Legal
Privacy policy
Last updated 21 October 2026
This policy explains how Aethon Accountancy Ltd collects, uses, shares and protects personal data. It covers this website, our services and our client portal. It’s written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Money Laundering Regulations 2017 and AAT’s professional standards.
1. Who we are
Aethon Accountancy is an accountancy practice regulated by the Association of Accounting Technicians (AAT). We are the data controller for the personal data we process.
- Company: Aethon Accountancy Ltd, registered in England and Wales, company number 17284774
- Registered office: 2 Western Close, Bradford, BD6 2BZ
- VAT number: GB 522 7131 23
- ICO registration number: ZC182101
- AAT member number: 1010198
- Privacy contact: keiran.hirst@aethonaccountancy.co.uk
2. What personal data we collect
2.1 Clients and prospective clients
When you work with us or ask about our services, we may collect:
- Identity data: full name, date of birth, National Insurance number and Unique Taxpayer Reference
- Contact data: address, email address and phone number
- Financial data: bank details for your Direct Debit, income, expenses, tax records and VAT details
- Business data: company number, VAT number, PAYE reference and year end
- Anti-money laundering data: identity documents, source of funds and our risk assessment
- Engagement data: signed engagement letters, proposals and correspondence
2.2 Website visitors
- Technical data: your IP address, browser type, the pages you visit and when. Our website host records this to keep the site running and secure.
- Booking questionnaire: before you book a call, we ask a few quick questions about your business: what it does, how long it has been trading, its turnover band, the turnover you expect if you have no sales yet, whether you have an accountant, and how you found us (you can skip that one). We use your answers to suggest the right next step and add them to your booking so Keiran can prepare. On their own they don’t identify you. Once added to your booking, they’re stored with your booking details and kept as set out in section 7.
- Campaign tags in links: some of our links (for example from YouTube, TikTok, LinkedIn or our newsletter) carry tags in the web address, such as utm_source=youtube, that say where the link was shared. If you book a call from that page, we use the tags to answer “how you found us” for you and add them to your booking. We read them from the address only and don’t store them on your device. If you accept analytics, the source and campaign are also counted in Google Analytics.
- Call bookings: when you book a call, our booking tool Calendly collects your name, email address, the time you choose and anything you type in, and passes them to us.
- Messages: if you email us or message Keiran on LinkedIn, we receive your name, contact details and message.
- Analytics: only if you accept analytics cookies. See our cookie notice.
2.3 Client portal users
- Account details: your email address and sign-in details
- Activity data: files you upload, tasks you complete, documents you sign and records of portal access
- Electronic signatures: your typed name, a timestamp and your confirmation when you sign documents through the portal
2.4 Free resources
Our getting-set-up checklist remembers your ticks in your own browser’s storage. They are never sent to us.
3. Why we use your data, and our legal basis
We only process personal data where we have a valid legal basis under UK GDPR Article 6.
| Purpose | Legal basis |
|---|---|
| Providing accountancy services (tax returns, bookkeeping, VAT, payroll) | Performance of a contract, Article 6(1)(b) |
| Anti-money laundering checks and ongoing monitoring | Legal obligation under the Money Laundering Regulations 2017, Article 6(1)(c) |
| Reporting to HMRC, Companies House and other regulators | Legal obligation, Article 6(1)(c) |
| Setting up and managing your Direct Debit | Performance of a contract, Article 6(1)(b) |
| Preparing for and holding a call you have booked, including your questionnaire answers | Steps you have asked us to take before a contract, Article 6(1)(b), and legitimate interests, Article 6(1)(f) |
| Responding to enquiries from prospective clients | Legitimate interests, to answer you and check we're a good fit, Article 6(1)(f) |
| Sending marketing about our services | Legitimate interests for existing clients, consent for prospective clients, Article 6(1)(f) or (a). You can opt out at any time. |
| Website analytics | Consent, Article 6(1)(a), only if you accept analytics cookies |
| Keeping audit logs of access to sensitive records | Legitimate interests, to protect client data and show compliance, Article 6(1)(f) |
4. Our obligations as an AAT licensed practice
- We must verify the identity of every client before providing services. This is a legal requirement under the Money Laundering Regulations 2017.
- We may have to make a Suspicious Activity Report to the National Crime Agency if we have reasonable grounds to suspect money laundering or terrorist financing. The law doesn’t allow us to tell you if we do.
- AAT supervises us for anti-money laundering purposes. These obligations take priority over our normal duty of confidentiality.
- We must keep client files for at least five years after the end of our relationship (Money Laundering Regulations 2017, regulation 40).
6. Transfers outside the UK
Core client data is hosted in the UK. Some providers are based in the United States: Vercel (website hosting), Resend (email), Calendly (call bookings) and, only if you accept analytics cookies, Google (Google Analytics). Where data goes outside the UK, it is protected by safeguards recognised under UK law, such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum.
7. How long we keep your data
| Data | How long we keep it |
|---|---|
| Client tax records, accounts and financial data | 7 years from the end of the relevant tax year |
| Anti-money laundering records | 5 years from the end of the client relationship |
| Signed engagement letters, proposals and electronic signature records | 7 years |
| Enquiries, call bookings and questionnaire answers from prospective clients | 2 years from our last contact, or until you ask us to remove them |
| Client portal access logs | 3 years |
| Website technical logs | Up to 12 months |
After these periods, we securely delete or anonymise the data.
8. Your rights
Under UK GDPR you have the right to:
- Access: ask for a copy of the data we hold about you
- Rectification: ask us to correct anything inaccurate
- Erasure: ask us to delete your data, subject to the records the law requires us to keep
- Restriction: ask us to pause processing in certain circumstances
- Portability: receive your data in a structured, machine-readable format
- Objection: object to processing based on legitimate interests, including marketing
- Automated decisions: we don’t make solely automated decisions with legal or similarly significant effects. Our booking questionnaire only suggests a next step, and you can always email us instead.
To use any of these rights, email keiran.hirst@aethonaccountancy.co.uk. We’ll respond within one month.
Where we rely on your consent, you can withdraw it at any time, for example by unsubscribing from an email or changing your choice in Cookie settings. Withdrawing consent doesn’t affect anything we did before.
If you don’t give us data we need for a legal or contractual reason, we may not be able to act for you. For example, we can’t take you on as a client without verifying your identity.
9. How we protect your data
- Data is encrypted at rest and in transit
- Access is limited to the people who need it, and access to sensitive client records is logged
- Client documents are stored privately, and download links expire
- Core client data is hosted in the United Kingdom
If a data breach is likely to put your rights at high risk, we’ll tell you without undue delay, and we’ll report qualifying breaches to the ICO within 72 hours.
11. Changes to this policy
We may update this policy to reflect changes in the law, technology or our services. The current version is always on this page with its date. We’ll tell existing clients directly about material changes.
12. How to complain
If you’re worried about how we handle your data, please contact us first at keiran.hirst@aethonaccountancy.co.uk and we’ll do our best to put it right.
You also have the right to complain to the Information Commissioner’s Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
You can also refer a complaint about our professional conduct to AAT at aat.org.uk.