Privacy Policy

This policy explains how we collect, use, share and protect personal data, and what your rights are. It applies to personal data we hold about clients, prospective clients, the individuals connected with them (such as directors, shareholders, partners, beneficial owners and employees), our suppliers, our contacts, visitors to our website and applicants for roles with us.

We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you are engaging us for professional services, this policy should be read alongside our Standard Terms of Business and your engagement letter.

2. Who We Are and Who Controls Your Personal Data

UHY Williamson Croft is an accountancy, tax, audit and business advisory practice. We provide services through three separate trading companies. Each company is a separate legal entity and each is the controller of the personal data it processes for its own clients and engagements. The company that controls your personal data is the company named in your engagement letter.

Each company is registered separately with the Information Commissioner’s Office (ICO):

Company	Company no.	Registered office	ICO registration
Williamson Croft Accountants Limited	10332044	York House, 20 York Street, Manchester, M2 3BB	ZB395160
Williamson Croft (Liverpool) Limited	04461831	1 Old Hall Street, Liverpool, Merseyside, L3 9HF	Z9808512
Williamson & Croft Audit Limited	10492101	York House, 20 York Street, Manchester, M2 3BB	ZA269347

Where we describe ourselves in this policy as “we”, “us” or “our”, we mean the company that controls your personal data. Some of our systems are shared across the three companies, including our client relationship management and marketing systems. Where the companies jointly decide how personal data held in a shared system is used — for example, our marketing list — they act as joint controllers for that processing. They have agreed between them which company is responsible for each data protection obligation, and a summary of that arrangement is available on request. Whichever company you deal with, you can contact us about any of them using the details in section 16 and exercise your rights in respect of any of them.

We are not required to appoint a statutory data protection officer and have not done so. Data protection enquiries are handled centrally, using the contact details in section 16.

3. The Personal Data We Collect

The personal data we collect depends on our relationship with you and the services we provide. It may include:

your name, job title or role, and the organisation you are connected with;
your contact details, including postal address, email address and telephone numbers;
identification and verification data we are required to obtain under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 — for example passport or driving licence details, date of birth, nationality and proof of address;
financial and tax information, including income, employment, benefits, investments, property, bank details, National Insurance number and Unique Taxpayer Reference;
information about your family or household where it is relevant to the tax or advisory work we are carrying out for you — for example marital status, dependants and connected parties;
information about your business interests, shareholdings, directorships and related parties;
correspondence and records of our dealings with you, including notes of meetings and calls;
where you apply for a role with us, your education and employment history, references and right-to-work information; and
technical information about your use of our website, such as IP address, browser type and pages visited, collected through cookies as described in our Cookie Policy.

Special category personal data. When we verify your identity electronically, our identity verification provider compares a live image of your face with the photograph on your identity document (see section 4). This involves biometric data, which is special category data. We carry out this check only with your explicit consent under Article 9(2)(a) of the UK GDPR, which we will ask you for before the check is carried out. You do not have to consent: if you prefer, we will verify your identity using certified copies of your documents and a short video call instead, and this will not affect our decision to act for you. You can withdraw your consent at any time by contacting us, although this will not affect a check that has already been completed. Other than this, we do not ordinarily seek personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, health, sex life or sexual orientation. Where a specific engagement genuinely requires us to process such data, we will tell you at the time and identify the condition under Article 9 of the UK GDPR that we rely on.

Anti-money laundering checks and criminal offence data. The anti-money laundering screening described in section 4 may return information about criminal allegations, proceedings or convictions, for example from enforcement records or adverse media. We process this information only to meet our obligations under the Money Laundering Regulations 2017, relying on the condition in paragraph 12 of Schedule 1 to the Data Protection Act 2018 (regulatory requirements relating to unlawful acts and dishonesty), and we maintain an appropriate policy document as that Act requires. Any potential match is reviewed by a member of our team before any decision is taken. Personal data we receive for the purposes of the Money Laundering Regulations 2017 is processed only for the purposes of preventing money laundering or terrorist financing, unless another use is permitted by law or you have consented to it. We do not otherwise seek criminal offence data unless a specific engagement requires it, in which case we process it only where a condition under the Data Protection Act 2018 applies.

4. Where We Obtain Personal Data

Most of the personal data we hold is provided directly by you or by the organisation you are connected with. We may also obtain personal data from:

HM Revenue and Customs and other government bodies, where we are authorised to act as your agent;
Companies House, the ICO register and other public registers;
our client onboarding platform, provided by Uniify ApS (Denmark), which we use for anti-money laundering purposes. Within Uniify, Veriff verifies your identity by comparing your photo ID with a live image of your face taken on your phone, and screening against sanctions, politically exposed persons and adverse media sources uses data provided by LexisNexis Risk Solutions;
your previous advisers, where professional clearance is sought and given;
banks, lenders, insurers and other professional advisers where you have asked or authorised us to deal with them; and
publicly available sources and your organisation’s website, where we are researching a prospective engagement.

5. Why We Process Personal Data

We process personal data in order to:

provide the professional services set out in your engagement letter, including accounts preparation, tax compliance and advisory work, audit, payroll and other agreed services;
carry out client due diligence, identity verification and ongoing monitoring, and to make reports where we are required to do so by law;
comply with our legal and regulatory obligations, including those under the Companies Act 2006, tax legislation, the Money Laundering Regulations 2017 and the standards of our professional bodies;
administer our relationship with you, including managing engagements, resourcing work, raising invoices and collecting fees;
respond to and investigate complaints, and to establish, exercise or defend legal claims;
meet the quality assurance, monitoring and practice assurance requirements of the ACCA, the ICAEW and, in relation to audit work, the Financial Reporting Council;
arrange and administer our professional indemnity insurance and to notify claims;
keep you informed about our services, publications and events, in accordance with section 12;
organise events and produce delegate materials;
recruit and assess applicants for roles with us;
protect our business, our staff and our clients from fraud, financial crime, cyber security threats and other risks; and
operate, monitor and improve our website.

6. Our Lawful Bases for Processing

We must have a lawful basis under Article 6 of the UK GDPR for everything we do with personal data. The basis we rely on depends on the purpose:

Purpose	Lawful basis	Notes
Providing the professional services set out in your engagement letter	Performance of a contract — Article 6(1)(b)	Where you are not personally the contracting party — for example you are a director of a corporate client — we rely on our legitimate interests instead
Client due diligence, identity verification, sanctions screening and regulatory reporting	Legal obligation — Article 6(1)(c)	Required by the Money Laundering Regulations 2017. The biometric facial check also relies on your explicit consent (Article 9(2)(a)); any criminal offence data relies on paragraph 12 of Schedule 1 to the Data Protection Act 2018.
Statutory filings, tax returns and other work we are legally required to carry out or retain records of	Legal obligation — Article 6(1)(c)
Practice administration, fee recovery, complaints, claims, quality assurance, insurance, risk management and business development	Legitimate interests — Article 6(1)(f)	See the list of our legitimate interests below
Marketing to individuals who are not existing clients	Consent — Article 6(1)(a)	A clear opt-in, which you may withdraw at any time
Non-essential cookies and similar technologies	Consent — Article 6(1)(a)	Managed through the consent tool on our website

Our legitimate interests. Where we rely on legitimate interests, the interests we are pursuing are:

running, administering and managing our practice efficiently;
maintaining and developing our relationships with clients and contacts, and telling existing clients about services that may be relevant to them;
recovering our fees and resolving fee disputes;
investigating and responding to complaints and establishing, exercising or defending legal claims;
meeting the quality assurance and monitoring requirements of our professional bodies;
obtaining and maintaining professional indemnity insurance;
making and receiving referrals within the UHY international network and to other companies within our group;
preventing and detecting fraud, financial crime and cyber security incidents, and protecting our staff, clients and systems; and
understanding how our website is used so that we can improve it.

Before relying on legitimate interests we consider whether the processing is necessary, and we balance our interests against your rights and reasonable expectations. You may object to processing carried out on this basis — see section 14.

We do not sell personal data. We share it only where we need to, and we require anyone acting for us to keep it confidential and secure. We may share personal data with:

HM Revenue and Customs, Companies House, the Pensions Regulator and other government and regulatory bodies, where we act as your agent or are required to make a filing or report;
other companies within our group and other members of the UHY international network, where relevant to your engagement or a referral you have agreed to;
subcontractors and specialist advisers we engage to assist with your work, where you have agreed or where your engagement letter permits it;
our professional bodies — the ACCA and the ICAEW and, in relation to audit work, the Financial Reporting Council — and their quality assurance reviewers, who are bound by confidentiality;
the Office for Professional Body Anti-Money Laundering Supervision, where required;
our client onboarding and anti-money laundering providers — Uniify ApS, Veriff and LexisNexis Risk Solutions — to carry out the identity verification and screening described in section 4;
our professional indemnity and fee protection insurers, brokers and legal advisers, where a claim, potential claim or complaint arises;
banks, lenders, insurers and your other advisers, where you have asked or authorised us to deal with them;
our software and service providers, who process personal data on our instructions — including cloud hosting, practice and document management, tax and accounts production, payroll, email and productivity, e-signature, and marketing platforms; and
the police, other law enforcement agencies, the courts, tribunals and the ICO, where we are permitted or required by law to do so.

Where a provider processes personal data on our behalf, we put a written contract in place that meets the requirements of Article 28 of the UK GDPR.

8. Transfers of Personal Data Outside the United Kingdom

Some of the providers we use are based outside the United Kingdom, or store or access data outside it — most commonly in the United States and the European Economic Area. This applies principally to cloud hosting, email and productivity, document management, AI-assisted tools, and our client onboarding, identity verification and anti-money laundering screening providers.

Where personal data is transferred outside the UK, we make sure the transfer is covered by one of the mechanisms permitted under Chapter V of the UK GDPR. Depending on the provider and the country, that will be:

UK adequacy regulations, where the government has decided the country provides an adequate level of protection — this covers transfers to the EEA;
the International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission’s standard contractual clauses; or
the UK Extension to the EU–US Data Privacy Framework, where the provider is certified under it.

Where we rely on the IDTA or the UK Addendum, we also carry out a transfer risk assessment. You can ask us for more information about the safeguards applying to a particular transfer using the contact details in section 16.

9. Use of Artificial Intelligence

We use artificial intelligence tools to assist with tasks such as research, drafting, data analysis, document review and administrative work. We use only tools that the firm has approved for professional use and that meet our requirements for security and confidentiality, and we do not input confidential information or personal data into any tool that has not been approved for that purpose.

AI tools support, but do not replace, the professional judgement of our partners and staff. All AI-assisted output is reviewed by a suitably qualified member of our team before it is relied upon or shared. We do not use AI to make automated decisions about you — see section 15.

Further detail on our use of AI in client work is set out in our Standard Terms of Business.

10. How We Keep Personal Data Secure

We have technical and organisational measures in place designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These include access controls, encryption, multi-factor authentication, secure file transfer, monitoring, backups and staff training. We review these measures regularly.

Where we are required to do so, we report personal data breaches to the ICO, and to affected individuals, within the timescales set by the UK GDPR.

11. Cookies

Our website uses cookies and similar technologies. We ask for your consent before setting any cookie that is not strictly necessary, and you can change your preferences at any time using the cookie settings on our website. We use strictly necessary cookies, which the website needs in order to work, and analytics cookies, which help us understand how the website is used. Analytics cookies are set only with your consent. Our Cookie Policy, available at williamsoncroft.co.uk/cookie-policy, gives further detail and is updated separately from this policy.

12. Marketing

We may send you information about our services, publications, technical updates and events. Where you are an existing client, or you have asked us about our services, we do this on the basis of our legitimate interests in maintaining our relationship with you. Where you are not, we will only send you marketing if you have opted in.

Every marketing message we send includes a way to opt out, and you can ask us to stop at any time by contacting us using the details in section 16 or by speaking to your usual contact. Opting out of marketing will not affect the professional services we provide to you.

13. How Long We Keep Personal Data

We keep personal data only for as long as we need it. Our normal retention periods are:

Records	Retention period
Tax returns and supporting records	Seven years from the end of the tax year to which they relate
Ad hoc advisory work	Seven years from the date our business relationship ends
Ongoing client relationships	Retained for the life of the relationship where needed for multi-year compliance, then for seven years after the relationship ends
Client due diligence and anti-money laundering records	Retained in line with the Money Laundering Regulations 2017 and our professional body requirements
Recruitment records for unsuccessful applicants	Normally six months after the recruitment process ends, unless you agree to us keeping them longer
Personal data we process on a client’s behalf as processor	Deleted or returned to the client annually, or on termination of the contract

We may keep personal data for longer where we are required to by law, where it is needed in connection with an actual or potential claim, complaint or investigation, or where you have asked us to.

14. Your Rights

You have the following rights in relation to your personal data. Some of them apply only in certain circumstances, and we will explain the position if a right does not apply to your request.

Access. You can ask for a copy of the personal data we hold about you, and for information about how we use it. We will respond within one month, although we may extend this by up to two further months for complex requests, and we will tell you if we do.
Rectification. You can ask us to correct personal data that is inaccurate, or to complete data that is incomplete.
Erasure. You can ask us to delete personal data. This right is limited — we are often unable to delete records we are required to keep by law or by our professional bodies, or that we need in connection with a claim.
Restriction. You can ask us to limit how we use your personal data in certain circumstances, for example while we investigate a concern you have raised about its accuracy.
Objection. You can object to processing we carry out on the basis of our legitimate interests, and you can object to direct marketing at any time. Where you object to direct marketing we will always stop.
Portability. Where we process personal data you have provided to us by automated means, on the basis of consent or contract, you can ask us to provide it to you or to another organisation in a structured, commonly used, machine-readable format.
Withdrawing consent. Where we rely on your consent, you can withdraw it at any time. This will not affect the lawfulness of anything we did before you withdrew it.

There is normally no charge for exercising these rights. To make a request, contact us using the details in section 16. We may ask you for information to confirm your identity before we respond.

15. Automated Decision-Making and Profiling

We do not make decisions about you that are based solely on automated processing and that have a legal or similarly significant effect on you. We do not carry out profiling of that kind.

16. How to Contact Us

For any question about this policy, about how we handle personal data, or to exercise any of your rights, please contact us:

by email at info@uhy-williamsoncroft.com; or
by post at UHY Williamson Croft, York House, 20 York Street, Manchester, M2 3BB.

Please tell us which of our companies you deal with, or which engagement your question relates to, so that we can direct it to the right place.

17. Complaints

If you are unhappy with how we have handled your personal data, please tell us first using the details above so that we have the chance to put it right. Our complaints procedure is set out in our Standard Terms of Business.

You also have the right to complain to the Information Commissioner’s Office at any time:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone 0303 123 1113
ico.org.uk

18. Changes to This Policy

We review this policy regularly and may update it to reflect changes in the law, in regulatory guidance or in the way we work. The current version is always available on our website, and the version date is shown at the top of this policy. Where a change is significant we will tell clients directly.