Privacy notice

This notice explains how Ailo Accounting collects, uses and protects your personal data in compliance with UK GDPR and the Data Protection Act 2018.

1. Who we are

Ailo Accounting(“we”, “us”, “our”) is the data controller for personal data you provide through https://www.ailoaccounting.co.uk and through any client engagement.

Contact for data-protection queries: hello@ailoaccounting.co.uk.

2. What data we collect

We may collect the following categories of personal data:

• Contact data: name, email address, phone number, business name. Collected when you contact us, request a quote, or sign up as a client.
• Business and tax data: information about your business activity, turnover, income, expenses and tax position. Collected when you become a client so we can carry out the services you have engaged us for.
• Identity verification data: documents we need to comply with anti-money-laundering law (passport, driving licence, proof of address). Collected at the start of every client engagement.
• Financial data: bank account details for Direct Debit collection of fees, transaction data from accounting software you authorise us to access.
• Technical data: anonymised analytics such as page views, device type and approximate country location. We do not use this to identify individuals.

3. How we use your data

We use personal data for the following purposes:

• Responding to enquiries you send us
• Providing the accounting services you have engaged us for
• Communicating with HMRC, Companies House and pension providers on your behalf where you have authorised this
• Complying with our legal obligations (anti-money-laundering, tax record-keeping)
• Billing and collecting payment for our services
• Improving our website and services through anonymised analytics

4. Lawful bases

We process personal data on the following lawful bases under UK GDPR:

• Contract: where processing is necessary to perform our agreement with you (the engagement letter)
• Legal obligation: where we must process data to comply with law (anti-money-laundering, tax authority requirements)
• Legitimate interests: for responding to enquiries from non-clients, and for improving our website (provided this does not override your rights)
• Consent: where you have opted in to optional communications (e.g., a newsletter, if we ever offer one)

5. How we store and protect your data

Personal data is stored on encrypted systems hosted in the UK or EEA. Access is restricted to staff members who need it to carry out their work. We use strong authentication, encrypted backups and regular security reviews.

For accounting software, we use HMRC-approved MTD-compatible providers (such as FreeAgent or Xero), which apply their own UK GDPR-compliant security measures.

6. How long we keep your data

• Enquiry data from non-clients: up to 12 months from last contact, then deleted.
• Client records: for at least 6 years after the end of the engagement, in line with HMRC and AML record-keeping requirements. Some categories (such as company-formation records where we acted) are kept for longer where law requires.
• Identity verification documents: 5 years after the engagement ends, as required by the Money Laundering Regulations.

7. Who we share data with

We share your data only with the parties listed below, only when necessary, and only to the extent required:

• HMRC and Companies House: as part of the services we provide for you
• Pension and payroll providers: where you have authorised us to run payroll or process pension contributions
• Accounting software providers: where you use software we have set up for you (FreeAgent, Xero, etc.)
• Our professional advisers: legal, insurance, IT, where strictly necessary
• Law enforcement and regulators: where required by law (e.g., suspicious activity reports under the Proceeds of Crime Act 2002)

We never sell your data, and we do not share it for marketing purposes.

8. International transfers

We do not routinely transfer personal data outside the UK or EEA. If a software provider we use is based outside the UK/EEA, we ensure they have adequate safeguards in place (such as Standard Contractual Clauses) before any transfer.

9. Your rights under UK GDPR

You have the right to:

• Access: ask for a copy of the personal data we hold about you
• Rectification: ask us to correct inaccurate or incomplete data
• Erasure: ask us to delete your data (subject to legal retention requirements)
• Restriction: ask us to limit how we process your data
• Portability: ask for your data in a portable, machine-readable format
• Objection: object to processing based on legitimate interests
• Withdraw consent: where we are processing on the basis of consent

To exercise any of these rights, email hello@ailoaccounting.co.uk. We respond within one calendar month.

10. Cookies

We use essential cookies only by default. Any analytics or marketing cookies are set only with your consent through the cookie banner. You can withdraw cookie consent at any time by clearing your browser data and re-visiting the site.

11. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at hello@ailoaccounting.co.ukso we can try to resolve it. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

12. Changes to this notice

We may update this notice from time to time. The current version is always at this URL with the “last updated” date at the top. Material changes will be notified to clients by email.