AJ Business Accounting Ltd and AJ Probate Services Ltd
Privacy Notice

Updated: 30^th March 2026

1.1.  Introduction

The Data Protection Act 2018 (“DPA 2018”) and the UK General Data Protection Regulation (“UK GDPR”) impose certain legal obligations in connection with the processing of personal data. This notice is about AJ Business Accounting Ltd and AJ Probate Services Ltd, referred to as “The Companies” throughout this notice. The Companies are controllers within the meaning of the UK GDPR. The firm’s contact details are as follows:

The Retreat

Butts Way

Milverton

Taunton

Somerset

TA4 1JR

We may amend this privacy notice from time to time. If we do so, we will supply you with and/or otherwise make available to you a copy of the amended privacy notice.

Where we act as a processor on behalf of a controller (for example, when processing payroll), we rely on the privacy notices as provided by our suppliers. We can direct you to those schedules relevant to you on request.

1.2.  The purposes for which we process personal data

We process personal data for the following purposes:

·to enable us to supply professional services to you as our client

·to fulfil our obligations under relevant laws in force from time to time (e.g. the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (“MLR 2017”))

·to comply with professional obligations to which we are subject, for example as a result of our obligations to the Chartered Institute of Management Accountants, or to the Institute of Chartered Accountants in England and Wales (who supervise The Companies for Anti-Money Laundering, and for Probate Services)

·to use in the investigation and/or defense of potential complaints, disciplinary proceedings and legal proceedings

·to enable us to invoice you for our services and investigate/address any attendant fee disputes that may have arisen

·to contact you about other services we provide which may be of interest to you if you have consented to us doing so

1.3.  The legal bases for our intended processing of personal data

We rely on the following legal bases in order to process your personal data:

·occasionally we will rely on your consent to process your personal data;

·the processing is necessary for the performance of our contract with you;

·the processing is necessary for compliance with legal obligations to which we are subject (e.g. MLR 2017);

·the processing is necessary for our legitimate interests, such as:

oinvestigating/defending legal claims

orecovering debts owed to us

okeeping our client records up to date

oto develop our services and grow our business

It is a requirement of our contract with you that you provide us with the personal data that we request. If you do not provide the information that we request, we may not be able to provide professional services to you. If this is the case, we will not be able to commence acting or may need to cease to act.

1.4.  Types of Personal Data that we collect

We will collect personal data to allow us to comply with our legal obligations, and to fulfil our contract with you and/or your business. The types of personal data that we collect include:

·Photo and Address ID (for example driving licence, passport, bank statement and utility bill)

·Current and Previous Names, current and previous addresses, date of birth, National insurance number, sex and gender identity, marital status, Companies House personal codes

·Bank account statements and / or data downloads from your banking history

·In some circumstances we may need to ask for criminal conviction data in respect of our Probate Services, or in respect of our Anti-Money-Laundering compliance checks.

·Data held by HMRC, such as historic tax due and paid, tax penalties and interest charged

1.5.  Persons/organisations from whom we may receive personal data

We will receive personal data to allow us to comply with our legal and contractual obligations, or as a result of access to other organisations. The orgainisations and types of personal data that we receive include:

·HMRC: historic tax due and paid, tax penalties and interest charged.

·Companies House: Name, address, companies with which you are or have been associated.

1.6.  Special Category Data

In the course of providing probate, accountancy, tax, payroll, anti-money laundering, and related professional services, the Companies may occasionally process special category personal data and criminal offence data where this is necessary and lawful.

Special category data may include information about health, religious or philosophical beliefs, sexual orientation, biometric data used for identification, genetic data, and other Article 9 categories where relevant to the matter. Criminal offence data may include information about allegations, investigations, proceedings, convictions, sanctions, fraud, or other unlawful conduct where relevant to legal obligations, anti-money laundering checks, probate disputes, safeguarding, or the establishment, exercise or defence of legal claims.

Where the Companies process special category personal data, they will do so only where they have both a valid lawful basis under Article 6 UK GDPR and a separate condition for processing under Article 9 UK GDPR. Depending on the circumstances, this may include explicit consent, the establishment, exercise or defence of legal claims, vital interests, or reasons of substantial public interest supported by the Data Protection Act 2018.

Where the Companies process criminal offence data, they will do so only where this is permitted under Article 10 UK GDPR and the Data Protection Act 2018, and only where an appropriate lawful basis and condition has been identified.

The Companies apply additional safeguards to this data, including limiting access to those who need it, minimising the amount collected and shared, using secure systems and disposal methods, and retaining it only for as long as necessary in accordance with legal, regulatory, professional and risk-management requirements.

Further details of the safeguards applied to special category and criminal offence data are set out in the Companies’ internal Appropriate Policy Document.Special Category Data

1.7.  Persons/organisations to whom we may give personal data

In general, we have a “no confirm no deny” policy in respect of data sharing. This means that in the event of an inquiry from somebody who we are not sure has your consent to share data, we will neither confirm nor deny whether you are a client of The Companies. If we deem that there is a legitimate inquiry from a third party, we may contact you requesting your permission to share data.

We may share your personal data with:

·HMRC, Companies House, The Charities Commission or the FCA as relevant to you and your business.

·Your spouse or partner, if we deem that your tax or business interests are closely connected, or if we have done so in the past.

·any third parties with whom you require or permit us to correspond

·subcontractors

·an alternate appointed by us in the event of incapacity or death

·tax insurance providers

·professional indemnity insurers

·our professional body (the Chartered Institute of Management Accountants and the Institute of Chartered Accountants in England and Wales) and/or the Office of Professional Body Anti-Money Laundering Supervisors (OPBAS) in relation to practice assurance and/or the requirements of MLR 2017 (or any similar legislation), this includes the Financial Conduct Authority (FCA).

·other professional consultants and service providers

·third party software providers as necessary to discharge our data processing and storage needs, e.g. Microsoft, Google, software providers for example for tax, company secretarial, or payroll processing, Customer Relationship Management (e.g. Bright Manager)

If the law allows or requires us to do so, we may share your personal data with:

·the police and law enforcement agencies

·courts and tribunals

·the Information Commissioner’s Office (“ICO”).

·We may need to share your personal data with the third parties identified above in order to comply with our legal obligations, including our legal obligations to you. If you ask us not to share your personal data with such third parties we may need to cease to act.

1.8.  Transfers of personal data outside the EU

Our policy is to use data storage providers who will store and retain your data within the EU, for example Microsoft OneDrive, Bright Manager. These suppliers may also store data outside the EU. We may also use third party suppliers who will process data outside the EU, for example we may use “offshoring” services to provide accounting resources.

1.9.  Retention of personal data

When acting as a data controller and in accordance with recognised good practice within the tax and accountancy sector we will retain all of our records relating to you as follows:

·It is our policy to retain information for six years from the date the business relationship ceased

Our contractual terms provide for the destruction of documents after six years and therefore agreement to the contractual terms is taken as agreement to the retention of records for this period, and to their destruction thereafter.

You are responsible for retaining information that we send to you (including details of capital gains base costs and claims and elections submitted) and this will be supplied in the form agreed between us. Documents and records relevant to your tax affairs are required by law to be retained by you as follows:

If we are required by law, for example because of a legal claim, records many be retained beyond this time limit.

Where we act as a processor as defined in DPA 2018, we will delete or return all personal data to the controller as agreed with the controller at the termination of the contract.

1.10.  Requesting personal data we hold about you (subject access requests)

You have a right to request access to your personal data that we hold. Such Requests are known as ‘subject access Requests’ (“SARs”).

Please provide all SARs in writing.

To help us provide the information you want and deal with your request quickly, you should include enough details to enable us to verify your identity and locate the relevant information. For example, you should tell us:

·Your name and (if applicable) previous names

·The approximate dates when we collected data from you

·what type of information you want to know

We may ask for additional identity information, to verify that your request is legitimate.

DPA 2018 requires that we comply with a SAR promptly and in any event within one month of receipt. There are, however, some circumstances in which the law allows us to refuse to provide access to personal data in response to a SAR (e.g. if you have previously made a similar request and there has been little or no change to the data since we complied with the original request).

You can ask someone else to request information on your behalf – for example, a friend, relative or solicitor. We must have your authority to respond to a SAR made on your behalf. You can provide such authority by signing a letter which states that you authorise the person concerned to write to us for information about you, and/or receive our reply.

Where you are a controller and we act for you as a processor (e.g. by processing payroll), we will assist you with SARs on the same basis as is set out above.

1.11.  Putting things right (the right to rectification)

You have a right to obtain the rectification of any inaccurate personal data concerning you that we hold. You also have a right to have any incomplete personal data that we hold about you completed. Should you become aware that any personal data that we hold about you is inaccurate and/or incomplete, please inform us immediately so we can correct and/or complete it.

1.12.  Deleting your records (the right to erasure)

In certain circumstances you have a right to have the personal data that we hold about you erased. Further information is available on the ICO website (www.ico.org.uk). If you would like your personal data to be erased, please inform us

and we will consider your request. In certain circumstances (for example due to obligations under AML or tax law) we have the right to refuse to comply with a request for erasure. If applicable, we will supply you with the reasons for refusing your request.

1.13.  The right to restrict processing and the right to object

In certain circumstances you have the right to ‘block’ or suppress the processing of personal data or to object to the processing of that information. Further information is available on the ICO website (www.ico.org.uk). Please inform us immediately if you want us to cease to process your information or you object to processing so that we can consider what action, if any, is appropriate.

1.14.  Obtaining and reusing personal data (the right to data portability)

In certain circumstances you have the right to be provided with the personal data that we hold about you in a machine readable format, e.g. so that the data can easily be provided to a new professional adviser. Further information is available on the ICO website (www.ico.org.uk).

The right to data portability only applies:

·to personal data an individual has provided to a controller

·where the processing is based on the individual’s consent or for the performance of a contract

·when processing is carried out by automated means

We will respond to any data portability requests made to us without undue delay and within one month. We may extend the period by a further two months where the request is complex or a number of requests are received but we will inform you within one month of the receipt of the request and explain why the extension is necessary.

1.15.  Withdrawal of consent

Where you have consented to our processing of your personal data, you have the right to withdraw that consent at any time. Please inform us immediately if you wish to withdraw your consent.

Please note:

·the withdrawal of consent does not affect the lawfulness of earlier processing

·if you withdraw your consent, we may not be able to continue to provide services to you

·even if you withdraw your consent, it may remain lawful for us to process your data on another legal basis (e.g. because we have a legal obligation to continue to process your data).

1.16.  Automated decision-making

We do not intend to use automated decision-making in relation to your personal data.

1.17.  Complaints

If you have requested details of the information we hold about you and you are not happy with our response, or you think we have not complied with the GDPR or DPA 2018 in some other way, you can complain to us using the contact details provided at the start of this notice.

If you are not happy with our response, you have a right to lodge a complaint with the ICO (www.ico.org.uk).

1.18.  We will never use or share your information for marketing purposes without your consent. We may from time to time contact you if we become aware of a service or a need from a third party or another client that might benefit you.