1. Who we are

Woodcock Accounting Ltd is the data controller for the personal data described in this notice. We are a company registered in England and Wales, company number 17372946, with our registered office at Glossop Gasworks, Arundel Street, Glossop, England, SK13 7AB.

We provide accountancy services to UK limited company contractors and freelancers. Woodcock Accounting Ltd is a member firm of the Institute of Chartered Accountants in England and Wales (ICAEW), firm registration number C011009896, and is supervised by ICAEW under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.

Data controller: Woodcock Accounting Ltd, company number 17372946
ICO registration: ZC210942
Contact: Oliver Woodcock, ollie@woodcockaccounting.co.uk

If you have any question about how we handle your personal data, contact Oliver Woodcock at ollie@woodcockaccounting.co.uk.

This notice explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and your rights under the UK GDPR and the Data Protection Act 2018. The sections on client data are the privacy notice we give every client with their engagement letter. The other sections cover enquiries, prospective clients, visits to this website and cookies.

2. What personal data we collect

2.1 Enquiries, bookings and the referral form

When you book a discovery call, email us, or submit our referral form, we collect your name, email address, company name (if provided), the nature of your enquiry, and any additional information you include in your message.

Legal basis (enquiries and bookings): Legitimate interests (Article 6(1)(f) UK GDPR): responding to an enquiry you have initiated, and, where relevant, taking steps at your request prior to entering into a contract (Article 6(1)(b)). Discovery calls are booked through Microsoft Bookings, which does not require a separate consent tick box on our site; see section 5 for how Microsoft processes this data.

Legal basis (referral form): Consent (Article 6(1)(a) UK GDPR). The referral form includes a tick box confirming you are happy for us to contact you about your referral and our services. You can withdraw this consent at any time by emailing us.

Purpose: To respond to your enquiry and keep you informed about Woodcock Accounting Ltd's services.

2.2 Clients

When you become a client, and while we carry out our checks before accepting you, we collect the following personal data. Where our client is a company, this includes data about its directors, shareholders and people with significant control. It also covers any individual whose own tax affairs we deal with, such as a director whose Self Assessment tax return we prepare.

Category Examples
Identity data Name, date of birth, nationality, photographs of identity documents, passport or driving licence details, National Insurance number, Unique Taxpayer Reference
Contact data Home and business address, email address, telephone number
Financial data Bank account details, income, expenditure, assets, liabilities, dividends, pension contributions
Company data Directorships, shareholdings, control of companies, information from the Companies House register including the register of people with significant control
Transaction data Details of payments to and from you, and of the services we provide
Verification data Results of electronic identity verification, sanctions and politically exposed person screening
Correspondence Communications between us, including email, WhatsApp messages and meeting notes

We collect this data from you directly, from public registers such as Companies House, from HMRC where you have authorised us to act, from your previous adviser where you consent to us seeking clearance, and from identity verification and screening providers.

If you are a director, shareholder or other individual whose personal data a client company has given us, the company has agreed to pass this notice on to you, and it applies to you in the same way.

We will not record or transcribe a call or a meeting using an automated tool without asking you first.

Depending on the service, we may act as a controller or as a processor of personal data. Where we act as a processor, we process personal data only on the client's documented instructions, subject to any legal requirements that apply to us. A client that gives us personal data about other people is responsible for having a lawful basis to do so, and for giving those people any privacy information they need.

2.3 Prospective client research

As part of identifying and approaching businesses that may benefit from our services, we may collect a limited amount of data from publicly available sources, including Companies House, LinkedIn, and company websites. This may include a company's name, registration number and registered office address, and a director or officer's name, job title, and publicly listed contact details (such as an email address, phone number, or professional profile).

Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR). We have a legitimate interest in identifying and making relevant, proportionate contact with businesses who may want accountancy services. Some of this data may be personal rather than strictly business in nature (for example, a company's registered office is sometimes a director's home address, and a LinkedIn profile is personal to the individual). We take this into account and keep our use of it limited and proportionate to the purpose of making an initial approach. Where we contact you on this basis, we will identify ourselves and explain why we are contacting you, and you have an absolute right to object at any time (see section 7), including by asking us to stop, after which we will do so.

Purpose: To make an initial, relevant approach about our services, by email, phone, or post.

2.4 Website usage data

When you visit our website, standard server logs may record your IP address, browser type, pages visited, and the time and date of your visit. This data is collected automatically by our hosting provider (Netlify) and is not linked to any personally identifiable information.

Legal basis: Legitimate interests (Article 6(1)(f)): to maintain the security and performance of the website.

Purpose Lawful basis Notes
Providing accountancy and taxation services Performance of a contract The engagement letter between us
Complying with the Money Laundering Regulations 2017: identity verification, screening, ongoing monitoring and record keeping Legal obligation, and a task carried out in the public interest under Article 6(1)(e) as provided by regulation 41(7) See section 4 below, which is a statutory requirement in its own right
Filing returns and accounts with HMRC and Companies House Legal obligation
Reporting under the Proceeds of Crime Act 2002, the sanctions regulations, and regulation 30A of the Money Laundering Regulations 2017 (discrepancies in the register of people with significant control) Legal obligation We may be prohibited by law from telling you that we have made a report
Keeping records for the periods required by law Legal obligation
Managing our practice, including fees, insurance and professional advice Legitimate interests Balanced against your rights
Responding to ICAEW monitoring Legal obligation and legitimate interests ICAEW reviewers are bound by confidentiality
Marketing our services to existing clients Legitimate interests You can opt out at any time

You must give us the personal data we ask for, because we need it to meet our legal obligations and to perform our contract with you. If you do not, we may be unable to act for you, or may have to stop acting. We do not make decisions about you based solely on automated processing.

4. Money laundering: a statement required by law

Regulation 41(6) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 requires us to give you the following statement before we establish a business relationship with you.

Statement under regulation 41(6)

“Any personal data we receive from you for the purposes of preventing money laundering, terrorist financing or proliferation financing will be processed only for those purposes, except as permitted by or under an enactment other than the Money Laundering Regulations 2017 or the UK GDPR, or with your consent. Personal data obtained for these purposes will not be used for any other purpose without your consent.”

Where the processing involves special category data, or data relating to criminal convictions and offences, we rely on the conditions in section 10 of and Schedule 1 to the Data Protection Act 2018.

5. Who we share it with

We do not sell your personal data, and we do not share it with third parties for their own marketing.

5.1 Client data

  • HMRC and Companies House, where we act as your agent or file on your behalf;
  • identity verification and screening providers, who verify your identity and screen you against sanctions and politically exposed person data, and who act as our processors under contract;
  • FreeAgent and other software providers used to deliver the services, as processors under contract;
  • GoCardless, which collects our fees by Direct Debit and processes your billing details under its own privacy terms;
  • the National Crime Agency, the Office of Financial Sanctions Implementation and the Registrar of Companies, where we are required by law to report, which we may be prohibited from telling you about;
  • approved cloud-storage, research, drafting and artificial-intelligence service providers, acting under contractual confidentiality and data-processing protections; we use business services under which the provider does not train its models on our inputs. Information collected for anti-money laundering purposes is never put into artificial-intelligence tools. If you would rather we did not use these tools on your affairs, email ollie@woodcockaccounting.co.uk and that preference will be recorded on your file and respected;
  • ICAEW, as our regulator, in the course of monitoring, whose reviewers are bound by confidentiality;
  • our professional advisers and insurers, in confidence, where necessary;
  • a successor adviser, where you ask us to hand over your records, but never our anti-money laundering records or any report we have made;
  • with your consent, a specialist we introduce you to, such as an IR35 contract reviewer or an FCA-authorised financial adviser. We take no fee or commission for any introduction.

We currently have no employees. If we engage another person to carry out work on your affairs, we will tell you before your information is shared with them and will make sure appropriate confidentiality obligations apply.

5.2 Enquiries and website visitors

  • Booking: discovery calls are booked through Microsoft Bookings. When you book, Microsoft processes the details you enter (name, email address and any notes) under Microsoft's privacy terms, and we receive them as the meeting organiser.
  • Form handling: referral form submissions are processed by Netlify, our website hosting provider. Netlify stores form data on servers in the United States under appropriate safeguards (Standard Contractual Clauses or the UK Extension to the EU–US Data Privacy Framework). You can view Netlify's privacy policy at netlify.com/privacy.
  • Analytics: only if you accept analytics cookies, Google Analytics processes anonymised usage data for us (see section 10).

We will also disclose personal data where we are required to do so by law, by a court order or by a regulator.

5.3 Transfers outside the United Kingdom

Some of our service providers, including cloud, research, drafting and artificial-intelligence providers, may process personal data outside the United Kingdom. Where personal data is transferred outside the United Kingdom, we will ensure that the transfer is made under UK adequacy regulations or subject to appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses or another lawful transfer mechanism. Further information about the safeguards used for a particular transfer is available on request.

6. How long we keep it

Record Retention
Enquiries, booking details and referral form submissions Up to 24 months from the date of submission, or until you ask to be removed, whichever comes first. If you become a client, they become part of your client records.
Prospective client research Up to 12 months from collection, or until you object or ask us to stop contacting you, whichever is sooner
Website server logs Typically up to 30 days, held by Netlify
Anti-money laundering records: identity evidence, screening results, risk assessments Five years from the end of our business relationship, then deleted unless another legal obligation or ongoing proceedings require us to keep them
Client accounting and tax records and working papers Six years from the end of the relevant period, in line with our Document Retention and Destruction Policy
Correspondence with clients Six years
Records of reports made under the Proceeds of Crime Act 2002 Five years from the date of the report, held separately and never released with your file

7. Your rights

You have the following rights in relation to your personal data. To exercise any of them, contact us at ollie@woodcockaccounting.co.uk. We will respond within one month.

  • Right of access: you can ask us for a copy of the personal data we hold about you.
  • Right to rectification: you can ask us to correct inaccurate or incomplete data.
  • Right to erasure: you can ask us to erase data where there is no continuing reason for us to hold it.
  • Right to restriction: you can ask us to restrict processing of your data in certain circumstances.
  • Right to data portability: where processing is based on consent or contract and carried out by automated means, you can ask to receive your data in a portable, machine-readable format.
  • Right to withdraw consent: where processing is based on consent (e.g. marketing communications), you can withdraw consent at any time. This does not affect the lawfulness of any processing carried out before withdrawal.
  • Right to object: you can object to processing based on legitimate interests, and you can opt out of marketing at any time.
Two limits you should know about

Where we are required by law to keep records, anti-money laundering records in particular, we cannot delete them at your request until the statutory period has expired. Where we have made a report under the Proceeds of Crime Act 2002, we may be prohibited by law from confirming or denying that it exists, including in response to a request for your data. This is not a matter of choice on our part.

8. How to be removed from our contact list

If you have contacted us or submitted our referral form and no longer wish to be contacted, you can ask to be removed at any time by emailing ollie@woodcockaccounting.co.uk with the subject line "Remove me from your list". We will process your request promptly and confirm once done.

9. Security

We hold your data on encrypted, access-controlled cloud storage with multi-factor authentication, and we exchange documents through secure links rather than as email attachments wherever practicable. We also use password-protected, encrypted devices and limit access to personal data to those who need it for their work.

No method of transmission over the internet is completely secure, and email can be intercepted, delayed or misdirected. We will never ask you for your HMRC sign-in details, and you should never give them to anyone. If you receive a message that appears to come from us asking for those details, or asking you to send money to a different bank account, telephone us on 07554 344174 before you act on it. Use the number on this website rather than one given in the message. If you believe your data has been compromised, please contact us immediately.

10. Cookies

Our website uses cookies. For full details of the cookies we use and how to manage them, please see our Cookie Policy.

In summary: we set strictly necessary cookies so the site and its forms work and, only if you accept, optional analytics cookies from Google Analytics 4. Google Analytics is not loaded unless you consent, so if you reject or ignore the banner, no analytics data is collected and nothing is sent to Google.

Where you do consent, we process anonymised usage data (pages viewed, approximate city-level location, device type, referring source) to understand how the site is used and improve it. The legal basis is your consent, and you may withdraw it at any time using the Cookie preferences link in the footer. Google Ireland Limited acts as our processor for this data; transfers outside the UK rely on the UK Extension to the EU–US Data Privacy Framework and standard contractual clauses. We do not use this data to identify you.

11. Links to other websites

Our guides and pages may include links to external websites (for example, HMRC guidance, ICAEW resources, or specialist IR35 reviewers). This privacy policy does not apply to those websites. We recommend reviewing their own privacy policies before providing any personal information.

12. Changes to this notice

We may update this notice from time to time and will tell you if we make a material change. The "last updated" date at the top of this page shows when it last changed. The client sections match the privacy notice issued with our engagement letter.

13. How to complain

If you are unhappy with how we have handled your personal data, please raise it with us first at ollie@woodcockaccounting.co.uk and we will do our best to resolve your concern.

If you are not satisfied, you may complain to the Information Commissioner's Office (ICO):