Privacy NOTICE

Last Updated: 05/10/2026

Introduction

XM Books and Accounts Ltd (“we”, “us”, or “our”) is committed to protecting your privacy and ensuring that your personal data is handled in a safe, responsible, and transparent way. This Privacy Notice explains how we collect, use, store, and protect your personal information in compliance with the Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR).
We may amend this privacy notice from time to time. If we do so, we will supply you with and/or otherwise make available to you a copy of the amended privacy notice.
Data Processor vs. Data Controller
Where we act as a data processor on behalf of a data controller (for example, when processing payroll for your employees), we provide an additional schedule setting out required information as part of that agreement. That additional schedule should be read in conjunction with this privacy notice.

Data We Collect

As a bookkeeping and accounts business, we collect specific categories of personal data to perform our contractual obligations and comply with legal requirements.
Personal Data of Individuals
  • Identity Data: Name, title, date of birth.
  • Contact Data: Billing address, delivery address, email address, and telephone numbers.
  • Financial Data: Bank account details (sort code, account number), credit/debit card details, and payroll information (including National Insurance numbers).
  • Transaction Data: Details of payments made and received, invoices, and receipts.
  • Employment Data: (If providing payroll services) Salary details, tax codes, and employee addresses.
Business Data
  • Company registration numbers, VAT numbers, and SIC codes.
Technical & Website Data
  • IP address, browser type, device information, and browsing patterns (collected via cookies).

Purposes for Which We Process Personal Data

We intend to process personal data for the following purposes:
  • To enable us to supply professional services to you as our client.
  • To fulfil our obligations under relevant laws in force from time to time (e.g., the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 as amended (“MLR 2017”)).
  • To comply with professional obligations (e.g., AAT ethical standards).
  • To enable us to invoice you for our services.

Legal Bases for Processing

Our intended processing of personal data has the following legal bases:
  • Performance of a Contract: The processing is necessary for the performance of our contract with you.
  • Legal Obligation: The processing is necessary for compliance with legal obligations to which we are subject (e.g., MLR 2017, Tax Laws).
It is a requirement of our contract with you that you provide us with the personal data that we request. If you do not provide the information that we request, we may not be able to provide professional services.

Data Sharing and Disclosure

We may share your personal data with:
  • HM Revenue & Customs (HMRC): As required by law.
  • Third Parties: Any third parties with whom you require or permit us to correspond.
  • Successors: An alternate appointed by us in the event of incapacity or death.
  • Insurers: Professional indemnity insurers.
  • Regulators: The AAT and/or the Office of Professional Body Anti-Money Laundering Supervisors (OPBAS) in relation to practice assurance and/or the requirements of MLR 2017.
If the law allows or requires us to do so, we may share your personal data with:
  • The police and law enforcement agencies.
  • Courts and tribunals.
  • The Information Commissioner’s Office (ICO).
We do not sell your personal data to third parties for marketing purposes.

Data Retention

Where tax returns have been prepared, it is our policy to retain information for 7 years from the end of the tax year to which the information relates. Our contractual terms provide for the destruction of documents after 7 years; therefore, agreement to the contractual terms is taken as agreement to the retention of records for this period, and to their destruction thereafter.
Documents and records relevant to your tax affairs are required by law to be retained by you as follows:
Individuals, Trustees, and Partnerships
  • With trading or rental income: 5 years and 10 months after the end of the tax year.
  • Otherwise: 22 months after the end of the tax year.
Companies, LLPs, and Other Corporate Entities
  • 6 years from the end of the accounting period.

Your Rights

Under the UK GDPR and DPA 2018, you have the following rights:
Right to Rectification
You have the right to obtain the rectification of any inaccurate personal data concerning you that we hold. You also have the right to have any incomplete personal data that we hold about you completed. Should you become aware that any personal data that we hold about you is inaccurate and/or incomplete, please inform us immediately so we can correct and/or complete it.
Right to Erasure
In certain circumstances, you have the right to have the personal data that we hold about you erased. Further information is available on the ICO website (www.ico.org.uk). If you would like your personal data to be erased, please inform us immediately and we will consider your request. In certain circumstances, we have the right to refuse to comply with a request for erasure (for example, if we are legally required to retain the data for tax purposes). If applicable, we will supply you with the reasons for refusing your request.
Right to Restrict Processing and Object
In certain circumstances, you have the right to ‘block’ or suppress the processing of personal data or to object to the processing of that information. Further information is available on the ICO website (www.ico.org.uk). Please inform us immediately if you want us to cease to process your information or you object to processing so that we can consider what action, if any, is appropriate.
Right to Data Portability
In certain circumstances, you have the right to be provided with the personal data that we hold about you in a machine-readable format (e.g., so that the data can easily be provided to a new professional adviser). Further information is available on the ICO website (www.ico.org.uk).
The right to data portability only applies:
  • To personal data an individual has provided to a controller.
  • Where the processing is based on the individual’s consent or for the performance of a contract.
  • When processing is carried out by automated means.
We will respond to any data portability requests made to us without undue delay and within one month. We may extend the period by a further two months where the request is complex, or several requests are received, but we will inform you within one month of the receipt of the request and explain why the extension is necessary.

Data Security

We implement appropriate technical and organisational measures to protect your data, including:
  • Encryption of data in transit and at rest.
  • Secure, password-protected cloud storage with multi-factor authentication (MFA).
  • Regular staff training on data protection and cybersecurity.
  • Restricted access to personal data on a “need-to-know” basis.

Complaints

If you have requested details of the information we hold about you, and you are not happy with our response, or you think we have not complied with the GDPR or DPA 2018 in some other way, you can complain to us. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Contact Us

If you have any questions about this Privacy Notice or wish to exercise your rights, please contact:
XM Books and Accounts Ltd
Email: xeni@xmbookkeeping.co.uk
Phone: 01273 569460