We, McAllister Accountancy Limited, are the data controller. The person responsible for data protection matters at the firm is James McAllister ACCA, who can be contacted at privacy@mcallisteraccountancy.co.uk.
We collect the data you give us, and data we receive from your previous accountant, from public registers such as Companies House, from HMRC, and from the identity verification and screening services we are required to use.
We use your personal data to set up and manage our relationship, to carry out required checks, to meet professional obligations and to comply with the law. This may include informing HMRC, the police and others.
Your data is stored on the systems we use, including cloud based systems. If any of those services process data outside the United Kingdom, we put in place the measures required by law.
We share data with our insurers, with the software providers we use to deliver our services, and with various local and national authorities.
We keep your data for the period we have a relationship with you plus seven years, unless there are reasons to keep it for longer. Anti-money laundering records are the exception: the law requires us to delete those after five years.
You have the right of access to your data, to rectify it, to challenge or block its use, to have it erased, to move it to another provider and to withdraw consent. Some of those rights are limited where the law requires us to keep or to report information. Section 9 explains where.
We do not make decisions about you by automated means alone.
1. Introduction
The Data Protection Act 2018 ("DPA 2018") and the UK General Data Protection Regulation ("UK GDPR") impose certain legal obligations in connection with the processing of personal data.
McAllister Accountancy Limited is a data controller within the meaning of the UK GDPR and we process personal data. The person responsible for data protection matters at the firm is James McAllister ACCA, who can be contacted at privacy@mcallisteraccountancy.co.uk. We are not required to appoint a Data Protection Officer and we have not appointed one.
We may amend this privacy notice from time to time. If we do so, we will supply you with, or otherwise make available to you, a copy of the amended notice. The version number and date at the top of this page tell you which version is current.
Where we act as a data processor on behalf of a data controller, for example when processing payroll, we provide an additional schedule setting out the required information as part of that agreement. That schedule should be read together with this notice.
Registered nameMcAllister Accountancy LimitedRegistered inEngland and Wales, company number 17147807Registered office12 St Bevans Road, Skircoat Green, Halifax, HX3 0RTData protection contactJames McAllister ACCA, privacy@mcallisteraccountancy.co.ukTelephone01422 730240Anti-money laundering supervisorACCA, firm number 2000005817
We are a practice rather than an office open to callers. Please write or telephone rather than visiting.
2. The purposes for which we process personal data
We intend to process personal data for the following purposes:
3. The legal bases for our processing
Our processing of personal data has the following legal bases:
Where we rely on legitimate interests, we have weighed our interest against your rights and concluded that ours does not override yours. You can ask us for that assessment, and you can object at any time. Section 9 explains what happens then.
It is a requirement of our contract with you that you provide us with the personal data we request. If you do not provide it, we may not be able to provide professional services to you, and we will not be able to start acting or will need to cease to act.
4. Anti-money laundering checks, and the extra protections that apply
We are supervised by ACCA for anti-money laundering purposes. MLR 2017 requires us to identify and verify our clients, and to understand who ultimately owns and controls them, before we act.
We use Xama to carry out identity verification and screening for us.
Some of this goes beyond ordinary personal data. Whether someone is politically exposed can reveal political connections, and screening can surface allegations or convictions. The law treats both as needing extra protection, so we rely on additional conditions:
If we suspect money laundering we are required to report it to the National Crime Agency, and the law prohibits us from telling you that we have done so. This means that in some circumstances we cannot answer a request to see your information, and cannot tell you why.
We must keep our anti-money laundering records for five years from the date our business relationship ends. During that period we cannot delete them, even if you ask us to. At the end of it we delete them.
5. If you have never dealt with us: our prospect list
We build a list of recently formed local companies that may be looking for an accountant for the first time. If you are a director of one, we may hold your company's details even though you have never contacted us. The law requires us to tell you where we got them.
Where it comes fromThe Companies House Free Company Data Product, the public register of every UK company. We also use postcodes.io to work out how far a company is from us. We do not buy lists and nobody gives us your detailsWhat we holdCompany name and number, registered office address, date of incorporation, accounts filing dates, the codes describing what the company does, and the number of officers. Where a registered office is a home address, that address is personal information about the directorWhy we are allowed toOur legitimate interest in offering our services to local businesses. We have carried out and documented an assessment weighing that against your rights, and you can ask us for itHow we use itWe may write to the company once. If you do not reply, we do not contact you againHow long we keep itIf we never contact you, until the next monthly refresh replaces it and in any event no more than 13 months. If we write and you do not reply, 12 months from that letter. If you ask us to stop, we keep only your company name, number and the date you asked, indefinitely, so that we do not contact you again by mistake
To be removed, email privacy@mcallisteraccountancy.co.uk or reply to our letter with the word STOP. We do not need a reason and we will not ask for one.
Companies House data is used under the Open Government Licence v3.0.
6. Who we may give personal data to
We may share your personal data with:
If the law allows or requires us to do so, we may also share your personal data with:
We may need to share your personal data with the third parties identified above in order to comply with our legal obligations, including our obligations to you, and for our and others' legitimate interests including those of society as a whole. If you ask us not to share your personal data with those third parties, we may need to cease to act.
We do not sell or rent your personal data, and we do not share it for anyone else's marketing.
7. Transfers of personal data outside the United Kingdom
Our software providers are contractually required to comply with UK data protection law. Where any of them processes personal data outside the United Kingdom, that transfer is covered by the International Data Transfer Agreement approved by the Information Commissioner, or by an equivalent safeguard permitted by UK law, so that your information is protected to a standard equivalent to that which applies in the United Kingdom.
If you would like to know where a particular provider holds your information, please ask and we will tell you.
8. How long we keep personal data
When acting as a data controller, and in accordance with recognised good practice in the tax and accountancy sector, we retain our records relating to you as follows.
RecordRetained forWhere tax returns have been preparedSeven years from the end of the tax year to which the information relatesWhere ad hoc advisory work has been undertakenSeven years from the date the business relationship ceasedWhere we have an ongoing client relationship, data needed for more than one year's tax compliance, for example capital gains base costs and claims and elections submitted to HMRCThroughout the period of the relationship, then deleted seven years after the end of it, unless you ask us to keep it for longerAnti-money laundering recordsFive years from the end of the business relationship. The law requires us to delete them at that point, so this is shorter than the periods above and takes precedence over themFee and payment recordsSix years from the last invoice or paymentComplaints records and our commissions registerSix yearsEnquiries that do not become engagementsTwelve monthsProspect recordsSee section 5
Our contractual terms provide for the destruction of documents after seven years. Agreement to those terms is taken as agreement to the retention of records for that period and to their destruction afterwards.
You are responsible for retaining information that we send to you, including details of capital gains base costs and claims and elections submitted, and this will be supplied in the form agreed between us. Documents and records relevant to your tax affairs are required by law to be retained by you as follows.
Individuals, sole traders, trustees and partnerships:
Where we act as a data processor as defined in DPA 2018, we will delete or return all personal data to the data controller, as agreed with that controller, at the termination of the contract.
9. Your rights, and where they are limited
You have the rights set out below. Before the detail, one thing that applies to several of them.
Not all of these rights are absolute. Our duty to keep anti-money laundering records for five years, our duty to keep records for tax and company law purposes, and the legal prohibition on telling you that we have made a report to the National Crime Agency, will each override some requests. Where we cannot do what you ask, we will tell you why, unless the law prevents us from doing so.
You have a right to request access to the personal data we hold about you. Such requests are known as subject access requests.
Please make a subject access request in writing to privacy@mcallisteraccountancy.co.uk, marked for the attention of James McAllister.
So that we can find the right information and deal with your request quickly, please tell us what type of information you want and, if you are not a current client, enough detail for us to identify you. We may ask you to confirm your identity before we respond. We will ask only for what we reasonably need in order to be satisfied who you are, and we will not use anything you give us for that purpose for anything else.
DPA 2018 requires us to comply with a subject access request promptly, and in any event within one month of receipt. There are some circumstances in which the law allows us to refuse to provide access, for example if you have previously made a similar request and there has been little or no change to the data since we complied with it. There is also a specific exemption where disclosure would prejudice the prevention or detection of crime, and a subject access request will not disclose whether we have made a report to the National Crime Agency. We will neither confirm nor deny that we have.
We will not charge you for dealing with a subject access request unless it is manifestly unfounded or excessive.
You can ask someone else to request information on your behalf, for example a friend, relative or solicitor. We must have your authority to respond to a request made on your behalf. You can give that authority by signing a letter stating that you authorise the person concerned to write to us for information about you, or to receive our reply.
Where you are a data controller and we act for you as a data processor, for example by processing payroll, we will assist you with subject access requests on the same basis as set out above.
You have a right to obtain the rectification of any inaccurate personal data concerning you that we hold, and to have any incomplete personal data completed. If you become aware that anything we hold about you is inaccurate or incomplete, please tell us and we will correct it, unless doing so would prejudice a report or an investigation.
In certain circumstances you have a right to have the personal data we hold about you erased. Further information is available on the ICO website at www.ico.org.uk. If you would like your personal data erased, please tell us and we will consider your request. In certain circumstances we have the right to refuse, and where the law requires us to keep the information we must do so. Anti-money laundering records in particular cannot be erased during the five year retention period. If we refuse, we will give you our reasons.
In certain circumstances you have the right to block or suppress the processing of personal data, or to object to it. Further information is available on the ICO website. Please tell us if you want us to stop processing your information, so that we can consider what action is appropriate. Where we hold information because the law requires us to, restriction and objection will have limited effect.
If you object to us using your information for direct marketing, we will stop. That right is absolute and we will not ask you for a reason.
In certain circumstances you have the right to be provided with the personal data we hold about you in a machine-readable format, so that it can easily be provided to a new professional adviser. The right to data portability only applies to personal data you have provided to us, where the processing is based on your consent or on the performance of a contract, and where the processing is carried out by automated means.
We will respond to a portability request without undue delay and within one month. We may extend that period by a further two months where the request is complex or where we receive a number of requests, but we will tell you within one month of receiving the request and explain why the extension is necessary.
Where you have consented to our processing of your personal data, you have the right to withdraw that consent at any time. Please tell us if you wish to do so. Please note that withdrawing consent does not affect the lawfulness of earlier processing; that if you withdraw consent we may not be able to continue to provide services to you; and that even if you withdraw consent, it may remain lawful for us to process your data on another legal basis, for example because we have a legal obligation to continue.
10. Automated decision-making
We do not make decisions about you by automated means alone that produce legal effects concerning you or similarly significantly affect you.
Some of the software we use flags matters for our attention, for example anti-money laundering screening results. Those results are always assessed by a person before any decision is taken.
11. Cookies
Cookies are dealt with separately from this notice, because the law treats them separately and consent to cookies cannot be bundled into a privacy notice.
Our website runs on a third-party platform. We are establishing exactly what it places on visitors' devices, and we will publish a cookie notice together with a means of controlling anything that is not strictly necessary. If you would like to know the position before then, email privacy@mcallisteraccountancy.co.uk and we will tell you.
12. Contact us
If you have requested details of the information we hold about you and you are not satisfied with our response, or you think we have not complied with the UK GDPR or DPA 2018 in some other way, please contact us at privacy@mcallisteraccountancy.co.uk.
If you are not satisfied with our response, you have a right to lodge a complaint with the ICO at www.ico.org.uk or on 0303 123 1113.
McAllister Accountancy Limited, registered in England and Wales, company number 17147807, registered office 12 St Bevans Road, Skircoat Green, Halifax, HX3 0RT.
Privacy Notice version 2.0, 26 August 2026.
Copyright © 2026 McAllister Accountancy Limited
McAllister Accountancy Limited | Registered in England and Wales | Company Number 17147807 | Registered Office: 12 St Bevans Road, Skircoat Green, Halifax HX3 0RT | Registered as a firm by the Association of Chartered Certified Accountants | Firm Number 2000005817 | HMRC authorised agent | Companies House Authorised Corporate Service Provider.