Everstead Business and Accountancy Services Limited (‘Everstead’, ‘we’, ‘us’, ‘our’) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect information about you when you visit our website or use our services. Please read it carefully.

We are the data controller for the personal data we hold about you. Our contact details are set out in Section 11 below.

1. What Data We Collect

1.1 Data you provide to us directly

When you submit an enquiry through our website contact form or contact us directly, we collect:

• Your name
• Your email address
• Your telephone number (if provided)
• Your business name (if provided)
• The content of your message or enquiry

1.2 Data we collect automatically

When you visit our website, we collect certain data automatically through cookies and analytics tools, including:

• Your IP address (anonymized where possible)
• Browser type and version
• Pages visited and time spent on each page
• Referring website or search terms used to find us
• Device type (desktop, mobile, tablet)

We use Google Analytics to collect and process this data. Google Analytics uses cookies — small text files placed on your device — to help us understand how visitors use our website. The data is aggregated and used to improve the content and usability of our website. It is not used to identify you personally.

1.3 Data collected in the course of providing services

When you become a client, we collect and process personal and financial data necessary to provide the services agreed in your engagement letter. This may include:

• National Insurance number and Unique Taxpayer Reference (UTR)
• Date of birth and address history
• Income and expenditure records
• Bank account details (where required for HMRC correspondence)
• Company registration information and officer details
• Payroll and employment records

Where we are providing outsourced services to another accountancy practice, we may process the personal data of their clients on their behalf. In such cases, we act as a data processor and the practice remains the data controller. A data processing agreement will be put in place.

2. How We Use Your Data

We use the data we collect for the following purposes:

• To respond to your enquiry and communicate with you about our services.
• To provide accountancy, tax, payroll, VAT, and advisory services as agreed.
• To comply with our legal and regulatory obligations, including HMRC reporting, anti-money laundering verification, and Companies House filings.
• To send you relevant updates, newsletters, or information about changes in tax law (where you have consented or we have a legitimate interest in doing so).
• To improve our website and understand how visitors use it, using anonymized analytics data.
• To fulfil our obligations under any outsourcing agreement with another accountancy practice.

3. Legal Basis for Processing

We process your personal data on one or more of the following legal bases under UK GDPR:

• Contract: processing is necessary to perform the services you have engaged us to provide.
• Legal obligation: processing is required to comply with our obligations under tax law, anti-money laundering regulations, and other applicable legislation.
• Legitimate interests: for example, using analytics to improve our website, or contacting you about relevant services where you have an existing relationship with us.
• Consent: where you have actively opted in to receive marketing communications. You may withdraw your consent at any time.

4. Cookies

Our website uses cookies. Cookies are small text files stored on your device when you visit a website. We use the following types of cookie:

• Essential cookies: necessary for the website to function correctly. These cannot be disabled.
• Analytics cookies (Google Analytics): help us understand how visitors interact with the website. These are only placed with your consent, which you can manage via our cookie consent banner.

You can control and delete cookies through your browser settings at any time. Disabling analytics cookies will not affect your ability to use our website but may limit our ability to improve it based on visitor behaviour.

For more information about Google Analytics and how to opt out, visit: https://tools.google.com/dlpage/gaoptout

5. Who We Share Your Data With

We do not sell your personal data. We may share it with:

• HMRC and other regulatory bodies, where required by law.
• Companies House, where required in connection with corporate filings.
• Third-party software providers used to deliver our services, such as cloud accounting platforms (e.g. Xero, QuickBooks, FreeAgent), payroll software, and secure document sharing tools. These providers are bound by data processing agreements.
• Google LLC, in connection with Google Analytics. Data is processed in accordance with Google’s privacy policy. Where data is transferred outside the UK, Google relies on Standard Contractual Clauses approved under UK GDPR.
• Professional advisers including solicitors and insurers, on a need-to-know basis.
• Subcontractors or outsourced staff engaged to assist in delivering our services, who are subject to equivalent confidentiality and data protection obligations.

6. International Transfers

Where we transfer personal data outside the United Kingdom (for example, through cloud-based software providers), we ensure that appropriate safeguards are in place in accordance with UK GDPR. This includes reliance on adequacy decisions, Standard Contractual Clauses, or other approved transfer mechanisms.

7. How Long We Keep Your Data

We retain personal data for as long as is necessary for the purposes set out in this policy and to comply with our legal obligations. Our standard retention periods are:

• Client records (tax, accounts, correspondence): 7 years from the end of the relevant tax year, in accordance with HMRC guidance.
• Anti-money laundering verification records: 5 years from the end of the client relationship.
• Website enquiry data (contact form submissions): 2 years from the date of submission, unless the enquiry leads to an ongoing client relationship.
• Analytics data (Google Analytics): as per Google’s standard retention settings (up to 26 months by default, which we may reduce in our analytics configuration).

After the applicable retention period, your data is securely deleted or anonymised.

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: you may request a copy of the personal data we hold about you.
• Right to rectification: you may ask us to correct inaccurate or incomplete data.
• Right to erasure: you may ask us to delete your data where there is no longer a lawful basis for processing it.
• Right to restrict processing: you may ask us to limit how we use your data in certain circumstances.
• Right to data portability: where processing is based on consent or contract, you may ask us to provide your data in a structured, commonly used, machine-readable format.
• Right to object: you may object to processing based on legitimate interests, including for direct marketing purposes.
• Rights related to automated decision-making: we do not make decisions about you based solely on automated processing.

To exercise any of these rights, please contact us using the details in Section 11. We will respond within one calendar month. We may need to verify your identity before processing your request.

9. Data Security

We take the security of your personal data seriously. We use appropriate technical and organizational measures to protect it against unauthorized access, loss, or disclosure. These include secure file sharing, encrypted communications, access controls, and regular staff training on data protection.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours and, where required, notify you directly without undue delay.

10. Complaints

If you have concerns about how we handle your personal data, please contact us in the first instance using the details below. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: www.ico.org.uk
• Telephone: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns directly before you contact the ICO.

11. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

• Everstead Business and Accountancy Services Limited
• Email: support@eversteadbusiness.co.uk
• Address: 20 Wenlock Road, London, N1 7GU

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or our data practices. The most current version will always be available on our website. Where changes are significant, we will take reasonable steps to notify you.

This Privacy Policy was last reviewed and updated in June 2026 and complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.