drafting, reviewing and structuring information, preparing content, presentations and infographics, and other practice-support activities.

AI tools currently used for these purposes may include:

• ChatGPT;
• Claude;
• Perplexity;
• Google Gemini; and
• Google NotebookLM.

We do not intentionally provide identifiable client or prospective-client personal information to these generative AI tools.

Where information arising from a client matter or website enquiry is used for an appropriate AI-assisted practice-support activity, our current process is to remove identifying and private information beforehand.

Identifiable client documents and records are not intentionally uploaded to generative AI tools.

Wispr Flow is currently used for general dictation and note-taking and is not currently used to process identifiable client or prospective-client information.

Otter is currently used in connection with external webinars and is not currently used to record or transcribe client meetings.

AI-assisted outputs are subject to human review.

We do not use AI to make solely automated decisions about individuals that produce legal or similarly significant effects.

Decisions concerning client acceptance, AML risk, bookkeeping or accounting treatment, tax matters, client communications and services are made or reviewed by a person.

16. KEEPING PERSONAL INFORMATION SECURE

We take appropriate organisational and technical measures to protect personal information against unauthorised or unlawful processing and against accidental loss, destruction, alteration or disclosure.

Access to personal information is limited as appropriate to people and service providers who require it for legitimate business, professional, regulatory or service purposes.

No method of electronic storage or transmission can be guaranteed to be completely risk-free.

17. YOUR DATA PROTECTION RIGHTS

Depending on the circumstances and the lawful basis on which we process your personal information, you may have the right to:

• request access to personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to erase personal information in certain circumstances;
• ask us to restrict processing in certain circumstances;
• object to certain processing;
• receive certain personal information in a portable format where the right applies; and
• withdraw consent where our processing relies on consent.

These rights are not absolute in every situation.

For example, we may need to retain information where this is required by law or applicable regulatory requirements.

To exercise a data protection right, please contact:

ipa.bookkeeping.clients@gmail.com

We may need to verify your identity before responding to a request.

Your rights to object

Where we process your personal information on the basis of legitimate interests, you may have the right to object to that processing.

You also have the right to object to the use of your personal information for direct marketing.

To object, please contact:

ipa.bookkeeping.clients@gmail.com

18. AUTOMATED DECISION-MAKING

We do not use automated decision-making or profiling to make decisions about individuals that produce legal or similarly significant effects.

Decisions relating to client acceptance, AML risk, bookkeeping or accounting treatment, tax matters, communications and services are made or reviewed by a person.

19. CHILDREN

Our services are intended for adult business owners, sole traders, landlords, partners, company directors and other adult clients or prospective clients.

We do not knowingly provide services directly to children or knowingly collect personal information through our website from anyone under the age of 18.

20. QUESTIONS AND COMPLAINTS

If you have questions or concerns about how we handle your personal information, please contact us first so that we can investigate your concern.

IPA Bookkeeping & Accounting Ltd

Heathlings
Fengate Drove
Weeting
Brandon
Suffolk
IP27 0PW
United Kingdom

Email: ipa.bookkeeping.clients@gmail.com

Telephone: 07494 106238

You also have the right to complain to the Information Commissioner’s Office (ICO) if you are concerned about how your personal information has been handled.

You can find information about making a data protection complaint on the ICO's website.

21. CHANGES TO THIS PRIVACY NOTICE

We keep this Privacy Notice under review.

We may update it when our:

• services change;
• systems or software change;
• website technologies change;
• service providers change;
• marketing activities change;
• AML or identity-verification arrangements change;
• AI use or data-processing practices change; or
• applicable legal or regulatory requirements change.

Where a change materially affects how we use personal information, we will take appropriate steps to bring the change to the attention of affected individuals where required.

The current version of this Privacy Notice will be published on our website.

This document should be reviewed following any material change to IPA's processing activities and checked against current ICO, ICB, HMRC or other official guidance where relevant.

Last updated: 30 September 2026