Privacy Notice (UK GDPR)

​

1. Introduction

Amy’s Bookkeeping & Administration Services (“we”, “us”, “our”) is committed to protecting your personal information and handling it securely, lawfully, and transparently. This Privacy Notice explains how we collect, use, store, and share your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We act as the Data Controller, meaning we determine how and why your personal data is processed. If you have any questions about this Notice, you can contact us at:

Registered Address: 61 Bridge Street, Kington, HR5 3DJ
Email: amys_bookkeeping@outlook.com

2. The personal data we collect

We may collect and process the following categories of personal data:

• Identity information: name, date of birth, company details

• Contact information: address, email address, telephone numbers

• Financial information: bank details (where required), transaction data, invoices, receipts

• Business information: trading activity, suppliers, customers

• AML information: identity documents, proof of address, ownership details

• Communication data: emails, messages, and correspondence

• Technical data: information required to maintain secure systems

We only collect the information necessary to provide our services and meet our legal obligations.

3. How we collect your data

We collect personal data in the following ways:

• Directly from you (forms, emails, phone calls, documents you provide)

• From third parties where necessary (e.g., HMRC, Companies House, your suppliers or contractors)

• Through bookkeeping software such as Xero, Hubdoc, or QuickBooks

• Through AML verification tools where required by law

4. Why we process your personal data (lawful bases)

We process your personal data under the following lawful bases:

Contract

To provide bookkeeping, payroll, VAT, CIS, and related services.

Legal obligation

To comply with laws including:

• HMRC requirements

• Anti‑Money Laundering (AML) regulations

• ICB regulatory obligations

• Record‑keeping laws

Legitimate interests

To operate and improve our business, prevent fraud, maintain accurate records, and manage communications.

We will only use your data for the purposes for which it was collected unless we notify you otherwise.

5. Sharing your personal data

We may share your personal data with trusted third parties when necessary, including:

• HMRC, ICB, and other regulatory bodies

• Subcontractors and service providers who support our work

• Software providers (e.g., Xero, payroll systems)

• Banks or payment processors (where required)

• Law enforcement or government bodies where legally required

We do not sell your personal data.

Any third party we share data with must comply with UK GDPR and maintain appropriate security measures.

6. International transfers

If your data is transferred outside the UK (for example, by a software provider), it will only be transferred where:

• The destination country has an adequacy regulation, or

• Appropriate safeguards (such as Standard Contractual Clauses) are in place

This ensures your data remains protected to UK GDPR standards.

7. Data security

We take appropriate technical and organisational measures to protect your personal data, including:

• Secure, password‑protected systems

• Firewalls and anti‑malware protection

• Regular data backups

• Locked storage for paper records

• Staff training and confidentiality obligations

• Shredding and secure disposal of documents

• Access controls ensuring only authorised personnel can view data

We continually review and update our security measures.

8. Data retention

We only keep your personal data for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and regulatory requirements.

Typical retention periods include:

• Bookkeeping records: 6 years

• AML records: 5 years after the end of the business relationship

• Payroll records: 3–6 years depending on the record type

• Emails and correspondence: up to 6 years

After these periods, data is securely deleted or destroyed.

9. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access – to request a copy of the data we hold

• Right to rectification – to correct inaccurate or incomplete data

• Right to erasure – to request deletion of your data (subject to legal obligations)

• Right to restrict processing – to limit how your data is used

• Right to data portability – to request transfer of your data

• Right to object – to object to certain types of processing

• Right not to be subject to automated decision‑making

• Right to be informed – about how your data is used

We will respond to all valid requests within one month.

10. How to make a request

To exercise any of your rights, contact:

Email: amys_bookkeeping@outlook.com
Address: 50 Alexander Drive, Louth, LN11 8QG

We may need to verify your identity before responding.

11. Complaints

If you are unhappy with how we handle your personal data, please contact us first so we can resolve the issue.

If you remain dissatisfied, you can contact the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: www.ico.org.uk
Telephone: 0303 123 1113

12. Updates to this Privacy Notice

We may update this Privacy Notice from time to time. When we make changes, we will update the version on our website or notify you directly where appropriate.