Last updated: 7 September 2026
 

1. Who we are

Self Assessment Systems Ltd is an accountancy practice registered in England and Wales.
Company Number: 03284147

Our registered office is:

Office Suite 4
4 Bridge Street Mills
Bridge Street
Witney
Oxfordshire
OX28 1FX

Email: gdpr@sasaccountants.co.uk
Telephone: 01993 775636

We are normally the data controller for the personal information described in this notice. Where we process information solely on a client’s instructions, such as certain payroll or bookkeeping information, we may act as a data processor and the client will remain the data controller.

2. Who this notice applies to

This notice applies to:

• current, former and prospective clients;

• people connected with our clients, including directors, shareholders, partners, employees, subcontractors and family members;

• professional and business contacts; and

• visitors to our website.

3. Information we collect

Depending on the services we provide, we may collect:

• names, addresses, dates of birth and contact details;

• National Insurance numbers, Unique Taxpayer References and other tax identifiers;

• identification documents and information required for anti-money laundering checks;

• financial information, including income, expenses, bank details, transactions, assets and liabilities;

• accounting, tax, VAT, payroll, pension and employment information;

• information about businesses, directorships, shareholdings and business relationships;

• correspondence, instructions, records of advice and signed documents;

• information about website use, including IP address, browser, device information and cookies; and

• limited special-category information, such as health information relevant to payroll, statutory payments or tax claims, where necessary.

We may also process information relating to suspected fraud or unlawful activity where necessary to meet our legal and regulatory obligations.

4. Where we obtain information

We normally obtain information:

• directly from you;

• from a client, employer, company or other person that you are connected with;

• from previous accountants or professional advisers;

• from HM Revenue & Customs, Companies House and other public bodies;

• from banks, bookkeeping systems, payroll systems and other software platforms;

• from identity-verification and anti-money laundering providers; and

• from publicly available records.

Some information is required so that we can comply with anti-money laundering and other legal obligations or provide the services agreed with you. If required information is not provided, we may be unable to accept an appointment, continue acting or complete the relevant work.

5. How we use information and our lawful bases

We use personal information only where necessary for the following purposes:

• Contract: to respond to enquiries, take steps before accepting an appointment, provide agreed services, communicate with clients and manage our engagement.

• Legal obligation: to comply with tax, accounting, company law, anti-money laundering, regulatory, record-keeping and reporting requirements.

• Legitimate interests: to operate and administer our practice, manage client relationships, maintain accurate records, protect our systems, prevent fraud, recover fees, improve our services and establish or defend legal claims.

• Consent: where we specifically ask for consent, including for certain marketing communications or non-essential cookies where consent is required.

Where we rely on legitimate interests, we consider whether those interests are proportionate and whether they are overridden by the rights and interests of the person concerned.

Where we process special-category or criminal-offence information, we do so only where it is necessary and an additional legal condition applies.

Necessary service communications, including deadline reminders and information about work we are carrying out, are not marketing communications.

We do not use personal information to make decisions based solely on automated processing that have legal or similarly significant effects.

6. Who we share information with

Where necessary, we may share personal information with:

• HM Revenue & Customs, Companies House and other government or public authorities;

• payroll, pension, banking and payment providers;

• identity-verification and anti-money laundering providers;

• accounting, tax, bookkeeping, payroll, document-management and secure-portal providers;

• website, email, cloud-hosting and IT-support providers, including Wix in connection with our website;

• our employees, contractors and outsourced service providers who are subject to confidentiality and data-protection requirements;

• professional bodies, regulators and supervisory authorities;

• insurers, auditors, legal advisers and debt-recovery advisers;

• previous or successor accountants where authorised; and

• courts, law-enforcement bodies or other organisations where disclosure is required or permitted by law.

We do not sell personal information.

7. International transfers

Some of our software and cloud-service providers may process information outside the UK, including in the European Economic Area or the United States.

Where a restricted international transfer takes place, we require an appropriate legal safeguard. This may include UK adequacy regulations, the UK–US data bridge where applicable, the UK International Data Transfer Agreement or the UK Addendum to approved contractual clauses.

You may contact us for further information about the safeguards applying to a particular transfer.

8. How long we keep information

We retain information only for as long as it is reasonably required for the purpose for which it was collected.

Our normal retention periods are:

• accounting, tax and payroll working papers and related correspondence: generally six years after the end of the relevant accounting or tax period or completion of the work;

• client engagement and administration records: generally six years after our professional relationship ends;

• anti-money laundering identification and due-diligence records: generally five years after the business relationship ends;

• enquiries that do not become clients: generally 12 months after the last meaningful contact; and

• website and cookie information: for the periods described in our cookie settings.

We may retain information for longer where required by law or while a tax enquiry, regulatory matter, complaint or legal claim remains possible or ongoing. Information that is no longer required will be securely deleted or anonymised.

9. Your rights

Depending on the circumstances and our lawful basis, you may have the right to:

• obtain a copy of your personal information;

• have inaccurate or incomplete information corrected;

• request erasure of your information;

• request restriction of its use;

• receive certain information in a portable format;

• object to particular uses of your information; and

• withdraw consent where processing is based on consent.

These rights are not absolute. For example, we may need to retain information to comply with tax, anti-money laundering or other legal obligations.

To exercise a right, contact gdpr@sasaccountants.co.uk. We may need to confirm your identity before dealing with your request.

Your right to object

You have an absolute right to object to your personal information being used for direct marketing.

You may also object where we rely on legitimate interests. We will consider your objection and stop processing unless we have a lawful reason to continue.

10. Cookies and website information

Our website is hosted by Wix and uses cookies and similar technologies for essential operation, security and website analytics.

Further information about the cookies used, their purposes and their duration is available through our cookie settings. Where consent is legally required, the relevant cookies will not be used unless consent is given. Where a lawful statistical-analytics exception is used, visitors will be given a simple way to object.

Cookie preferences can be changed through the website’s cookie settings.

11. Security

We use appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure. Access is restricted to people and service providers who need the information for authorised purposes.

12. Information about children

Our website and services are not directed at children. We may nevertheless process limited information about a child or dependant where it is relevant to a client’s tax, payroll or accounting affairs. Such information will normally be provided by a parent, guardian, employer or client and will be used only where necessary and lawful.

13. Complaints

If you have a concern or complaint about how we use personal information, please contact gdpr@sasaccountants.co.uk and state that you are making a data-protection complaint.

We will acknowledge a data-protection complaint within 30 days, investigate it, keep you informed where appropriate and tell you the outcome without undue delay.

If you remain dissatisfied, you may complain to the Information Commissioner’s Office:

https://ico.org.uk/make-a-complaint/

14. Changes to this notice

We may update this notice when our services, systems or legal obligations change. The latest version will be published on our website with its revision date. Where a change materially affects how we use existing information, we will take reasonable steps to bring it to the attention of the people affected.