1Who we are

M&B Tax Services Ltd (“we”, “us”, “our”) is a UK accountancy practice registered in England & Wales, company number 09421033, with its registered office at Eastlands Court Business Centre, St Peters Road, Rugby, Warwickshire, CV21 3QP. We are the data controller for the personal data described in this notice. We are regulated by the Institute of Certified Bookkeepers (ICB) and act as a registered HMRC agent on behalf of our clients. If you have any questions about this policy or how we handle your data, contact us at mbtaxoffice@gmail.com or on 07429 166 407.

2What data we collect

The data we hold depends on the service you use. Broadly, it falls into these categories:

Category	Examples
Identity	Full name, date of birth, National Insurance number, UTR, nationality, photo ID (passport or driving licence)
Contact	Home and business address, email address, telephone number
Financial	Bank statements, invoices, receipts, payroll records, VAT records, tax returns, Companies House filings
Employment	Salary, pension contributions, employment status, CIS deduction records
Transaction	Details of services purchased and payments made via Stripe
Technical	IP address, browser type, device information, pages visited on our website

Some of this — such as your National Insurance number and photo ID — is required by law under Anti-Money Laundering (AML) regulations before we can act for you.

3How we collect it

• Directly from you — when you complete a form on our website, email us, phone us, or send us documents.
• From third parties — HMRC, Companies House, your previous accountant, your bank (via open banking feeds where you authorise this), and pension providers.
• Automatically — limited technical data collected when you browse our website.

4Why we use it, and our lawful basis

Under UK GDPR we must have a lawful basis for processing your data. Ours are:

Purpose	Lawful basis
Delivering accounting, payroll, CIS, bookkeeping and formation services	Performance of a contract
Filing returns with HMRC and Companies House on your behalf	Legal obligation
AML and identity verification checks	Legal obligation
Taking payment and issuing invoices	Performance of a contract
Responding to enquiries and providing quotes	Legitimate interests
Sending marketing emails and newsletters	Consent (opt-in)
Improving our website and services	Legitimate interests

5Who we share it with

We never sell your data. We share it only where necessary to deliver our services or comply with the law:

• HMRC — for tax returns, RTI/FPS payroll submissions, VAT returns, CIS300 filings and registrations.
• Companies House — for incorporations, confirmation statements and director filings.
• Pension providers — NEST, The People’s Pension, Smart Pension and similar, for auto-enrolment.
• Software providers — Xero, QuickBooks, FreeAgent, Sage, BrightPay and Dext, all acting as data processors under contract.
• Stripe — our payment processor. We do not store your full card details; Stripe handles these under PCI-DSS.
• Professional advisers — solicitors, insurers or auditors, where legally required.
• Law enforcement or regulators — where we are legally obliged to disclose, including suspicious activity reports under AML rules.

6How long we keep it

We keep your data only as long as necessary:

Record type	Retention period
Client accounting & tax records	6 years after the end of the relevant tax year
Payroll records	6 years from the end of the tax year they relate to
AML identity records	5 years after the end of our business relationship
Company formation documents	6 years after incorporation or dissolution
Enquiries that did not become clients	12 months
Marketing consents	Until you withdraw consent

Once a retention period expires, we securely delete or anonymise the data.

7How we keep it safe

• All documents transmitted through our website use 256-bit SSL encryption.
• Client records are stored on encrypted, access-controlled systems with regular backups.
• Access is restricted to staff who need it to do their job.
• Physical documents are stored securely at our Rugby office and shredded when no longer needed.
• We carry professional indemnity insurance and maintain a documented data breach procedure.

If a breach occurs that is likely to risk your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours and inform you without undue delay.

8Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data, where no legal obligation requires us to keep it.
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests, or to direct marketing at any time.
• Withdraw consent — where processing is based on consent.

To exercise any of these, email mbtaxoffice@gmail.com. We will respond within one calendar month. There is no charge unless a request is manifestly unfounded or excessive. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve it first.

9Cookies

Our website uses a small number of cookies:

• Essential cookies — required for the site to function, such as remembering form progress. These cannot be disabled.
• Analytics cookies — help us understand which pages are useful. These are only set with your consent.

You can control or delete cookies through your browser settings at any time. Blocking essential cookies may stop parts of the site working.

10International transfers

Your data is primarily stored in the UK and EEA. Where a software provider processes data outside the UK, we ensure appropriate safeguards are in place — such as UK adequacy regulations or International Data Transfer Agreements.

11Changes to this policy

We review this policy annually and whenever our practices change. The “last updated” date at the top always reflects the current version. Material changes affecting existing clients will be notified by email.

12Contact us

For any privacy question, data request or complaint:

• Email: mbtaxoffice@gmail.com
• Phone: 07429 166 407
• Post: M&B Tax Services Ltd, Eastlands Court Business Centre, St Peters Road, Rugby CV21 3QP

See also our Terms & Conditions, or get in touch if anything here is unclear.