Privacy Policy

 

Privacy Notice

Caroola Accountancy Limited

  1. Our Commitment to Your Privacy

Caroola Accountancy Limited is committed to protecting your personal information and respecting your privacy.

This Privacy Notice explains how we collect, use, retain, share and protect personal information when you:

  • visit our website;
  • enquire about our services;
  • become or have previously been a client;
  • use our client portal, software or other digital services;
  • communicate with us;
  • participate in surveys, campaigns or referral schemes;
  • ask us to introduce you to an external service provider; or
  • otherwise interact with Caroola Accountancy.

It also explains your rights and how to contact us about the way we handle your personal information.

This notice should be read alongside any additional privacy information provided when we collect information from you for a particular purpose.

  1. Who We Are

Caroola Accountancy Limited is a company registered in England and Wales under company number 06277058.

Our registered office is:

Caroola Accountancy Limited

Apollo House

Hallam Way

Whitehills Business Park

Blackpool

FY4 5FS

Caroola Accountancy Limited is part of the Caroola Group. In certain circumstances and for the purposes described within this Privacy Notice, personal information may be shared between companies within the Caroola Group where this is necessary for operational, compliance, administrative or service delivery purposes.

Caroola Accountancy Limited is the data controller responsible for the personal information covered by this Privacy Notice, unless we tell you otherwise.

References to “Caroola Accountancy”, “Caroola”, “we”, “us” or “our” mean Caroola Accountancy Limited.

We are registered with the Information Commissioner’s Office under registration number ZA170388.

  1. How to Contact Us

We have appointed a Data Team to oversee compliance with this Privacy Notice and applicable data protection law.

If you have any questions, wish to exercise a legal right or want to make a data-protection complaint, please contact:

Email: data@caroola.com

Post:

Data Team

Caroola Accountancy Limited

Apollo House

Hallam Way

Whitehills Business Park

Blackpool

FY4 5FS

  1. Data Protection Law

We process personal information in accordance with applicable UK data protection legislation, including:

  • the UK General Data Protection Regulation;
  • the Data Protection Act 2018;
  • the Data (Use and Access) Act 2025;
  • the Privacy and Electronic Communications Regulations 2003, as amended; and
  • other applicable privacy and electronic communications legislation.

The Data (Use and Access) Act 2025 updates aspects of UK data protection law but does not replace the UK GDPR, the Data Protection Act 2018 or PECR

  1. Data Protection Principles

We will process personal information in accordance with the data protection principles. This means that personal information must be:

  • processed lawfully, fairly and transparently;
  • collected for specified, explicit and legitimate purposes;
  • adequate, relevant and limited to what is necessary;
  • accurate and kept up to date;
  • retained for no longer than necessary;
  • protected using appropriate technical and organisational security measures; and
  • handled in a way that enables us to demonstrate compliance with our obligations.

 

  1. Who This Notice Applies To

This Privacy Notice applies to individuals whose personal information we process in connection with our accountancy services and business activities, including:

 

  • prospective, current and former clients;
  • directors, shareholders, company secretaries and Persons with Significant Control of client companies;
  • employees, contractors and representatives of clients;
  • sole traders and business owners;
  • website and portal users;
  • individuals who contact us or request information;
  • individuals referred to us by another person or organisation;
  • suppliers, consultants and professional contacts; and
  • authorised representatives acting on behalf of a client.

 

This notice does not form part of any contract for services.

 

  1. Personal Information We Collect

Personal information means any information relating to an identified or identifiable individual. It does not include information that has been effectively anonymised so that an individual can no longer be identified.

Depending on the services you use and your relationship with us, we may process the following categories of personal information.

  • Identity Information

This may include:

  • name;
  • previous name;
  • title;
  • date of birth;
  • gender, where relevant;
  • National Insurance number;
  • Unique Taxpayer Reference;
  • company officer or shareholder status;
  • signature; and
  • client, account or portal identifiers.

 

  • Contact Information

This may include:

  • residential or business address;
  • email address;
  • telephone number;
  • preferred method of communication; and
  • emergency or authorised contact information where relevant.

 

  • Identification and Verification Information

This may include:

  • passport;
  • driving licence;
  • proof of address;
  • right-to-work or immigration documentation where relevant;
  • Companies House identity verification or authentication information;
  • electronic identity-verification results;
  • sanctions, politically exposed person and adverse media screening results; and
  • information required for anti-money laundering and client due-diligence checks.

 

  • Company and Professional Information

This may include:

  • company name and number;
  • registered office and trading addresses;
  • business activities;
  • ownership and control information;
  • directorships;
  • shareholdings;
  • employment and professional information;
  • contracts and engagement details; and
  • information concerning your clients, workers or suppliers where necessary to provide our services.

 

  • Financial and Tax Information

This may include:

  • bank account details;
  • payment information;
  • income and expenditure;
  • salary, dividend and pension information;
  • accounts and bookkeeping records;
  • invoices, receipts and bank statements;
  • tax returns, calculations and tax records;
  • VAT, payroll, CIS and Corporation Tax information;
  • assets, liabilities, investments and loan balances; and
  • information about payments made to or received from you or your company.

We do not normally retain complete payment-card details where payment processing is handled securely by a payment provider.

  • Transaction and Service Information

This may include:

  • services purchased from us;
  • payments, charges and refunds;
  • instructions and approvals;
  • account and service history;
  • correspondence relating to our engagement; and
  • complaints, queries and service feedback.

 

  • Technical and Usage Information

This may include:

  • internet protocol address;
  • login and authentication information;
  • browser type and version;
  • device type;
  • operating system;
  • time-zone and approximate location information;
  • website and portal usage;
  • access logs;
  • cookie identifiers; and
  • information about how you interact with our digital services.

 

  • Communication and Marketing Information

This may include:

  • email and written correspondence;
  • telephone-call recordings;
  • communication preferences;
  • marketing preferences;
  • survey responses;
  • feedback and reviews;
  • campaign participation; and
  • information provided through referral or promotional schemes.

Calls may be recorded for training, monitoring, quality, security, evidential and service-improvement purposes.

  • Publicly Available Information

We may collect information from public or official sources, including:

  • Companies House;
  • HMRC;
  • professional registers;
  • insolvency registers;
  • sanctions and politically exposed person databases;
  • public websites; and
  • other publicly accessible records.

 

  • Special Category and Criminal-Offence Information

We do not routinely seek health or other special category information as part of our standard accountancy services.

We may process limited special category information where:

  • you provide it to explain a vulnerability, accessibility requirement or circumstance relevant to our service;
  • it is included within financial, tax or employment records supplied to us;
  • it is necessary to establish, exercise or defend legal claims;
  • the law requires or permits the processing; or
  • another valid condition under data protection law applies.

We may process information relating to criminal convictions, offences, sanctions or suspected financial crime where necessary for anti-money laundering checks, fraud prevention, regulatory compliance or legal claims and where permitted by law.

Where required, we maintain an appropriate policy document covering special category and criminal-offence information.

  1. How We Collect Personal Information

 

  • Information You Give Us

We may collect information when you:

  • enquire about or apply for our services;
  • complete onboarding or identity-verification checks;
  • speak to us by telephone;
  • communicate by email, post or online message;
  • use our website, portal or accounting software;
  • supply accounting, payroll, tax or company information;
  • complete a survey or provide feedback;
  • participate in a campaign or promotional offer;
  • use a refer-a-friend scheme;
  • make a complaint; or
  • ask us to introduce you to an external provider.

 

  • Information Collected Through Our Services

We may collect information through:

  • client portals;
  • accounting and bookkeeping platforms;
  • payroll systems;
  • bank-feed services;
  • identity-verification systems;
  • electronic signatures;
  • website cookies and similar technologies;
  • call-recording systems; and
  • security, access and audit logs.

 

  • Information Received From Other Sources

We may receive personal information from:

  • Companies House and HMRC;
  • banks and payment providers;
  • accountants, tax advisers and other professional advisers;
  • payroll providers;
  • identity-verification, fraud-prevention and credit-reference providers;
  • individuals or organisations authorised by you;
  • introducers and referral partners;
  • business partners;
  • software and technology providers;
  • your employees, agents, contractors or representatives; and
  • publicly available sources.

Where we obtain information from another source, we provide appropriate privacy information unless an exemption applies.

  1. If You Do Not Provide Information

We may need certain personal information to:

  • meet legal or regulatory obligations;
  • complete anti-money laundering checks;
  • enter into or perform our contract with you;
  • submit information to HMRC or Companies House;
  • calculate taxes or prepare accounts;
  • verify instructions; or
  • protect our systems and services.

If you do not provide required information, we may be unable to begin or continue providing services. We will explain the consequences where this applies.

  1. How and Why We Use Personal Information

We will only process personal information where we have a lawful basis.

The applicable basis may include:

  • contract, where processing is necessary to enter into or perform a contract with you;
  • legal obligation, where processing is required by law;
  • legitimate interests, where processing is necessary for our or another party’s legitimate interests and those interests are not overridden by your rights;
  • consent, where you have given valid consent;
  • legal claims, where processing is necessary to establish, exercise or defend legal claims; or
  • another lawful basis or condition permitted under data protection law.
    • Enquiries and Client Onboarding

We use identity, contact, company and service information to:

  • respond to enquiries;
  • provide quotations or service information;
  • establish whether we can provide the requested services;
  • register you as a client;
  • prepare engagement documentation;
  • verify your authority to act for a business; and
  • complete identity and anti-money laundering checks.

The lawful bases are usually taking steps to enter into a contract, performing a contract, complying with legal obligations and our legitimate interests in managing our business safely.

  • Providing Accountancy and Tax Services

We use relevant identity, contact, financial, tax, transaction, company and professional information to:

  • maintain bookkeeping records;
  • prepare accounts and tax returns;
  • calculate tax liabilities;
  • process payroll;
  • prepare VAT, CIS and other submissions;
  • provide tax and accountancy advice;
  • assist with Companies House filings;
  • communicate with HMRC and other authorities where authorised;
  • provide software and portal access; and
  • maintain records of instructions and approvals.

The lawful bases are normally performance of our contract, compliance with legal obligations and our legitimate interests in delivering and administering professional services.

  • Fees and Payments

We process relevant information to:

  • issue invoices;
  • collect payments;
  • manage direct debit arrangements;
  • administer charges and refunds;
  • pursue unpaid amounts;
  • reconcile transactions; and
  • prevent or investigate payment fraud.

The lawful bases are performance of the contract, legal obligation and our legitimate interests in administering our services and recovering amounts owed.

  • Legal, Regulatory and Financial-Crime Compliance

We may use information to:

  • carry out client due diligence;
  • verify identity and business ownership;
  • conduct sanctions and politically exposed person screening;
  • detect and prevent fraud, money laundering and terrorist financing;
  • make disclosures required by law;
  • respond to information requests from authorised bodies; and
  • maintain regulatory and audit records.

The lawful bases are legal obligation, public interest where applicable, and our legitimate interests in protecting our business, clients and the wider financial system.

  • Managing Our Relationship With You

We may use information to:

  • communicate about your services;
  • respond to queries;
  • notify you of service, price or contractual changes;
  • manage complaints;
  • request feedback;
  • assess service quality;
  • improve our services and processes; and
  • maintain accurate records.

The lawful bases are contract, legal obligation and legitimate interests.

  • Business Administration, Security and Improvement

We may process information to:

  • operate and secure our systems;
  • prevent unauthorised access;
  • maintain backups and audit trails;
  • test and improve services;
  • undertake quality assurance;
  • perform business reporting and analysis;
  • manage suppliers;
  • support business continuity;
  • deal with legal claims; and
  • support a corporate reorganisation, sale, acquisition or transfer.

The lawful bases are legal obligation and our legitimate interests in operating, protecting and developing the business.

  • Referrals to External Providers

Where you ask us to introduce you to an external provider, we may share the contact and other limited information necessary to make that introduction.

We will normally do this at your request or with your agreement. The external provider will generally act as an independent data controller and will provide its own privacy information.

We will not disclose extensive accounting or tax records to an external referral partner unless:

  • you instruct or authorise us to do so;
  • disclosure is necessary for a service you have requested; or
  • another lawful basis permits or requires disclosure.

 

  • Marketing

We may use contact, service, technical, usage and marketing-preference information to:

  • send relevant information about our services;
  • tell clients about related services;
  • invite participation in surveys or events;
  • manage marketing preferences; and
  • understand the effectiveness of communications.

Electronic marketing is subject to UK GDPR and PECR. The applicable rules may differ depending on the communication method and whether the recipient is an individual, sole trader, partnership or corporate subscriber.

Where consent is required, we will rely on consent. In other circumstances, we may rely on legitimate interests where permitted, after considering your rights and reasonable expectations.

You can object to direct marketing or withdraw consent at any time by:

 

  • selecting the unsubscribe link in a marketing message;
  • updating your communication preferences; or
  • emailing data@caroola.com.

Opting out of marketing does not prevent us from sending necessary service, legal, regulatory, security or contractual communications.

  1. Legitimate Interests

Where we rely on legitimate interests, those interests may include:

  • providing, managing and improving our services;
  • maintaining accurate client records;
  • securing systems and information;
  • preventing fraud and financial crime;
  • recovering debts;
  • managing complaints and legal claims;
  • monitoring service standards;
  • understanding how clients use our services; and
  • communicating relevant information to business contacts where permitted.

We will consider whether the processing is necessary and whether your interests, rights or freedoms override our interests.

You may object to processing based on legitimate interests. Further information is provided in the “Your Rights” section.

  1. Automated Decision-Making and Profiling

We may use technology to support administrative checks, risk assessment, fraud prevention, identity verification, security monitoring and service delivery.

Where we use solely automated decision-making that produces legal or similarly significant effects, we will:

  • ensure there is a valid lawful basis;
  • provide appropriate information about the processing;
  • apply the safeguards required by law; and
  • provide a way to obtain human intervention or challenge the decision where applicable.

The Data (Use and Access) Act 2025 changed aspects of the automated decision-making framework while preserving safeguards for significant decisions.

  1. Sharing Personal Information

We may share personal information with the following categories of recipient where necessary and lawful:

  • employees and authorised personnel;
  • HMRC and Companies House;
  • law-enforcement agencies, regulators and other public authorities;
  • banks, payment and direct-debit providers;
  • accounting, payroll and software providers;
  • cloud hosting, IT support, communications and cybersecurity suppliers;
  • identity-verification, fraud-prevention and credit-reference agencies;
  • auditors, legal advisers, insurers and other professional advisers;
  • mailing, document management and electronic-signature providers;
  • outsourced service providers and contractors;
  • organisations that introduced you to us, where appropriate;
  • organisations you ask us to introduce you to;
  • service and benefits providers included within your package;
  • prospective purchasers, investors or advisers involved in a business sale, merger or reorganisation; and
  • other parties where you authorise disclosure or where disclosure is required or permitted by law.

Caroola Group Companies

Where necessary for the purposes described in this Privacy Notice, personal information may be shared with other companies within the Caroola Group. Such sharing may occur to support the delivery of services, client administration, compliance obligations, technology and system support, regulatory requirements, internal governance, business reporting and service improvement activities.

Any sharing of personal information within the Caroola Group will be undertaken in accordance with applicable data protection legislation and subject to appropriate safeguards and access controls.

Service Providers

Some recipients act as processors and may only process personal information for the agreed purpose, under contractual terms and subject to appropriate security requirements.

Independent Controllers

Other recipients, including HMRC, Companies House, banks, insurers, legal advisers, financial advisers and certain referral partners, may act as independent controllers. They will determine how they use information for their own purposes and should provide their own privacy information.

We do not sell personal information.

  1. External Partners

Where you request or agree to an introduction, external partners may include providers of:

  • financial planning and pension advice;
  • mortgage and protection advice;
  • insurance;
  • banking;
  • business finance;
  • legal services;
  • IR35 reviews;
  • contractor support services;
  • healthcare and wellbeing services;
  • rewards platforms; and
  • will-writing services.

Current providers may include Caroola Financial Planning, Caroola Mortgages, RQ Ratings Limited, Alfa Wealth, Contractor Wealth, Interactive Investor, Qdos Broker and Underwriting Services Limited, Kingsbridge, Tide, Zempler, WPA Healthcare Practice, Switch Health, Funding Options, Helium Law, CMME, Cleerly, IPSE, Boostworks and Thomas Bradley & Co.

This list should be kept under regular review. An organisation may change its name, ownership, regulatory status or service offering. An introduction does not mean that Caroola controls the provider or is responsible for its independent processing of personal information.

  1. International Transfers

Some suppliers or technology providers may store, access or process personal information outside the United Kingdom.

Where a restricted international transfer takes place, we will use an appropriate transfer mechanism. This may include:

  • UK adequacy regulations;
  • the UK International Data Transfer Agreement;
  • the UK Addendum to European Commission Standard Contractual Clauses;
  • approved binding corporate rules; or
  • another safeguard or exception permitted by law.

Where required, we will complete an appropriate transfer risk assessment, also referred to in legislation as a data protection test.

The ICO identifies the UK IDTA and UK Addendum as approved contractual safeguards for restricted transfers and explains that a transfer risk assessment may also be required.

You may contact the Data Team for further information about the safeguards used for a particular transfer.

  1. Information Security

We maintain technical and organisational security measures designed to protect personal information against accidental or unlawful:

  • loss;
  • destruction;
  • alteration;
  • unauthorised disclosure; and
  • unauthorised access.

Our measures include, where appropriate:

  • access controls;
  • authentication controls;
  • employee confidentiality requirements;
  • staff training;
  • system monitoring;
  • secure backup arrangements;
  • incident-management procedures;
  • supplier assurance; and
  • Cyber Essentials Plus certification.

Access is limited to personnel and suppliers with an appropriate business need.

Where a personal data breach occurs, we will investigate it and notify the Information Commissioner’s Office and affected individuals when legally required.

No security system can eliminate every risk. Clients should also take appropriate steps to protect passwords, devices and account information.

  1. Data Retention

We retain personal information only for as long as reasonably necessary to:

  • provide our services;
  • meet legal, accounting, tax and regulatory requirements;
  • satisfy anti-money laundering obligations;
  • respond to complaints;
  • establish, exercise or defend legal claims;
  • meet insurance requirements; and
  • maintain appropriate business records.

Different categories of information are retained for different periods.

When determining the appropriate period, we consider:

  • the nature and sensitivity of the information;
  • the purpose for which it is processed;
  • legal and regulatory limitation periods;
  • tax and accounting requirements;
  • anti-money laundering requirements;
  • contractual requirements;
  • insurance requirements; and
  • risks arising from continued retention.

Information may be retained for longer where:

  • litigation or a complaint is ongoing or reasonably anticipated;
  • HMRC or another authority has opened an enquiry;
  • the law requires a longer period; or
  • preserving the information is necessary for a legal claim.

When information is no longer required, it will be securely deleted, destroyed or anonymised.

Anonymised information that can no longer identify an individual may be retained and used for statistical, research, operational or reporting purposes.

  1. Your Rights

Depending on the circumstances, you may have the following rights.

  • Access

You may request confirmation that we process your personal information and obtain a copy of that information.

  • Rectification

You may ask us to correct inaccurate personal information or complete incomplete information.

  • Erasure

You may ask us to erase personal information where there is no lawful reason for us to continue processing it.

This right is not absolute. We may retain information where required by law or necessary for tax, regulatory, contractual or legal-claims purposes.

  • Restriction

You may ask us to restrict processing in certain circumstances, including while accuracy or an objection is being considered.

  • Objection

You may object to processing based on legitimate interests because of your particular situation.

You have an absolute right to object to processing for direct-marketing purposes.

  • Data Portability

Where the relevant conditions apply, you may request personal information you provided to us in a structured, commonly used and machine-readable format or ask us to transmit it to another controller.

  • Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect processing carried out lawfully before consent was withdrawn.

  • Automated Decisions

Where applicable, you may have rights relating to significant decisions made solely by automated means, including rights to information, human intervention and challenge.

  1. Exercising Your Rights

To exercise a right, contact the Data Team at data@caroola.com.

We may request information to verify your identity and authority. This is a security measure intended to prevent personal information being disclosed to an unauthorised person.

You will not normally need to pay a fee. We may charge a reasonable fee or refuse to act where permitted by law if a request is manifestly unfounded or excessive.

We normally respond within one month. Where permitted because a request is complex or multiple requests have been made, we may extend the response period and will inform you.

  1. Data-Protection Complaints

If you have concerns about how we have handled your personal information, please raise them with our Data Team:

Email: data@caroola.com

Post:

Data Team

Caroola Accountancy Limited

Apollo House

Hallam Way

Whitehills Business Park

Blackpool

FY4 5FS

We will:

  • provide an accessible way to submit a complaint;
  • acknowledge receipt in accordance with applicable legal requirements;
  • make appropriate enquiries without undue delay;
  • keep you informed where additional time is needed; and
  • explain the outcome without undue delay.

The Data (Use and Access) Act 2025 introduced specific requirements for organisations to maintain a data-protection complaints process. ICO materials state that organisations must provide a means of making a complaint, acknowledge it within 30 days, take appropriate steps to respond, keep the complainant informed and communicate the outcome without undue delay.

You may also complain to the Information Commissioner’s Office. We would appreciate the opportunity to address your concerns first, but this does not affect your right to approach the ICO.

ICO telephone: 0303 123 1113

Website: https://ico.org.uk/

  1. Cookies and Similar Technologies

Our website and digital services may use cookies and similar technologies to:

  • provide necessary functions;
  • maintain security;
  • remember preferences;
  • understand website usage;
  • improve performance; and
  • support marketing where permitted.

Further information is available in our Cookie Policy, including the cookies used, their purposes and how to manage preferences.

The Data (Use and Access) Act 2025 made changes to some cookie and storage-access rules, including limited circumstances in which certain statistical or functionality technologies may be used without consent, subject to applicable conditions.

  1. Third-Party Websites

Our website, portal or communications may contain links to external websites and services.

We do not control independently operated third-party websites and are not responsible for their privacy practices. You should review the privacy information provided by the relevant third party before submitting personal information.

  1. Changes to This Notice

We may update this Privacy Notice to reflect:

  • changes in the law;
  • regulatory guidance;
  • changes to our services;
  • changes to suppliers or technology;
  • changes to our business structure; or
  • improvements to our privacy practices.

The current version will be published on our website. Where a change materially affects how we use personal information, we will provide additional notice where appropriate.

Last updated: October 2026