Our Privacy Policy

Who we are and what this covers

Concrete Accounts Ltd, company number 14822426, registered in England and Wales, is the data controller for the personal data described here. That means we decide what is collected and why. The policy covers the people we deal with: clients, their directors, staff and subcontractors where their details reach us through payroll or CIS, people who enquire through the website or the intake quiz, suppliers, and visitors to concreteaccounts.com. It sets out what we hold, the legal grounds we rely on, who else sees it, how long records are kept and the rights you can use. This version takes effect on 22 October 2026.

What personal data we collect

The data falls into three groups, depending on where it comes from.

Information you give us

Your name, business name, email address, phone number and what you tell us when you answer the intake quiz, send a message or speak to us on WhatsApp, phone or email. Once you engage us, this extends to the records we need for the work: bank statements, sales and purchase invoices, receipts, payroll and pension details for your team, subcontractor details for CIS, tax references, and the identity documents required for anti-money laundering checks.

Information collected automatically

When you visit the website we collect technical data through cookies and similar tools: your IP address, approximate location, browser and device type, the pages you look at, how long you stay and the site or advert that sent you. We use this to keep the site working, to spot abuse and to see which pages are useful. Our cookie policy at /cookie-policy/ lists what is set and how to refuse the optional ones.

Information from third parties

We receive data from HMRC and Companies House about you and your company, from your previous accountant when we take over, and from the bank feeds, bookkeeping, payroll and document-sharing software used on your account. We may receive identity and verification results from screening providers used for anti-money laundering checks, and contact details from someone who refers you to us.

The legal grounds we rely on

Every use of your data sits under one of four lawful bases in the UK GDPR.

To provide our services (Contract)

Once you engage us, we process your data to do the job you are paying for: bookkeeping, VAT returns, CIS returns, payroll and auto-enrolment, year-end accounts, corporation tax, director self assessment and quarterly reporting. Without this data we cannot prepare or file anything, raise invoices or answer your questions.

To meet our legal obligations (Legal obligation)

UK law requires us to verify client identity and keep anti-money laundering records under the Money Laundering Regulations 2017, to make statutory filings to HMRC and Companies House, to keep accounting records, and to respond to lawful requests during an HMRC enquiry or investigation. We cannot delete data we are required to hold.

To run and improve our business (Legitimate interests)

We rely on legitimate interests to administer client accounts, keep our own records of advice given, protect the website and our systems from misuse, measure which pages bring enquiries, and tell existing clients about services of ours that relate to work we already do for them. You can object to any of this at any time.

Where you have agreed (Consent)

We rely on consent for marketing emails to people who are not yet clients, for optional analytics and advertising cookies, and for publishing anything you send us such as a review or a quote. You can withdraw consent whenever you like by using the unsubscribe link, changing your cookie choice or emailing us. Withdrawing it does not affect what was done beforehand.

Who we share your data with

We do not sell your data and we do not pass it on for anyone else’s marketing.

Data is shared only where it is needed to deliver the work, to meet a legal duty, or to run the systems we use. Everyone we share with is bound by a contract or a professional duty of confidentiality, and sees only what they need.

HMRC and Companies House

We submit VAT returns, CIS returns, payroll information, corporation tax returns, self assessment returns, annual accounts and confirmation statements on your behalf, and we correspond with HMRC when there is a query or an enquiry.

Software providers

Cloud bookkeeping, payroll, tax filing, document signing, secure file storage, email and website hosting providers process data on our instructions. Each is appointed under a written data processing agreement and may not use your data for its own purposes.

Professional advisers

Where a matter needs it, and normally with your agreement, we share relevant information with your solicitor, insurance broker, bank or lender, an independent tax specialist, or our own insurers and legal advisers if a claim or dispute arises.

Regulatory and legal authorities

We disclose information to our anti-money laundering supervisor, to the National Crime Agency where the law requires a report, and to police, courts or other authorities where we are compelled by a court order or statutory notice.

Sending data outside the UK

Most of your data stays on UK or European servers. Some of the cloud software, email and website services we use are supplied by companies based outside the UK, so limited data may be stored or accessed in the European Economic Area or the United States. Where data goes to a country the UK has not deemed adequate, the transfer is covered by the International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses, together with the provider’s own security measures. You can ask us which providers are involved and what safeguards apply.

How long we keep your data

We keep records for as long as the work, the law or a possible claim requires, then delete them.

Client records

Accounting, tax and payroll records and the correspondence that goes with them are kept for at least six years after the end of the engagement, in line with the Money Laundering Regulations 2017 and HMRC’s record-keeping rules. Some tax records are held longer where a claim or enquiry could still arise.

Enquiry and prospect data

If you answer the intake quiz or contact us and do not become a client, we keep your details for up to 24 months from your last contact so we can pick up the conversation where it stopped. After that they are deleted or anonymised.

Website analytics

Analytics data linked to a device or visit is kept for up to 26 months, then deleted or held only as aggregate totals that cannot identify anyone. Cookie preferences are stored on your device until you clear them or they expire.

Marketing consent records

Where you have opted in or out of marketing, we keep a record of that choice for as long as it applies and for two years afterwards, so we can show the choice was respected and so we do not email you again by mistake.

Your rights over your data

These are statutory rights under the UK GDPR, and they are free to use. Some of them are qualified, so in a few cases we have to explain why we cannot act on a request in full.

Right to be informed

You can be told what we hold about you, why we hold it and who else sees it. This policy is how we give that information, and we will answer follow-up questions in plain terms if anything is unclear.

Right of access

You can make a subject access request and receive a copy of the personal data we hold about you, with an explanation of how it is used. Email us and we will reply within one month, normally free of charge.

Right to rectification

If anything we hold about you is wrong or incomplete, tell us and we will correct or complete it, and let anyone we have shared it with know where that is practical. This applies to your details, never to figures we are required to report accurately.

Right to erasure

You can ask us to delete your data. We will, unless we are required to keep it, which is usually the case for accounting and anti-money laundering records held for at least six years after the engagement ends.

Right to restrict processing

You can ask us to pause the use of your data while a dispute about its accuracy or our legal grounds is sorted out. We will keep the data but stop using it, apart from storage or defending a legal claim.

Right to data portability

Where you gave us data and we process it by consent or under our contract with you, you can ask for it in a common machine-readable format, or ask us to send it straight to another provider where that is technically possible.

Right to object

You can object to processing we carry out under legitimate interests, including profiling. If you object to direct marketing we will stop immediately. For other objections we stop unless we have compelling grounds that override your interests.

Rights on automated decision-making

We do not make decisions about you by automated means alone and we do not profile you in a way that produces legal or similarly significant effects. Advice and the fee we quote are decided by a person, and you can always query either with us.

How to exercise your rights

Email info@concreteaccounts.com with the word privacy in the subject line, or write to the registered office. Tell us which right you want to use and what the request covers. We may ask for proof of identity before releasing anything, which protects you as much as us. We reply within one month, and will tell you if a complex request needs longer, up to a further two months. There is no charge unless a request is clearly unfounded or repetitive.

How we protect your data

Your data is held in reputable cloud systems rather than on loose devices. Traffic to this website and to the software we use is encrypted in transit with HTTPS, and the providers we use encrypt data at rest. Access is limited to the people who need it for your work, protected by strong passwords and two-factor authentication, and removed when it is no longer needed. Devices are kept updated and locked. Documents are exchanged through secure portals or email rather than being posted around. If a breach happens that risks your rights, we will tell you and report it to the Information Commissioner’s Office within 72 hours. We review these measures regularly.

Cookies on this website

This website uses essential cookies that make pages and forms work, plus optional analytics cookies that tell us which pages bring enquiries. Optional cookies are set only if you agree, and you can change or withdraw that choice at any time. Our cookie policy at /cookie-policy/ lists each one and explains how to turn them off.

Children and under 18s

Our services are sold to businesses and this website is aimed at business owners, not children. We do not knowingly collect personal data from anyone under 18, except where a young person is on a client’s payroll and we hold their employment details to run it. If you think we hold a child’s data in error, tell us and we will look into it.

Changes to this policy

We update this policy when the law changes, when we start using new software, or when the way we work changes. The last reviewed date at the top shows the current version. If a change materially affects how we use your data, we will tell existing clients by email rather than relying on you to spot it here.

How to contact us

One address handles every data question.

We have not appointed a data protection officer, as we are not required to. Barnaby Byrom deals with data protection questions, subject access requests and complaints. Email is the quickest route, and it gives both of us a record of what was asked.

Data queries: info@concreteaccounts.com — We reply within one month, as required by UK GDPR. Data controller: Concrete Accounts Ltd, 82a James Carter Road, Mildenhall, Bury St Edmunds, Suffolk IP28 7DE (registered office). Companies House 14822426. ICO registration [ICO registration number — to be added].

Complaints to the ICO

If you are unhappy with how we have handled your data or your request, tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection. You can reach the ICO at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by phone on 0303 123 1113, or online at https://ico.org.uk/make-a-complaint/. Going to the ICO does not affect any other legal remedy open to you.