Client Privacy Notice - Alchemy Accountancy

Alchemy Accountancy Limited. Last updated: 13 November 2026.

This notice explains how we handle personal data about our clients and the people connected with them. For how we handle data about visitors to this website, see our privacy statement.

Contact details

Craig McCall is responsible for data protection compliance. Contact him about anything to do with your personal data, including making a subject access request:

Email: craig@alchemyaccountancy.com
Post: Ground Floor, 13 Cable Court, Pittman Way, Fulwood, Preston, PR2 9YW
Telephone: 01772 965550

Introduction

In this notice, “data protection legislation” means any law that applies to the processing, privacy and use of personal data, including UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020, and the Data (Use and Access) Act 2025.

Data protection legislation places legal obligations on organisations that process personal data. We are a data controller and we process personal data.

We will only hold or process your personal information to the extent necessary to provide the agreed professional services and for any other purpose specifically agreed.

Information we collect

We are entering into a contract with you and will process data to meet our contractual obligations. To provide the agreed services, we need to collect, keep and process personal data about you in order to:

take you on and keep you as a client under UK law and professional regulations, such as anti-money laundering requirements
prepare and file accounts and tax returns
advise on tax and national insurance liabilities
provide ad hoc advice

If you do not provide the information we need, we may not be able to provide the services, which would trigger the disengagement provisions in our terms of business.

The personal data we collect and process includes:

names and addresses
email addresses
telephone numbers
information held by HMRC
information needed to prepare your tax returns and accounts
correspondence between us

How we collect information

We collect information about you from:

you
your spouse or partner
HMRC
your organisation
electronic ID verification providers
other third parties you authorise, such as banks or investment managers

How we use your information

We may use the information we hold about you:

to provide services under our contract with you
to contact you about other services we provide that may interest you, if you have consented
to meet other legal and regulatory requirements
for other legitimate interests

We keep records in line with our retention policy so that we can defend ourselves against legal claims or disciplinary action brought within statutory time limits.

We may also use information from other people or organisations when carrying out these activities.

We may use software, including AI-enabled software, to analyse your information and highlight matters for our attention. No decision affecting you is made by automated means alone. A member of our team reviews and decides on anything that affects the service you receive.

Any subcontractors we use will comply with UK GDPR.

Lawful basis for processing

We may process personal data:

under our contract with you, set out in the engagement letter and service agreements
with your consent, when meeting your wider expectations of our professional relationship
to meet legal obligations or in the public interest
to further our legitimate interests

In some cases we may anonymise or pseudonymise personal data so that it can no longer be linked to you, in which case we may use it without further notice to you.

We may also process your personal data without your knowledge or consent, in line with this notice, where the law requires or allows us to.

Transferring personal data outside the UK

We use established cloud software to deliver our services, and some of those providers process data outside the UK. Where personal data is transferred outside the UK, we rely on the safeguards required by UK data protection law. Depending on the provider, this means the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it. We keep a register of the software we use, the data it holds and where that data is processed, and a copy is available on request.

Where we use anonymised or aggregated data to produce comparative information, that data cannot be linked to you and is used only within our own practice.

Before we adopt any system that processes your data, we review the provider’s privacy and security terms to satisfy ourselves that the arrangement is appropriate, and we keep that assessment under review.

Information we may give to others

To provide the agreed services, we may share personal data about you with:

HMRC
other third parties you ask us to correspond with, such as finance providers, pension providers (including for auto-enrolment) and investment brokers
subcontractors bound by the same professional and ethical obligations as our principals and employees
an alternate appointed by us in the event of incapacity or death (their name and address are available on request)
tax insurance providers
professional indemnity insurers
ACCA, or an external reviewer, for quality assurance
software and technology providers who process data on our behalf to deliver our services, including accounting, tax, document management and practice management systems. These providers act on our instructions and are bound by written agreements covering how your data is handled.

We need to share information with these parties to meet our contractual obligations to you, so you cannot opt out of this. If you ask us not to share information, we may need to stop acting for you.

Where the law allows or requires, during or after our engagement, we may give information about you to:

the police and law enforcement agencies
courts and tribunals
the Information Commissioner’s Office (ICO)

After we stop acting for you, we may also give information about you to:

our professional indemnity insurers or legal advisers, where we need to defend a claim
our professional disciplinary body, where a complaint has been made against us
your new advisers or other third parties you ask us to share information with

Data security

We have appropriate and proportionate security measures in place to protect personal data from being lost, used, altered or accessed without authority. We limit access to personal data to people with a business need, who will only process it on our instructions.

No data transmission over the internet or any other network can be completely secure. We have measures in place to deal with any suspected data breach, including policies and procedures that we review regularly to make sure they work.

Retention of information

When acting as data controller, and in line with good practice in the tax and accountancy sector, we keep records as follows:

where we have prepared tax returns and accounts, for seven years from the end of the tax year they relate to
where we have carried out ad hoc advisory work, for seven years from the date the business relationship ended
for an ongoing client relationship, permanent information needed for more than one year’s tax and accounts work (such as capital gains base costs and claims and elections made to HMRC) is kept throughout the relationship and deleted seven years after it ends, unless you ask us to keep it longer
under Regulation 40(5) of the Money Laundering Regulations 2017, certain personal data must be kept for the length of our engagement and for five years afterwards
records our systems generate while delivering your services, including notes, summaries and review findings, are kept for the length of the relationship and for seven years afterwards

Your right to access your information

A request to see the records and related information we hold about you is called a subject access request. Please make any request in writing to the person named at the top of this notice. To help us respond promptly, you may need to provide copies of ID and proof of address.

You can ask someone else, such as a friend, relative or solicitor, to make a request for you. We need your authority to deal with them, usually a letter signed by you saying they may request and receive information about you.

When we won’t release information

The law allows us to refuse a request in certain circumstances, for example if you have made a similar request recently and little or nothing has changed since.

The law also allows us to withhold information where releasing it would be likely to:

prejudice the prevention or detection of crime
prejudice the arrest or prosecution of offenders
prejudice the assessment or collection of any tax or duty
reveal the identity of, or information about, another person

If we cannot agree to your request, we will explain why in writing.

Your right to have information corrected

If information you have given us is wrong, please tell us straight away so we can update it.

Your right to have information deleted

In certain circumstances you can ask us to delete your records. More information is available on the ICO website (www.ico.org.uk). If you would like your records deleted, please tell us and we will consider your request. In some circumstances we may refuse, and if so we will explain why.

Your right to restrict or object to processing

In certain circumstances you have the right to block or suppress the processing of your personal data, or to object to it. See the ICO website (www.ico.org.uk) for more information. Please tell us straight away if you want us to stop processing your information or you object to how it is processed, so we can take appropriate action.

Withdrawing consent

Where you have agreed that we may contact you about other services, we may continue to process your data for that purpose after our contract ends. You can withdraw that consent at any time, during or after our engagement. We will then stop processing your data for that purpose only. Withdrawing consent does not affect the other bases on which we process your data, so we will continue to process it under our contract and for the other reasons in this notice.

Your right to data portability

The right to data portability only applies to personal data you have given to a controller, where processing is based on consent or the performance of a contract, and is carried out by automated means.

You may be able to request your personal data in a format that allows it to be passed to another organisation. We will respond without undue delay and within one month. We may extend this by up to two months if the request is complex or we receive several requests, in which case we will tell you within one month and explain why.

Complaints about how we use your data

If you are unhappy with how we have handled your personal data, please tell us. You can complain to Craig McCall by email at craig@alchemyaccountancy.com, by phone on 01772 965550, by post to Ground Floor, 13 Cable Court, Pittman Way, Fulwood, Preston, PR2 9YW, or in any other way that suits you.

We will:

acknowledge your complaint within 30 days
look into it without undue delay, making whatever enquiries we need to
keep you updated on our progress
tell you the outcome in writing

You also have the right to complain to the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, at ico.org.uk, or on 0303 123 1113. We would appreciate the chance to put things right first.

For complaints about our accountancy services, please see the complaints section of our terms of business. You can also complain to ACCA, as set out there.