Privacy Notice

Melanie Curtis Accountants Ltd

Issue 2026.1 | Last updated: 23 September 2026 | Replaces the privacy notice in force from June 2021

This notice explains what personal data we collect, why we collect it, what we do with it and what rights you have. It applies to our clients, to people who work for or with our clients, to people who contact us or visit our website, and to anyone else whose personal data reaches us in the course of our work.

We have tried to write it in plain English. If anything is unclear, or you want more detail about a particular point, please ask.

1. Who we are

Melanie Curtis Accountants Ltd is a firm of Chartered Certified Accountants based in Wokingham, Berkshire. We are the data controller for the personal data described in this notice, which means we decide why and how it is processed.

We are not required to appoint a Data Protection Officer. Melanie Curtis is responsible for data protection within the firm and is the person to contact about anything in this notice.

Where we act for a business client, that client is the controller of its own employee and customer data, and we are its processor for that data. For our own client records, our billing, our regulatory obligations and our marketing, we are an independent controller in our own right. We are not joint controllers with our clients.

2. Whose data we process, and where we get it

We process personal data relating to:

• our clients, and the directors, shareholders, partners, members and officers of client businesses
• employees, workers and former employees of clients for whom we operate payroll
• suppliers, customers and other contacts of our clients, where their details appear in the records we work on
• people who enquire about our services, and people we meet at events or through referrals
• our own suppliers and their staff
• people who apply to work with us
• visitors to our website

Most of the information we hold comes directly from you, or from someone at your business who provides it on your behalf.

We also obtain information from other sources, including Companies House, HMRC, your bank or accounting software through an authorised data feed, your previous accountant under professional clearance, Land Registry and other public registers, and credit reference and identity verification agencies.

Where we are required to verify identity under the Money Laundering Regulations 2017, we may carry out an electronic identity check through a verification provider. That check leaves a soft footprint on your credit file. It is visible to you, it is not visible to lenders as a credit application and it does not affect your credit score.

3. What personal data we process

Depending on our relationship with you, this may include:

• identity data, such as your name, date of birth, nationality, photographic identification and National Insurance or Unique Taxpayer Reference number
• contact data, such as your home and business address, email address and telephone numbers
• financial data, such as income, expenditure, bank account and payment details, tax affairs, assets, liabilities, pensions, investments and property transactions
• verification data, such as copies of passports, driving licences and proof of address, and the results of electronic identity and sanctions checks
• payroll data, where we or our payroll bureau operate payroll for your business, including employee names, addresses, dates of birth, National Insurance numbers, tax codes, pay, deductions, pension contributions, bank details and statutory payment records
• correspondence and records of our dealings with you, including emails, letters, notes of meetings and calls, and recordings and transcripts of online meetings
• website and marketing data, such as your IP address, pages visited and how you interact with our emails

Some of this is special category data under data protection law. In practice this arises where health information is disclosed in connection with statutory sick pay, or where family circumstances are disclosed in connection with statutory maternity, paternity, adoption or shared parental pay. We process it only so far as is necessary to operate payroll or to give you the advice you have asked for, relying on Article 9(2)(b) of the UK GDPR and paragraph 1 of Schedule 1 to the Data Protection Act 2018, which cover employment and social security law, and where relevant on Article 9(2)(f), which covers the establishment, exercise or defence of legal claims.

We do not process criminal offence data other than where it is disclosed to us in the course of an anti money laundering check or an enquiry, in which case we process it in accordance with Schedule 1 to the Data Protection Act 2018.

4. Why we process your data, and our lawful basis

We must have a lawful basis for everything we do with your personal data. The bases we rely on are these.

To perform our contract with you

Preparing accounts and tax returns, running payroll, giving advice, dealing with HMRC and Companies House on your behalf, managing our engagement with you and taking payment.

To comply with our legal and regulatory obligations

Verifying identity and carrying out ongoing monitoring under the Money Laundering Regulations 2017, making reports where the law requires it, keeping records for the periods the law requires, filing with HMRC and Companies House, and complying with ACCA’s requirements including practice monitoring.

For our legitimate interests

Running and administering our practice, managing the client relationship, keeping records of the advice we have given, recovering unpaid fees, maintaining the security of our systems, defending professional claims and complaints, and marketing our services to existing clients and to people who have asked us about them. Where we rely on legitimate interests we have considered the effect on you, and you can object at any time.

With your consent

Sending marketing emails to people who are not existing clients, using non essential cookies on our website, and anything else we specifically ask you to agree to. You can withdraw consent at any time, and withdrawing it does not affect anything done before you withdrew it.

5. What that involves in practice

The services we provide, and therefore the processing we carry out, may include:

• preparing and filing annual accounts
• corporation tax computations and returns
• VAT returns and Making Tax Digital submissions
• personal tax returns, including income from employment, self employment, property, dividends, pensions and investments
• capital gains tax, including residential property disposals and the 60 day reporting requirement
• payroll, auto enrolment pension submissions and Construction Industry Scheme returns
• bookkeeping and management accounts
• company secretarial work, including confirmation statements and changes to company records
• business advisory work, including forecasting, benchmarking and profit improvement
• dealing with HMRC enquiries and compliance checks

6. Who we share your data with

We share personal data only where we need to. The categories of recipient are:

• HMRC, Companies House and other government bodies, where we file or correspond on your behalf
• our outsourced accountancy support provider and our payroll bureau, both of which process personal data on our instructions only. See section 7
• our software and cloud service providers, listed in section 7
• pension providers, where we make auto enrolment submissions for your business
• ACCA, in connection with practice monitoring, and our professional indemnity insurers and their advisers in connection with any claim or potential claim
• our alternate, being another accountancy practice appointed under ACCA rules to take over the running of the practice if Melanie Curtis were unable to continue. The alternate would only access client data if that arrangement were triggered
• our own professional advisers, including solicitors, and our bank
• other professionals such as solicitors, independent financial advisers or specialist tax advisers, but only where you have asked us to involve them or have agreed that we should

We do not sell your personal data, and we do not share it with anyone for their own marketing purposes.

We may disclose personal data where we are required to do so by law, including under the Money Laundering Regulations 2017 and the Proceeds of Crime Act 2002. In some circumstances the law prevents us from telling you that we have done so.

7. Systems and third party providers

We use trusted third party software providers and cloud platforms, including but not limited to Xero, QuickBooks, Sage, Dext, Capium, Bright Manager, BrightPay, BrightHR, Capisign, Xama, Fathom, Trello, Calendly, Power Pricing, Microsoft 365, Anthropic, OpenAI, GoCardless, Stripe and PayPal.

We also work with an outsourced accountancy support provider, a UK registered company whose delivery teams are based in India and work remotely on UK hosted systems, and with a payroll bureau based in the United Kingdom. Both process personal data on our behalf.

Where you have engaged us for advisory work, a business development and advisory consultant engaged by us may see your accounts and management information in order to support us in delivering that work. Your website and our online booking are looked after by a website and search agency, and we are introduced to independent financial advice through a firm of advisers where you ask us to arrange it.

All of them act on our instructions only, are bound by written data processing agreements and by the same confidentiality and data protection obligations as our own team, and we remain fully responsible to you for their work.

We will tell you the names of these providers on request. This list is kept up to date, and we review it at least annually.

8. AI assisted tools

We use artificial intelligence tools to help us work more efficiently. Being open about this matters more to us than being quiet about it, so here is exactly what we do.

The tools we use are Claude, provided by Anthropic, ChatGPT, provided by OpenAI, Microsoft 365 Copilot, provided by Microsoft, and Fathom, which records and summarises online meetings.

We use them to help with drafting, summarising documents and correspondence, research, analysis and routine preparation. They speed up how we work. They do not decide anything.

The safeguards

• We use paid business accounts under commercial terms. Your data is not used to train the providers’ models.
• Our team may only use the accounts the firm provides. Personal AI accounts must not be used for any client work.
• Everything an AI tool produces is reviewed by a suitably qualified person before it is used or sent to you. The work remains ours and we remain responsible for it.
• We have a written AI Use Policy that all of our people are required to read and sign.

Automated decision making

We do not make decisions about you by automated means alone where those decisions produce legal effects or similarly significant effects. Every piece of advice and every judgement is made by a person.

If you would rather we did not

If you would prefer us not to use AI assisted tools on your work, tell us in writing and we will honour that. It may affect how quickly we can turn work around, and we will tell you if it does.

Meeting recordings

We record and summarise some online meetings so that we have an accurate record of what was discussed and agreed. We tell everyone before the recording starts, and no substantive discussion is recorded until everyone has agreed. If you would rather a meeting were not recorded, say so and it will not be.

9. International transfers

Your data is stored on systems located in the United Kingdom or the European Economic Area wherever we can arrange it. Some transfers outside the United Kingdom do take place, and we want to be clear about them.

Our outsourced accountancy support provider is a UK registered company that stores client data on UK infrastructure. Its delivery teams in India access that data remotely. No client data is stored, downloaded, copied or printed in India. Remote access of this kind is still treated as an international transfer under UK data protection law, and it is covered by an International Data Transfer Agreement and a documented transfer risk assessment between the UK company and its Indian operation.

Some of our software providers, including the AI providers named in section 8, are based in the United States or process data there. Those transfers are made under the providers’ own data processing agreements, which incorporate the UK Addendum to the EU Standard Contractual Clauses or an equivalent safeguard approved under Article 46 of the UK GDPR.

You can ask us for more detail about any of these arrangements, including a copy of the safeguard relied on.

10. How long we keep your data

We keep personal data only for as long as we need it, and for as long as the law requires. In practice:

Where we are required to keep records for longer, for example because of an ongoing HMRC enquiry, a complaint or a claim, we will keep them until that matter is resolved. At the end of a retention period, records are securely deleted or destroyed.

11. How we keep it safe

We take the security of your information seriously. The measures we have in place include:

• multi factor authentication on our email, our practice systems and our cloud accounts
• encryption of data in transit and at rest on the systems we use
• access limited to those members of our team and our providers who need it to do the work
• secure client portals for exchanging documents, in preference to unencrypted email
• managed devices, with software installed only where it has been approved
• data protection and anti money laundering training for all of our people, refreshed annually
• written data processing agreements with the providers who process personal data on our behalf
• backup and business continuity arrangements
• a documented procedure for handling any personal data breach, including reporting to the Information Commissioner within 72 hours where the law requires it

No system can be guaranteed completely secure. If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay.

12. Your rights

Under data protection law you have the following rights.

Some practical limits

The right to erasure is not absolute. Where we are required by law to keep records, for example under the Money Laundering Regulations 2017 or tax legislation, we cannot delete them on request. The same applies where we need them to establish, exercise or defend a legal claim. If we cannot delete something, we will tell you why.

Where you are an employee of one of our payroll clients, your employer is the controller of your payroll data and we act on their instructions. If you ask us to exercise a right over that data, we will pass your request to your employer and tell you that we have done so.

How to exercise a right

Email mel@melaniecurtisaccountants.co.uk or write to Melanie Curtis Accountants Ltd, 65 Peach Street, Wokingham, Berkshire RG40 1XP. There is no charge, and we will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you if we need to. We may ask you to confirm your identity first.

13. Cookies

Our website uses cookies. Details of the cookies we use, what they do and how to control them are set out in our separate cookie policy. Non essential cookies are only set where you have agreed to them, and you can change your preferences at any time.

14. Complaints

If you are unhappy with how we have handled your personal data, please tell us first so that we have the chance to put it right. Contact Melanie Curtis at mel@melaniecurtisaccountants.co.uk.

You also have the right to complain to the Information Commissioner’s Office at any time.

15. Changes to this notice

We review this notice at least once a year, and sooner if the way we work changes. The date at the top shows when it was last updated. Where a change is significant we will tell our clients directly rather than rely on the website.